A school district holds more identity data per person than almost any organization a child will meet before adulthood: a legal name, a date of birth, a home address, often a Social Security number, sometimes an immigration status, a health file, a disciplinary record and the household income figure behind a free lunch application. It holds that data for people whose credit files nobody will look at for another decade. And it defends that data on a budget where the security line, when there is one at all, competes with a bus route.
That is the sector in one paragraph. What most district leaders find hardest to believe is the next part: the federal law everyone names in this conversation does not set a security standard at all.
Why Cyber Security for Schools Is Different
Three things separate this sector, and every sensible spending decision follows from them.
There is no federal security rule to point at. A hospital has a regulation that names administrative, physical and technical safeguards, which is why cyber security for healthcare starts with the rule and works outward. A school district has no equivalent. FERPA, CIPA and COPPA each touch student data from a different direction, and none of them is a security standard in the sense a CFO or a board member means when they ask what the district is required to do. The practical effect is that a district cannot outsource the judgment to a regulation. It has to make the judgment itself.
The data ages well, and that is the problem. A stolen payment card is cancelled within hours. A seven-year-old's Social Security number sits unused for eleven years before anyone applies for a student loan in that name and discovers what happened. Nobody runs a credit check on a second grader. By the time the fraud surfaces, the incident is long closed, the notification letters are archived, and the connection back to the district is unprovable.
The budget floor is real and it is documented. The Center for Internet Security, which runs the MS-ISAC that most districts join, found that the average school spends less than 8 percent of its IT budget on cyber security, with one in five committing less than 1 percent. Its own summary of the sector is the phrase worth repeating at a board meeting: schools are data-rich and can be resource-poor, which is exactly what makes them attractive.
What Regulations Apply to School Cyber Security
Four bodies of law touch a district's data, and they do different jobs. Reading them in the wrong order is how districts end up with a signed compliance binder and an unpatched server.
FERPA governs disclosure, not security
The Family Educational Rights and Privacy Act, implemented at 34 CFR Part 99, gives parents and eligible students the right to see education records, to seek to have them amended, and to control the disclosure of personally identifiable information from them. It is written as a consent statute. It tells a district when it may hand a record to somebody else, and it is silent on how the record should be stored.
The closest FERPA comes to a technical control is in the exception that lets a district share records internally without consent.
That last sentence is the entire security content of FERPA, and it is conditional. The rule assumes a district might have no technological access controls at all and tells it to have a policy instead.
Enforcement matches that shape. Under 34 CFR 99.67 the Secretary of Education may withhold further payments under an applicable program, issue a complaint to compel compliance through a cease and desist order, or terminate eligibility to receive funding. The sharper tool sits at the end of the same section: where a third party improperly rediscloses information from education records, the district it came from may not give that third party access to student records for at least five years. FERPA's real enforcement against vendors is exile, not a fine.
CIPA ties filtering to E-Rate money
The Children's Internet Protection Act reaches districts through the universal service discount program. 47 CFR 54.520 requires the billed entity for a school receiving discounts for internet access or internal connections to certify on FCC Form 471, in each funding year, that an internet safety policy is being enforced, and that the policy includes a technology protection measure blocking access by adults and minors to visual depictions that are obscene or child pornography, and by minors to material harmful to minors. An authorized administrator may disable the filter for an adult engaged in bona fide research or another lawful purpose.
CIPA is a content rule wearing security clothing. A web filter that satisfies CIPA does incidentally block some malicious domains, which is why it often ends up as the only line in the technology budget that a business manager can defend without argument. It is not a substitute for anything else, and treating the E-Rate certification as evidence of a security program is the most common category error in this sector.
COPPA puts the security obligation on the vendor
Here is the part almost nobody in a district knows. The Children's Online Privacy Protection Act rule covers operators of websites and online services directed to children under 13, which describes most of the ed tech catalog a district buys. And unlike FERPA, the COPPA rule does contain a genuine security mandate.
16 CFR 312.8 requires an operator to establish and maintain reasonable procedures to protect the confidentiality, security and integrity of personal information collected from children, and, at a minimum, to establish and maintain a written information security program with safeguards appropriate to the sensitivity of the data and the operator's size and activities. The program must designate one or more employees to coordinate it, identify internal and external risks and reassess them at least annually, design and maintain safeguards sized to the volume and sensitivity of the data at risk, and regularly test and monitor whether those safeguards work.
