The DfE MIS framework
Built to the Department for Education’s MIS requirements.
DfE publishes its approved list of MIS suppliers in November 2026, and from May 2027 schools must choose an MIS from it. SOS has been built to the published requirements, and this page shows how.
Core functions
The minimum DfE expects of an MIS.
The core functions DfE has confirmed for every MIS, and where each stands in SOS today.
| Requirement | In SOS | Status |
|---|---|---|
| School census | Built from the school’s records and checked against DfE’s own validation pack before upload. Autumn now; spring and summer as DfE issues each term’s pack. | Autumn now |
| Pupil data | Identifiers, UPN generation, ULNs, demographics, free school meals with category and verification date, funding indicators and early years hours. | In place |
| Relationships | Contacts with parental responsibility, priority, court orders and restrictions, and linked siblings. | In place |
| Admissions and transfers | CTF and ATF import and export, admission without a file, leavers with DfE’s reasons, managed moves, and schools moving between trusts. Files are exchanged with School to School by hand. | In place |
| Attendance | AM and PM registers on DfE’s codes, persistent and severe absence, and session counting as DfE does it. The daily attendance share is collected through Wonde. | In place |
| Staff and the workforce census | Staff records for the workforce census, with the return checked against DfE’s 2026 rules. | In place |
| SEND, looked-after, safeguarding and behaviour | SEN provision and needs, EHC plans, care episodes, child protection plans, suspensions and exclusions, as the census needs them. | In place |
How it runs
Security, resilience and accountability.
| Requirement | In SOS | Status |
|---|---|---|
| Cloud software as a service | One service for every school, each with its own database. Nothing for a school to install or patch. | In place |
| Certification | Cyber Essentials Plus. | Certified |
| Role-based access | Pages and actions gated by permission, with roles a school can make for itself. The older classic screens, which use role names, are retired in October 2026. | Finishing |
| Audit log | Changes, views, downloads and sign-ins, kept for six years. The database refuses edits and early deletion. | In place |
| Backups | Nightly, locked against deletion for 35 days, with a restore of every school tested each month. | In place |
| Availability | Every school monitored every five minutes, with a public status page and monthly figures. | In place |
| Vulnerabilities | Dependencies audited on every change and daily, with a written policy for fixing critical and high issues. | In place |
| UK GDPR | Retention periods agreed by the school, erasure on request, subject access exports, and no comparison across trusts without written consent. | In place |
Data ownership and interoperability
The school’s data, available to the school.
DfE makes these conditions of appointment. In SOS they are part of the product, not a request to support.
Bulk export, any time
Every table as CSV with a data dictionary, made by the school whenever it likes, never switched off.
An open API
A documented, versioned REST API, with a token for each client that the school creates and revokes.
A published dictionary
Every table and column described, generated from the database so it cannot drift.
An exit export
A complete export with relationships intact, made before a contract ends and held until it is collected.
API after you leave
The API keeps answering after the contract ends, until your next supplier is accepted.
Deletion on exit
Your data deleted when you go, with a certificate listing what was removed.
In SOS
The framework, on the school’s own pages.
Each module mapped to DfE’s list, and retention periods the school agrees.
Our self-assessment
We keep a detailed self-assessment of SOS against every requirement in DfE’s framework, including the few we are still finishing. Email us and we will send you the latest copy.