Jisc has worked in collaboration with FE members across Wales to produce this guide. It is also informed by research conducted by Jisc across other sectors and the experiences of Jisc working with members across the United Kingdom of their sustainable practices.
While the focus of this guide is on financial sustainability, much of the advice contained within will also help members improve their environmental sustainability and assist in planning towards net zero. Jisc's exploring digital carbon footprints report is a useful accompaniment to this guide and provides detailed information on the environmental impacts of technology.
Financial sustainability is of importance to FE providers across Wales. The Jisc/Welsh Government post-16 IT study highlighted concerns over the sustainability of additional equipment obtained to support remote learning and working for students and staff, much of which was purchased as a result of additional funding. Increased energy and equipment costs have also put pressure on providers to reduce costs wherever possible.
This guide provides advice and good practice from across the sector in Wales, and elsewhere based on Jisc’s experience of working with colleges across the UK.
The procurement of equipment should be managed and controlled by the IT team. All IT purchases should be submitted to and authorised by the IT team.
- Ensures value for money,
- Allows the IT team to ensure that devices are of an adequate specification, fit-for-purpose and have appropriate support, and
- Prevents duplicate and unnecessary purchases of equipment.
It is important when purchasing equipment to have strategic alignment and a good business case to ensure any spend is directly contributing to strategic objectives. Adequate training also needs to be in place for staff using devices to make sure they are used to their full potential. A good way to ensure this is by having information learning technology (ILT) champions to ensure equipment gets used.
Tech hubs to allow staff to practice using new technology in a safe environment away from students can also be beneficial in ensuring leveraging the best out of the technology you have invested in.
Procurement procedures are a standard part of college governance, however, they do vary across organisations. It can be tempting, especially when under time and/or financial pressures, to accept the lowest quote without considering other factors including reliability, ongoing support and expected lifespan of equipment.
Consider lifecycle cost
When purchasing, consider the total cost of ownership. If you can, find the total lifecycle cost and divide that by the expected lifespan of the device. It might be worth paying the extra for a device that will last another year. Google has a list for Chromebooks for example.
It’s also worth considering that purchasing Chromebooks is not the only solution. It is possible to reuse older Windows laptops by wiping them and installing Chrome OS onto them. There is, of course, a trade-off in that these devices are unlikely to last as long but it can be a good short-term and low-cost solution.
While the total cost of ownership is a useful metric in decision making, the current market situation which is affected by issues such as chip shortages may mean having to spend a little more over the lifetime of a device in order to secure equipment in a timely manner.
You don't always need to buy new
When purchasing equipment consider whether it must be brand new. There are other options available such as:
- Remanufactured: where servers, switches or laptops have been returned to the original manufacturer and been completely updated and refreshed and sold with a manufacturer’s warranty.
- Refurbished: This is often done by a third-party supplier. Refurbished can offer greater discounts but can be less reliable and may not be as long-lasting as remanufactured devices.
- Leasing: This can be useful for cashflow purposes. Analysis of the costs and benefits of leasing is recommended – it may not necessarily be cheaper than buying outright, but the cashflow and possible support benefits of having leased equipment may outweigh any additional costs.
2020-2021 Funding for devices
Many colleges received funding for equipment during 2020 and 2021 for devices which is unlikely to be repeated in the future. If you are planning to maintain the same number of devices, these will need to be replaced when they become end-of-life. Planning well in advance for the budget impact of this is recommended. Refreshing the large numbers of devices purchased, for example in response to Covid-19, may be challenging.
Most colleges have a documented replacement timetable for both end-user devices and core infrastructures such as servers, storage, and networking equipment.
Historically, timetables for replacement have been typically 3-5 years for end-user devices such as desktops and laptops. More recently, many have been increasing this as hardware becomes more reliable. It is not uncommon for refresh cycles of 5-6 years, especially for desktops.
While increasing the period devices are retained is recommended and can reduce costs, there becomes a point where the risk of failure becomes too great and can place an unnecessary burden on the IT team. Anything over 7 years is likely to increase that risk.
You should also consider if you need to replace monitors at the same time or rate as PCs. Monitors are frequently serviceable for several years more than a PC.