Read that against the FERPA text above. The strongest security requirement anywhere in federal law touching a child's school data binds the supplier rather than the district. A district cannot be cited under it, but it can and should ask every vendor holding student records to produce the written program that section requires.
State law is where breach notification lives
Because FERPA carries no notification duty, the letter a family receives after a district incident is written to satisfy a state statute. Every state has a data breach notification law, and a number of states have added student-data-specific duties on top, with New York's Education Law 2-d the most detailed example. Timelines, the definition of a reportable event and the duty a contractor owes the district all vary by state, which is why the first call in a school incident is usually to counsel rather than to a forensics firm.
What Student Data Is Worth to an Attacker
A district record is not one thing. It is a stack, and each layer is worth something different to a different buyer.
The identity layer is a name, a date of birth, a home address and, in most student information systems, a Social Security number collected for state reporting or for a benefits program. That set is enough to open credit. The eligibility layer, free and reduced-price lunch status, is a household income statement. The special education layer holds an individualized education program, which is a psychological and medical document. The health layer holds immunization records and medication lists. And the staff side of the same system holds payroll, direct deposit routing numbers and W-2 data, which is why school finance offices see a seasonal spike in fraudulent payroll change requests every January and February.
The middle layer is where most districts have the least visibility and the fewest controls, and the bottom layer is the one FERPA actually asks about. Records encrypted at rest in the student information system and separated by role are worth substantially less to whoever gets in, and role separation costs nothing but the afternoon it takes to review who holds which permission.
The Cyber Attacks That Actually Hit School Districts
Vendor pages list every threat that exists. The sector's own information sharing center publishes what actually landed, and the shape is narrower than the lists suggest.
The Center for Internet Security and the MS-ISAC studied more than 5,000 K-12 organizations between July 2023 and December 2024 and found that 82 percent of reporting schools experienced cyber threat impacts, across 14,000 security events and 9,300 confirmed incidents. The US Department of Education, citing the K12 Security Information eXchange, puts the running rate at an average of five cyber incidents a week across districts nationally.
The traffic data underneath those incidents is more useful than the headline. CIS reports that its protective DNS service handled more than 225 billion DNS requests for enrolled K-12 entities and blocked 423 million of them, with 78 percent of that blocked activity associated with malware. The same analysis found that K-12 organizations do comparatively well on identity management, access control, and awareness and training, and struggle with protective technologies such as audit log management and malware defenses. That is the profile of a sector that has bought policies and training but not tooling, which is exactly what a constrained budget produces.
The chain itself is consistent enough to draw.
- A staff mailbox or a vendor account is takenA phishing email, a reused password, or a call to a help desk asking for a reset
- Quiet reconnaissanceReading mail, finding the student information system, learning the pay cycle
- Privilege escalation to an admin accountOften a shared or service account nobody owns
- Bulk export of student and staff recordsIdentity, eligibility, special education and payroll data together
- Extortion, sometimes without encryptionIncreasingly a threat to publish rather than a locked network, so backups do not resolve it
- Publication, then contact with familiesRecent campaigns have emailed parents and students directly to raise pressure
- Notification under state lawCounsel, the state statute, credit monitoring, and a board meeting
Ransomware is the word every board uses, but the encryption stage is increasingly skipped. When the threat is publication rather than a locked network, a tested backup protects instruction without protecting a single student record, and the notification obligation arrives regardless.
There is also a gap worth naming between what districts rank as their top risk and what the incident data shows. The Consortium for School Networking's 2025 survey of district technology leaders found phishing rated high risk by 27 percent, with unauthorized disclosure of student data and ransomware attacks each at 13 percent. Phishing is correctly at the top. The two ranked below it are the outcomes of the one at the top, which suggests the sector reads them as separate problems when they are one chain.
That placement is our reading of the CIS incident data alongside the CoSN survey, not a figure either publishes. It is offered as a starting point for a district risk register, which is a document most districts do not have and every insurer now asks for.
What a School Cyber Attack Costs a District
The ransom, where one is paid, is rarely the biggest number, and it is the only one an insurer will quote confidently. The costs that hurt are measured in days.
Three weeks of lost instruction is a calendar problem that follows a district into the next school year. Two to nine months of recovery is a staffing problem: the same three people who run the help desk are rebuilding domain controllers while a substitute teacher cannot take attendance and the food service office is running on paper.
