Home / Insights / Safeguarding vs risk and continuity — what changes when IT moves from education to business

Safeguarding vs risk and continuity — what changes when IT moves from education to business

Four months ago I moved from IT in education to IT in business. The tools looked familiar. The reason for using them did not.

In schools and nurseries, every tech decision starts with safeguarding: who can see what, what gets filtered, and how we keep children safe online. That culture shapes everything — account design, filtering, device policies, even how you talk about a “quick share” of a document.

In business, the same decisions start with risk and continuity. The question becomes: what happens to the company if this system goes down? Who can reach commercial data? How fast can we recover email, finance, or the line of business app that keeps orders moving?

Microsoft 365, firewalls, access controls — the stack is often identical. What changes is the why behind them. That shift in framing is easy to underestimate if you have only ever worked in one sector.

Same tools, different north star

Education IT teams are quietly brilliant at data protection culture. Staff learn early that children’s data is not something you improvise with. Least privilege is not a buzzword; it is how you sleep at night. Filtering and monitoring exist because the organisation’s duty of care is visible every day.

Businesses are often stronger at planning for scale and for failure. Continuity plans, supplier dependencies, backup tests, and “what if the finance system is offline on month-end” conversations sit closer to the surface. Growth, multi-site ops, and commercial pressure push IT to think in resilience, not only in locked-down access.

Neither mindset is complete on its own. A school that never stress-tests restore times can still leave people stranded. A company that obsesses over uptime but treats access as an afterthought still leaks risk through leavers, shared mailboxes, and “temporary” admin rights that never expire.

What carried over for me

Moving sectors did not mean throwing away the education playbook. It meant translating it.

• Who can see what still matters — commercial and customer data deserve the same care as pupil records, even if the legal labels differ.
• Clarity beats cleverness — busy staff need simple paths. If the secure way is the awkward way, people will invent workarounds.
• Culture is a control — policies on paper matter less than whether people feel safe to ask before they click or share.

What I had to re-weight was continuity. In education, a site going offline is serious; in business, downtime often hits revenue, suppliers, and reputation in the same afternoon. Risk registers and recovery objectives are not bureaucracy when the business depends on them.

I also had to unlearn the assumption that every decision would be framed first through safeguarding language. In business the opening question is often operational: can we trade, can we pay, can we talk to customers? The access and protection work still has to happen — it just sits inside that continuity conversation rather than replacing it.

A practical bridge between the two

If you are bringing education habits into a commercial setting — or the other way round — start with the shared ground:

1. Map the systems that hold sensitive data and the systems that keep the organisation running. They overlap, but they are not the same list.
2. Ask “who can see this?” and “what if this dies at 9am?” for every important platform.
3. Design access and recovery so busy people can do the right thing without a specialist on every call.

That is the work that travels between sectors: not a different brand of firewall, but a clearer reason for how you configure it. If you have moved between sectors yourself, the useful question is the same one I keep asking: what carried over for you, and what did you have to unlearn?