Stay on top of upgrades
The lifespan of devices can often be extended through low-cost upgrades. Many colleges have been able to hold on to equipment longer by replacing traditional hard drives with solid-state drives (SSDs) and/or additional memory. However, some devices are less maintainable.
Graphics Processing Units (GPUs) can also be added to move processing off the machine to the GPU. This is ideal for terminal-type environments. Online resources such as this laptop repairability guide can be useful in determining how easy it is to repair and upgrade specific laptop models.
Core infrastructure replacement cycles should be considered alongside vendor support timetables, maintaining equipment for as long as possible but within end-of-life dates.
Some vendors will offer a trade-in deal that can be used to offset the cost of replacement equipment such as servers and network switches reducing the overall cost.
Keep a database of equipment
You should also take steps to avoid unnecessary replacement of equipment. It can be useful to keep a database of equipment that can be used to audit what is being used.
Only devices that are being actively used should be replaced.
Further guidance on device utilisation can be found later in this guide.
The same principle applies for software licenses – records of these should be retained and usage monitored rather than automatically renewing licenses for software which is no longer required. License management tools are available for this, and many colleges use simple tools such as Excel to track licenses.
Bring your own device (BYOD) support
Most colleges allow staff and learners to connect their own devices to organisational wi-fi when on site. It is useful to have a written policy in place for BYOD to clarify what they can be used for and to document security considerations. Eduroam can be useful in providing access for BYOD devices in a managed way, reducing the overhead on the IT team.
Should you not wish to go down the eduroam route, most wi-fi controllers have built in radius servers which will provide identifiable, encrypted communications between devices. This provides secure and managed BYOD access, ensuring that web filtering and monitoring policies can be applied, and safeguarding requirements met. Shared key (WPA) access should not be used as any BYOD traffic cannot be identified to an individual user. Guest accounts issued to visitors should also be individual and allocated by reception for a specified time period. The use of a shared guest credentials increases the risk of these being used by learners rather than their college accounts, bypassing monitoring.
BYOD in situations where users can afford to purchase their own devices can reduce the cost of providing devices on loan but can increase management overheads as they attempt to connect a variety of devices, many of which may have been purchased at lowest cost and may not be entirely reliable.
There are examples where colleges have sought to overcome this by setting up a BYOD framework where users can purchase equipment to a specification determined by the IT team and negotiated by the college. This can help learners access reliable devices at a reasonable cost that they can then use throughout the duration of their learning journey. See an example at Cardiff and Vale College.
Supporting BYOD devices is also a consideration. At Neath Port Talbot College, the IT support team provide a limited about of support for students’ own devices, backed up by additional support on the use of devices by the LRC focusing on using devices rather than technical issues. Some colleges have moved to a shared library and IT helpdesk which may be an option worth considering. Limited resources within IT teams will make providing a high level of support for BYOD devices difficult. Liability is also a consideration when supporting personal devices – what would the consequences be if the IT team were to accidentally delete data from a personal device?
While most colleges have a helpdesk system, many are using either a basic version or are not taking full advantage of the asset management features of more advanced versions. Not only can these improve the user support experience, they can also help the IT team determine trends in failing equipment, allowing issues to be more easily addressed and can inform future procurement decisions, for example where equipment has been identified as prone to failure.
Device choice, maintenance, and management
This can be the most important decision in a sustainable device strategy. In the worst case staff may want, or have, a mobile phone, desk phone, tablet, laptop, and a PC on their desk. This could be in addition to a PC at the front of each class they teach in. Try to reduce the number of devices wherever possible. Neath Port Talbot College is moving towards a policy of one device per student or member of staff. Staff will be given a device, but bring your own devices (BYOD) for students is encouraged. Exceptions will be required for specialist areas such as engineering and computing which need specialist and/or higher specification equipment.
Docking stations can be useful in reducing the numbers of PCs in use and providing digital mobility. Laptops can be connected to a keyboard and monitor when used on site but can also be taken off site to allow for working from home or elsewhere. It is important to ensure that visual display unit (VDU) assessments are undertaken to ensure that docked laptops are being correctly and safely used. Laptops on their own should not be used for long periods of time without a docking station, keyboard, and monitor.
