Higher education regularly experiences cyber attacks. Organisations that do not adequately protect themselves risk the loss or exposure of personal student and staff data and also commercial, institutional and research data that are valuable to cyber criminals operating domestically and internationally. This paper discusses: (1) the current security landscape for UK higher education and research; (2) the types of incidents higher education providers face that could lead to significant data breaches or loss of access to data; (3) the types of questions governors and students should be asking their institutions' leadership teams; and and (4) the minimum requirements and tools providers should have in place as a framework for protecting themselves and the sector as a whole.