EdCircuit Staff 
School cybersecurity helps keep classrooms running and protects the information families trust schools to hold. Schools rely on connected systems to record attendance, access emergency contacts, deliver lessons, and communicate with caregivers. When access disappears, employees still have to carry out those responsibilities.
A data breach creates a different problem. Restoring a service does not resolve questions about information that may have been exposed or stolen. Families need answers, and districts need a process for providing them.
October’s Cybersecurity Awareness Month is an opportunity to examine how well schools are prepared for both situations. The National Cybersecurity Alliance’s 2026 campaign promotes familiar practices: strong passwords and password managers, multifactor authentication, recognizing and reporting scams, and software updates.
District leaders determine how those practices work in schools. They approve services, establish access rules, and provide the support employees need to use technology securely. October’s reminders become more useful when they lead to improvements in that everyday work.
How districts are strengthening security
Schools are investing in protection. CoSN’s U.S. State of EdTech 2026 report, based on 607 district survey responses, found that 72 percent reported investing in cybersecurity monitoring, detection, and response. Resources remain a concern: 65 percent reported insufficient cybersecurity staffing, and the same share identified the lack of a dedicated cybersecurity budget as a barrier.
District examples show what those investments can involve. Pennsylvania’s School District of Springfield Township describes device protection, multifactor authentication, and phishing awareness training that includes practice exercises and simulated tests. California’s Lynwood Unified School District reports multifactor authentication for all staff, network monitoring, and tools for detecting and responding to threats on devices.
Each measure addresses a different need. Multifactor authentication, or MFA, requires an additional step beyond a password to sign in. Device protection helps defend laptops and other equipment. Monitoring helps technology teams identify activity that needs investigation.
Maintaining those protections takes people and time. Someone must review alerts, help employees establish secure access, and close accounts when staff leave. District leaders need to understand how that work is assigned and covered when an employee is unavailable.
A useful security review connects the technology to its operation: what is protected, who maintains the protection, and how the district knows it is working.
Review the services that hold school information
A district may rely on separate providers for student records, classroom assignments, transportation, and family communication. Security planning needs to account for how each provider handles information and grants access.
The PowerSchool breach illustrates that responsibility. PowerSchool became aware of the incident on December 28, 2024, and notified affected school customers in January 2025. In its January 10 notice, Tipp City Schools explained that a compromised credential in PowerSchool’s PowerSource support portal allowed unauthorized access to certain student and staff data. The district stated that the incident occurred at the vendor level and that its own systems were not compromised.
The example raises a question every district should investigate: how does a provider protect the accounts and systems through which it can reach school information?
Before approving a service, determine what information it needs and why. A classroom practice tool may have little reason to collect details required for a student information system. Limiting unnecessary collection reduces the information a district must account for if something goes wrong.
Vendors should explain who can access records, how remote support access is authorized, and how that access ends when the work is complete. Districts should request evidence of safeguards and establish a contact who can respond during an incident.
Free tools deserve the same attention when they handle student information. Teachers need a straightforward review process and access to approved options. Evaluating a service’s security should not become an additional responsibility an individual teacher must manage alone.
Test recovery against the needs of a school day
Recovery planning should begin with the work a school must continue.
A discussion-based exercise can make that work specific. Suppose the student information system becomes unavailable shortly before students arrive. Principals and office staff would explain how attendance will be recorded and how authorized employees will reach emergency contacts. Technology staff would identify which recovery steps they control and which depend on a provider.
The exercise should also examine communication. If the usual messaging platform is unavailable, families still need reliable updates. Staff need to know which alternate channel to use and who will prepare and approve the message.
Working through the scenario can reveal problems while there is time to correct them. An alternate contact list may be outdated. A communication plan may depend on the same service involved in the disruption. Finding either problem during practice gives the district a chance to resolve it before an emergency.
Backups require verification, too. Technology teams should test whether essential information can be restored and document how long restoration takes. Leaders can then plan around a demonstrated recovery process rather than an assumption about how quickly services will return.
CISA introduced a K–12 Cybersecurity Foundations Resource Package in August 2026. Its school safety bulletin describes guides, videos, and supporting materials for school leaders and technology professionals working to prevent, mitigate, and respond to cyber threats. The collection offers resources for districts reviewing their own programs.
Help employees make secure decisions
Security decisions arrive in the middle of other responsibilities. A teacher receives a shared document while preparing a lesson. An office employee sees an urgent request to change payment information. A principal receives a message that appears to come from a colleague.
Training should give employees a way to evaluate those requests. Short exercises can ask staff to identify what a message wants them to do, explain how they would verify it, and demonstrate where they would report a concern.
Employees also need clear instructions for what to do after clicking a suspicious link or entering information. The reporting route should be easy to find, and the first response should encourage prompt communication. Thank the employee, gather the details, and follow district procedures. Public embarrassment can make the next person hesitate.
Secure access needs practical support as well. MFA instructions should be understandable, with an approved option for employees who cannot use a personal phone. Substitute teachers need access appropriate to their duties. Staff should know how to resolve a sign-in problem without borrowing a colleague’s account.
These details make district expectations workable. Leaders can review them with the people who use the systems and correct obstacles that encourage unsafe workarounds.
Give families clear information
Families trust schools with information about their children. Communication during an incident should reflect that responsibility.
Explain what is known, which categories of information are involved, and what families should do next. Identify the actual information affected instead of relying on the broad phrase “student data.” State what remains under investigation and update families as facts are confirmed.
Keep notices in a consistent location accessible through the district’s known website. Explain how caregivers can verify an unexpected request, particularly one asking for credentials or payment.
That guidance is useful before an incident, too. Families should know the district’s usual communication channels and where to ask questions about school accounts. Clear school procedures support the verification habits children are learning at home and in class.
Keep the work moving after October
Districts can finish Cybersecurity Awareness Month with specific improvements underway. A leadership team might correct an access problem, act on findings from a recovery exercise, or establish a regular review of vendor safeguards.
Each task needs an owner and a date for checking progress. At the next leadership or board meeting, the discussion can focus on what was completed, what was tested, and what still needs attention.
This gives leaders concrete evidence to review and employees clearer procedures to follow. It also keeps cybersecurity connected to the work of operating schools throughout the year.
Students need instruction of their own, supported by those adult responsibilities. The next article in this series examines middle school cybersecurity and how schools can help students verify requests, protect accounts, and seek help when something goes wrong.
Part 1 of edCircuit’s Cybersecurity Awareness Month series
Subscribe to edCircuit to stay up to date on all of our shows, podcasts, news, and thought leadership articles.