The quality and specification of devices is also an important consideration. While lower cost devices may reduce the upfront cost, the total cost of ownership is often higher, especially if device lifespans are lower and additional repair costs are incurred during their lifetime. Many colleges have documented a minimum specification covering features such as processor, RAM, storage size and type etc which can be useful when negotiating with vendors. Adult Learning Wales, for example, selects the brand and specification of devices based on their experiences of using devices and known reliability – the overhead of managing devices within a small IT team is a primary consideration.
Many devices have published end-of-life dates which can be found on the manufacturer’s website. An awareness of these dates can be useful when planning initial procurement and for determining when they will need to be replaced. It is also worth considering major components of core infrastructure and devices, for example, operating systems and processors – if they have already been on the market for a few years devices may go end of life sooner than expected.
Laptops are typically a choice between Windows or Chromebooks. Chromebooks can be a good lower cost option if your organisation is already invested in Google, however the management overhead may be higher if your device estate is primarily Windows-based. If using Chromebooks check the period for which they will receive auto-updates (the auto-update expiry date – AUE) – this is largely now an issue with older devices. Those devices released from around 2020 should receive updates for eight years. Once a device reaches its AUE it is by and large unusable.
Windows 10 is scheduled to go end of life on 14 October 2025. While some are already making a move to Windows 11, bear in mind that this has a much smaller, (restricted to newer hardware), compatibility list. There are specific requirements for devices to work with Windows 11, including processor specification and encryption. A full list of system requirements is available from Microsoft.
Devices bought in the last couple of years may well be impacted by this so may need to be decommissioned earlier than planned. Consider that many refurbished computers on sale even today are not on that list so may need to be decommissioned by 2025 to stay secure with Windows 11.
Planning for Windows 11 should begin as soon as is practical. The numbers of devices requiring updating or replacement may be higher than expected. An April 2022 Lansweeper audit of devices found that 55% of devices were incapable of being upgraded to Windows 11.
Laptops are typically a choice between Windows or Chromebooks. Chromebooks can be a good lower cost option if your organisation is already invested in Google, however the management overhead may be higher if your device estate is primarily Windows-based. If using Chromebooks, check the period for which they will receive auto-updates (the auto-update expiry date – AUE) – this is largely now an issue with older devices. Those devices released from around 2020 should receive updates for eight years. Once a device reaches its AUE, it is by and large unusable.
At Gower College Swansea, iPads have been requested but had very low usage compared to other devices. Usage was found to be inconsistent, in some cases devices stayed in cupboards for long lengths of time during the year.
Consider pooling and centralising lesser used resources, like tablets and laptops so their use is spread more.
There is a need to encourage the use of technology and available devices across the curriculum. Institutional cultural shift to embrace technology is important to ensure that not only the enthusiastic few make full use of the technology available.
Low usage of devices such as tablets can often be the result of poor connectivity, or a lack of knowledge on how to make best use of the technology. Improving wi-fi to allow casting from devices can increase the use of devices. Casting from a camera can be beneficial in areas such as hairdressing and mechanics so learners can just use the closest screen rather than crowding around a small area to see what is going on. Providing a tangible benefit such as this to both teaching staff and learners can increase the use of devices.
Many mobile phones stay disconnected and unused. Encourage users when requesting such devices to consider whether they really need them. Mobile devices in further education are only usually actively offered to senior staff and those who are working offsite, for example apprenticeships. For those staff who require basic telephony offsite, such as staff on class trips, a simple non-smartphone is likely to be adequate. Other settings may also provide a genuine reason for using lower cost and specification devices – in healthcare, for example, many sites do not allow phones with cameras.
Policies and management for issuing devices to staff and learners for use offsite vary by organisation. Sometimes this is managed by the IT team, sometimes the library or learning resource centre (LRC) are responsible.
A benefit of offering loaned devices (or loaned devices combined with BYOD) is that greater use of e-books can be made, which can lower library costs. Many colleges in Wales are actively reducing their stock of hard copies in favour of e-books.