The rest of the bill is predictable and rarely budgeted. Forensic investigation. Outside counsel to work out which state statutes are triggered. Notification printing and postage for every family in the district plus every former student in the affected records. Credit monitoring, typically one to two years. Overtime. Hardware replacement where machines cannot be trusted. Higher insurance premiums at renewal, or a refusal to renew.
A written incident response plan is the control that moves the most of that cost, because almost all of it accumulates during the days when nobody is sure who decides. Naming the decision maker, the counsel, the forensics firm and the communications owner in advance takes an afternoon and no money.
How Much School Districts Spend on Cyber Security
The honest answer is that most districts do not know, because the money is not in a line called security.
The Consortium for School Networking found that districts typically pay for cyber security out of general funds, at 61 percent, and that most do not have dedicated funding for it at all. The same survey found 78 percent spending on monitoring, detection and response, and 44 percent outsourcing that monitoring. Layer that over the CIS finding of under 8 percent of the IT budget on average and under 1 percent for one district in five, and the picture is a sector that has correctly identified what it needs and cannot fund it internally, so it buys the watching from somebody else.
Federal money exists and it is finite. The Department of Education reports that more than 600 schools and districts have been selected to receive up to $200 million in cyber security tools collectively under the Federal Communications Commission's Cybersecurity Pilot Program. Spread across the roughly 13,000 public school districts in the country, that is a pilot rather than a solution, and it does not change what a district has to decide next July.
Cyber insurance has become the other forcing function. Renewal questionnaires in this sector now ask about multi-factor authentication on remote access and email, offline backups, endpoint detection and an incident response plan, and a district that answers no to several of them will find that the quote reflects it. That is not a reason to buy the policy, but the questionnaire is a free and reasonably well-designed gap assessment.
Third Party and Vendor Risk in School Districts
A mid-sized district runs hundreds of ed tech applications, most adopted by individual teachers or departments rather than by the technology office, and a meaningful share of them hold student names against something else identifying.
FERPA's answer to this is the school official exception described above, and its two conditions are the whole of the district's leverage. A vendor qualifies only where it performs a function the district would otherwise do with employees, and only where it remains under the district's direct control with respect to the use and maintenance of education records. Direct control is a contractual state, not a good intention. If the agreement does not say what the vendor may do with the data, who it may pass it to, what happens at termination and what it must tell the district after an incident, the district is not exercising control, and the exception it is relying on to share the data in the first place is thin.
The practical version of this is short and does not need a lawyer for the first pass. Keep a list of every application holding student data and who approved it. Require a written data protection agreement before a new one goes live. Ask each vendor for the written information security program COPPA already obliges it to maintain, and treat an inability to produce one as the answer. Ask where the data is stored, who at the vendor can read it, and how quickly the district is told after an incident.
The reason to spend time here rather than on the network edge is arithmetic. One supplier compromise reaches every district using that supplier at once, and in this sector a single student information system or assessment platform can hold records for millions of children across hundreds of districts. No control a district buys for its own network affects that exposure. The contract does.
How to Secure a School District
In order, cheapest and most effective first. This list assumes no dedicated security staff, because that is the normal case.
When to Hire a Cyber Security Firm for a School District
Hire when one of three things is true: nobody is watching the systems overnight or through the summer, an insurer or a state program has asked a security question the district cannot answer in writing, or something is happening right now. Before any of those, the money goes further on the nine items above.
What to ask for specifically in this sector: experience with student information systems and the access model inside them, a response retainer that covers state breach notification support rather than only technical containment, and a willingness to work through a school year calendar where a maintenance window means a week in July. Managed detection and response is the service that covers the overnight and holiday gap without hiring a team, and it is what the 44 percent of districts outsourcing monitoring are buying.
Key takeaways
- FERPA is a disclosure law. It names no encryption, authentication, logging or breach notification requirement, and a district can be fully compliant on the day it is attacked.
- The only technical language in FERPA is the requirement to use reasonable methods to limit school officials to records they have a legitimate educational interest in.
- COPPA at 16 CFR 312.8 requires a written information security program with a named coordinator and annual risk assessments, and it binds the ed tech vendor rather than the district.
- CIPA is an internet filtering certification tied to E-Rate discounts, not a security program.
- Breach notification comes from state law, which is why counsel is the first call in a school incident.
- 82 percent of reporting K-12 organizations experienced cyber threat impacts across an 18 month period, per CIS and the MS-ISAC.
- The average school spends under 8 percent of its IT budget on security and one in five spends under 1 percent.
- The GAO recorded 3 days to 3 weeks of lost learning and 2 to 9 months of recovery after a school cyberattack.