At Grwp Llandrillo Menai, the move to loaned devices and BYOD has also resulted in a big fall in demand for drop-in IT areas within the LRC. PCs are being removed from these spaces, which are being converted into more flexible social spaces. Neath Port Talbot College is also finding that bookable computer rooms in the LRC are not being well used due to BYOD and loaned devices.
Grwp Llandrillo Menai had previously means tested loan devices providing them only to those with the greatest needs. Now all learners can access a loan device – while this can be of benefit to learners it can also discourage those who would have ordinarily bought their own device from doing so.
It is an inevitable fact that a percentage of loaned equipment will not be returned to the college at the end of courses, or as staff leave. In the case of both Grwp Llandrillo Menai and Neath Port Talbot College this, however, has been lower than anticipated. At Neath Port Talbot College they have even experienced learners returning devices after being given a laptop as a Christmas present, so encouraging learners to hand back equipment when no longer needed can be beneficial.
An asset register should be maintained with contact details to ensure wherever possible, equipment can be retrieved and reallocated to another user.
Even when devices are returned, learners often do not look after them, so there will be damaged devices to deal with, potentially with missing cables and peripherals or requiring a more substantial repair. Neath Port Talbot College found that using the library system to loan out devices, treating them almost like a book, has worked well and encourages learners to treat the devices with respect. The ability to make devices unusable once they have been recalled has also encouraged their timely return.
The risk of damage to equipment can be difficult to mitigate, but some preventative measures can help, for example ensuring laptops are issued with a travel bag.
In addition to standard equipment for teaching and learning such as desktops, laptops, whiteboards etc, some courses require specialised equipment, for example eSports which requires high specification gaming PCs. Many colleges in Wales have received additional funding for such devices.
Careful consideration should be made to the future sustainability of such devices. Jisc is aware of some colleges who have received funding for an initial classroom fit for eSports, however replacement will need to be funded from existing college budgets.
Equipment such as virtual reality (VR) headsets is often purchased as part of projects – effective management to ensure the most effective use of equipment is recommended. Neath Port Talbot College has set up a VR project group. They also manage devices centrally to make sure they are widely accessible and maximise use.
If your college is looking to purchase VR headsets, consider some of the potential associated costs. Some devices require a very high specification of PC and graphics card for them to run on, which may require additional equipment. Even high specification gaming PCs within your organisation may still need upgrades in order for some headsets to work.
Oculus Quest (Meta) headsets can be a lower cost option. Until now, these have required a Facebook or Instagram account to operate, which can cause issues in a college environment. As of August 2022 a separate Meta account for the management of headsets is all that will be needed, which may make them a more viable choice – one account per headset will be required.
Device and software use
Software is available to monitor the use of devices, particularly in classrooms, to ensure equipment is being used to its full potential, and any excess equipment can be earmarked for disposal without replacement at the next refresh cycle.
Powerman, Sassafras Keyserver, and Labstats are examples of software in use by colleges. This type of software can monitor all devices on the network, providing information on idle time, usage time, devices left turned on overnight etc. Neath Port Talbot College has recently started using Powerman – the data from the software will be used in collaboration with Estates and timetabling. The college has an ultimate aim of having a completely ‘dark campus’ out of hours, with no devices remaining switched on which do not need to be.
Some also monitor the use of PCs in shared areas such as learning resource centres through periodic manual headcounts where the space and staff overhead allows them to do so.
Make sure actual usage is being recorded – just because a device is switched on does not necessarily mean it’s being used. Ensure the student records system and timetabling are up-to-date so you know what rooms should be in use at a given time.
It is also important to consider that comparison of usage statistics can be difficult given restrictions throughout 2020 and 2021 caused by Covid-19 when capacity restrictions on campus were in place. It may be useful to collect usage statistics in 2022 as a baseline for future comparison.
During the peak of the Covid pandemic, hundreds of laptops were purchased. Some colleges have however seen lower device utilisation than expected, particularly as staff return to work on their ‘desk PC’ onsite.
Gower College Swansea is considering a ‘one device per person’ strategy going forward; removing the box on the desk and enabling staff to use their laptops onsite with a docking station and monitor.
Monitoring software use is also important. As noted above, an audit of software licensing should be maintained. In addition, solutions such as AppsAnywhere and Windows Server Remote Apps can provide a software library that users get a leased use of and can take wherever they are – encouraging off-site working and home working.
Monitor device power usage
It can be beneficial to monitor power consumption across the IT estate. Older equipment, particularly servers, networking and telephony equipment can consume significant amounts of energy compared to newer equipment. Higher specification machines such as those used for gaming and e-sports can also consume significantly higher amounts of power compared to standard PCs. Power meters can be helpful in identifying any equipment which is consuming excessive power.
As the cost of energy increases, this is likely to become a more important factor in determining which devices to purchase in the future.
Laptops typically use less energy than desktops, but if used with other peripherals such as a monitor and docking station, the energy consumption of these needs to be factored in. Online calculators can help you work out the energy costs of desktops and laptops.
Employ power management software
In addition to monitoring the utilisation of devices, Neath Port Talbot College is using Powerman to deploy power management profiles to devices – these can be applied at a granular level applicable to an individual machine through to the entire device estate. The college expects the initial investment to be more than repaid in reduced energy costs.
Some potential power savings include:
- For laptops, think about updating policies for waking devices on LAN – most updates require a shut down so while power management is important, you should also ensure that devices are being woken up and shut down frequently enough to make sure they are being kept up to date.
- For desktops (such as classroom sets), policies can be put in place to shut down after a certain time and to shut down screens. It can also be possible to link policies to timetables to ensure that devices aren’t left on when they are not needed. Many colleges leave machines turned on all the time which adds a significant and unnecessary energy cost.
- Moving to virtual desktops also has the potential to reduce power costs. Using a client/server model, servers use additional power themselves, but this is better optimised. Thin clients will use less power compared to a room full of PCs and despite the increased server power requirements, this can result in an overall saving.
Consider the layout of server rooms
Server rooms and data centres within organisations are a major source of power consumption. Cooling can account for around 50% of the total energy cost to run a server room.
Consider having hot aisles and cold aisles to create an energy-efficient layout for server racks and equipment. This will prevent hot and cold air from mixing, for example by having cold aisles facing air conditioning ducts. You should also have raised flooring to allow for good ventilation all the way through, allowing air conditioning to push air through the space. The installation of both high- and low-positioned air conditioning units can also provide more efficient cooling.
Blade enclosures can also provide a better power optimised solution than rack mount servers.
Reduce your costs
Environmental controls such as temperature and moisture sensors not only ensure the server room is at an optimum temperature, potentially reducing energy costs, but it also reduces the risk of equipment becoming damaged or destroyed by overheating (for example should air conditioning fail).
Insulation can also reduce cooling costs in summer, as can blocking up windows if there are any in the server room to eliminate the need to cool heat generated by sunlight entering the room.
Cabinets within server rooms can also impact power usage depending on how they are configured. Holes in cabinets can result in poor airflow and thermal efficiency.
Repurpose excess space
Another consideration is room size. Where possible, server rooms that are larger than required should be optimised and excess space repurposed.
Many new build colleges constructed in the last 10-15 years had server room specifications determined as part of the build. These were often larger than required and future-proofed for expected expansion as demand for services increased. The reality, however, is that demand for server room space has often decreased as increased use of cloud is made.
If this applies to your organisation, consider whether the footprint can be reduced to save energy and estates cost. Another alternative may be to make use of excess capacity to other organisations, for example offering infrastructure or server room space to other colleges as a disaster recovery environment perhaps on a reciprocal basis.
With the advent of collaborative platforms, such as Microsoft Teams, together with cloud-based storage such as OneDrive, the requirement for producing hard copies of documents has significantly reduced.
Neath Port Talbot College actively discourages printing for staff and students unless essential. Office printers have been removed and Multi-Function Devices (MFDs) have been installed in strategic locations.
Adult Learning Wales has also moved away from printers and copiers in offices to communal facilities in their efforts to reduce printing. Home working, however, has increased requests from staff for portable printers. Efforts are made to discourage the use of portable printers and alternatives offered such as dual screens.