- 61 percent of districts fund security from general funds and 44 percent outsource monitoring, per CoSN.
- A student record holds identity, eligibility, health and special education data on someone whose credit nobody checks for a decade.
Common questions
What is cyber security in a school district?
It is the protection of three things at once: student and staff records, the systems that keep instruction and payroll running, and the ed tech vendors holding district data outside the district's own network. The third is the part most districts underweight, because a hosted student information system is where the records actually live.
Does FERPA require schools to have cyber security?
Not in the way people assume. FERPA governs when a district may disclose personally identifiable information from education records and to whom. It names no specific safeguard. The closest it comes is at 34 CFR 99.31(a)(1)(ii), which requires reasonable methods to ensure school officials access only records in which they have a legitimate educational interest, and it explicitly contemplates a district with no technological access controls at all.
Does FERPA require breach notification?
No. There is no notification clause in FERPA. The letters families receive after a school incident are written to satisfy a state data breach notification statute, and in some states an additional student-data-specific law. Because the duties and timelines vary by state, the first call in a school incident is usually to counsel.
What is the biggest cyber security threat to schools?
Phishing against staff mailboxes, which district technology leaders themselves rate as their top risk in the CoSN survey. It is also the entry point for most of what follows: an email account leads to an administrator account, an administrator account leads to a bulk export of student records, and the export leads to an extortion demand.
How much should a school district spend on cyber security?
There is no defensible national benchmark, and any vendor quoting one is guessing. What is documented is where the sector currently sits: under 8 percent of the IT budget on average, per CIS, and under 1 percent for one district in five. A district well below the average is not necessarily insecure, but it should be able to explain which risks it has accepted and why.
What does CIPA require of schools?
If a school takes E-Rate discounts for internet access or internal connections, its billed entity must certify each funding year on FCC Form 471 that an internet safety policy is enforced, including a technology protection measure that blocks obscene material and child pornography for everyone and material harmful to minors for students. An authorized adult may disable the filter for bona fide research.
Does COPPA apply to schools?
COPPA binds operators of online services directed to children under 13, which in practice means the district's ed tech vendors rather than the district itself. That distinction is useful rather than academic: the written information security program required at 16 CFR 312.8 is a vendor obligation a district can ask to see before signing, and an inability to produce one is a meaningful answer.
How long does it take a school district to recover from a cyberattack?
The GAO's review recorded recovery times of 2 to 9 months, with 3 days to 3 weeks of lost learning, based on reports from state and local officials. The instructional loss is short and visible; the recovery is long, largely invisible outside the technology office, and absorbed by the same small team that runs everything else.
Should a school district pay a ransom?
That is a decision for the superintendent, the board and counsel, not a technical call, and it should be made against a written policy rather than in the first 48 hours. Two facts belong in that conversation: payment does not remove the notification obligation, because the data was still taken, and in campaigns that never encrypted anything there is nothing to unlock in the first place.
Do school districts need cyber insurance?
Most now carry it, and the renewal questionnaire has become the sector's de facto standard. Whether the policy is worth its premium depends on the district's size and the exclusions in the wording, but the questionnaire itself is worth completing honestly even if the district does not buy, because it lists the controls insurers have found actually correlate with claims.
Can a small district do this without hiring anyone?
Most of it, yes. Multi-factor authentication, an application inventory, an administrative rights review, tested backups, network separation and a one-page incident response plan cost time rather than money and cover the majority of what goes wrong. The two things that genuinely need outside help are watching the systems outside school hours and responding to an incident in progress.
On this page
- Why Cyber Security for Schools Is Different
- What Regulations Apply to School Cyber Security
- What Student Data Is Worth to an Attacker
- The Cyber Attacks That Actually Hit School Districts
- What a School Cyber Attack Costs a District
- How Much School Districts Spend on Cyber Security
- Third Party and Vendor Risk in School Districts
- How to Secure a School District
- When to Hire a Cyber Security Firm for a School District
Daniel Reyes
Daniel Reyes is a CISSP who spent twelve years in security operations, most recently leading a detection and response team for a mid-sized healthcare group in Texas. He reviews every resource and breach report on Cyber Security Firms for technical accuracy before it publishes.
Most of the people he has trained arrived having been told too much: a dozen acronyms, six vendors, and no clear idea which risk was theirs. His approach is to explain what an attack actually does before naming the tool that stops it, on the basis that most breaches start with something a reader could have recognised.