Gower College Swansea sets annual print reduction targets.
Reports on print usage are commonplace across the sector to monitor usage and to encourage a reduction in printing levels.
Using software such as Papercut and Pcounter which is commonplace across colleges, students can be provided with a termly printing quota for free. If a student needs to exceed this quota, they must top up their accounts using their own finances.
There is a mix of internally managed print services and managed print contracts offered by vendors, often on a ‘cost per copy’ basis. Which is best will depend on individual circumstances. However, it is worth considering that the trend of managed print contracts to ease device replacements can cause unnecessary early disposal of printers where the environmental cost may be large.
For bulk and non-urgent printing, consider establishing a contract with a local print shop if your organisation does not have its own reprographics facility. These typically operate on a turnaround time of a few days, but print costs can be much lower for larger jobs such as sets of materials at the start of the academic year.
Data centres represent a recurring cost. They require staff and equipment replacement. Moving to the cloud moves the responsibility to someone else, freeing up IT team time which can be dedicated to more strategic and user-focussed tasks to deliver service improvements. If managed well, a move to cloud can also reduce costs.
Some colleges are adopting either a ‘cloud-first strategy’, moving as many systems and services as possible to the cloud, others are adopting a hybrid approach, with some services in the cloud and others remaining on-premise. Neath Port Talbot College is moving a number of services to cloud including the finance system. As services reach end-of-life consideration is made as to whether they can be moved to the cloud.
Software as a service (SaaS)
Moving on-premise applications to cloud can deliver a number of benefits. Not only does it reduce the requirement for hardware within server rooms, but it also typically means the management of software such as patching is no longer required by the IT team, freeing up time for other tasks.
Cloud software is typically licenced on a per-user basis, whereas a lot of on-premise software can be purchased on site licenses. In both cases where licensing is on a user basis, careful monitoring is required to reduce the number of unnecessary licenses in use.
If your organisation has a Microsoft 365 or Google Workspace subscription, users should be encouraged to use the available OneDrive or Google Drive storage rather than home drives to reduce the overhead on local storage. Many colleges who have moved to Microsoft 365 or Google have found that their total storage requirements, after long periods of growth, have started to fall.
At Neath Port Talbot College, the long-term plan is to move the shared drives in to Teams for staff and students. They have already moved all learners to Microsoft 365, this has reduced the on-site storage and given easier access to learners’ work when they are offsite. All new staff go straight onto Microsoft 365 storage and staff are being moved from Azure to Microsoft 365 so that all staff and student data is in one place.
Infrastructure as a service (IaaS)
Some colleges are opting to move away from on-premise infrastructure such as servers to the cloud. This may not necessarily be the cheapest option, and there are ‘hidden costs of cloud’ given that billing is often based on the amount of data transfer. Costs can also be based in US Dollars, so are subject to volatile exchange rates.
When considering cloud, the total cost may or may not be lower but other factors such as the management overhead on the IT team, reduced server room estate and additional resilience should also be considered.
Case study: Neath Port Talbot College
At Neath Port Talbot College on-site servers were due to be replaced in the summer of 2021. They decided to move as many of their on-site servers to Microsoft Azure. Over the last 8 months they have made great progress with no loss of service to the end user.
The next steps of the project are to move on-site systems to Azure. Many systems are already hosted externally, however, there are a few remaining systems to migrate including finance and student records.
This project will save approximately £100,000 a year due to not having to replace onsite servers. In addition to the cost savings, the project will also reduce the college’s carbon footprint. The two main data centres will be redesigned and reduced significantly, releasing more room for teaching and learning.
Significant cost savings can be leveraged from cloud hosted services by shutting down systems overnight and at weekends when not in use.
IaaS for backup may end up cheaper as while data needs to be put up to the cloud, there is only typically a need to retrieve data if there’s been an incident or to test restore procedures as part of business continuity and disaster recovery planning. The reduced reliance on local storage can also result in a reduction in hardware and energy costs, although this needs to be offset by the additional cost of cloud backup. Disaster recovery environments in the cloud are also becoming more common, working in a similar way to cloud backup with reduced reliance on equipment on site, and services in the cloud only spun up if they are required.
Data retention policies
Good data governance practices ensure that information is held and used in an efficient way, aiding compliance with legislation such as the General Data Protection Regulation (GDPR). By also ensuring that data is well managed, with regular housekeeping and expiry dates you can help to ensure that data is not kept for longer than required. This in turn helps to minimise the amount of data storage required. Whether you are using a cloud or on-premise storage solution, reduced hardware, cloud, and energy costs can be realised.
A huge amount of data in the sector is stored and never used again. Reports suggest that up to 90% of stored data is never accessed once stored and only 6% of cloud data is used regularly. Discouraging the practice of data hoarding can help to reduce costs.
Backups should also be reviewed, especially if being backed up to the cloud and incurring costs based on the amount of data transferred. Many organisations still routinely back up data from legacy systems which is no longer needed for example.
There have been many hardware related security incidents in recent years. Making sure equipment is up to date and patched in a timely manner is essential in reducing the risk of a cyber attack. Implementing some of the recommendations in this guide will have security implications that need to be considered, and adequate management practices put in place.
Cyber essentials is a funding requirement for further education (FE) providers in Wales and is becoming increasingly required elsewhere in the UK. Recent changes as part of the Evendine question set release have brought in additional requirements which must be adhered to.
Cyber essentials requires all hardware and devices to be under vendor support and able to receive critical security updates. This means that you may have to bring some devices to end of life early.
For cyber essentials certification, only staff devices are considered in scope – student devices are exempt. This means that older, unsupported devices which would result in a cyber essentials fail can be used by students as bring your own devices (BYOD).
If you are using a VLAN combining both staff and student devices they will all need to be subject to the same rules, preventing student devices that are legitimately being used from connecting to the college network. Having separate VLANs for staff and student devices means students can be excepted so older hardware can still be used, preventing them from having to potentially pay for updated BYOD devices. Older college owned equipment that can no longer be used by staff also could be offered to students.
Planning should also take place as soon as possible in preparation for multi-factor authentication (MFA) which is already a cyber essentials requirement for staff and will become a requirement for students accessing organisational systems from next year.
Equipment disposal, recycling, and reuse
When equipment is no longer required and cannot be repurposed internally there are options when it comes to disposal. The most common disposal method is to appoint a waste electronic and electrical equipment (WEEE) approved company to take the equipment, ensure data is fully deleted and a certificate issued.
Jisc has worked with colleges elsewhere in the UK that have come up with some innovative ways of disposing of equipment including:
- Setting up an eBay shop to sell on core infrastructure which had reached end of life for the college, but still had some value. Only equipment which would not represent a security risk to the college (for example through the risk of college data being recoverable) is considered for sale. The funds raised from such sales in one example was retained by the IT team and ringfenced for staff development.
- A number of colleges have worked in partnership with local schools to provide them with equipment once end-of-life. This has proved more challenging in recent years, especially with Covid-19 requiring additional devices such as laptops to be found for remote learning.
- Some colleges sell old equipment to staff and students. This is generally subject to an agreement that the equipment is sold ‘as is’, with no further support provided by the IT team.
- A number of colleges have agreements with their approved suppliers to dispose and recycle end-of-life equipment. This can include buy-back schemes that can provide a small revenue stream back to the college for equipment that is no longer required. Gower College Swansea, for example, uses Stone Computers, which collects equipment and provides full disposal documentation. 80% of equipment collected is refurbished or reused.
It is also worth considering if components can be re-used at end of life, such as SSDs from laptops or PCs and RAM from decommissioned equipment to keep other machines running longer. St David’s Catholic Sixth Form College retains some end-of-life devices for spares.
Jisc subject specialists can provide additional support in implementing some of the good practice recommendations in this report. Contact your Jisc relationship manager to arrange an initial discussion.
Jisc would like to thank the following for their contribution to the guide:
- Neath Port Talbot College
- Gower College Swansea
- Cardiff and Vale College
- Grwp Llandrillo Menai
- Adult Learning Wales
- St. David’s Catholic Sixth Form College