K-12 cybersecurity is improving. More districts are investing in security tools, adopting multi-factor authentication, and engaging their boards in oversight conversations. But the sector remains underinvested relative to the threat landscape it faces, and the gaps that persist are the ones that matter most when an incident occurs.
This article reflects the patterns we observe across district assessments and engagements. This is a practitioner's perspective rather than a statistical study, grounded in direct observation.
The Overall Picture
Most K-12 districts we assess fall in the Foundation to Structure range of the Cyber Index, with a typical result landing in the lower end of the Structure tier. The gauge below illustrates that pattern; it reflects our assessment experience rather than a computed sector average.
Illustrative pattern based on assessment experience, not a measured dataset.
That score reflects a sector that has made meaningful progress on technical controls but hasn't yet built the programmatic foundations that sustain those controls over time. Districts are buying the right tools but are not always operating them consistently or connecting them to a broader security strategy.
Domain Breakdown
The pattern across domains is consistent and revealing. The chart below uses illustrative scores that reflect the relative ordering we observe across assessments, not measured sector data.
Illustrative pattern based on assessment experience, not a measured dataset.
Protect is consistently the strongest domain. Districts invest in firewalls, endpoint protection, email filtering, and network segmentation. These are tangible, purchasable solutions with clear deployment paths.
Govern is consistently the weakest. Governance requires policies, committees, designated ownership, board engagement, and documented risk acceptance. These are not products you can buy; they are organizational habits the district has to build.
The gap between Protect and Govern tells the story of the sector: organizations that have invested in defense but haven't yet built the program around it.
What's Improving
Several areas are trending in the right direction, driven by a combination of insurance requirements, vendor defaults, and increasing board awareness.
MFA adoption is accelerating. Cyber insurance carriers have made MFA a prerequisite for coverage in most cases. This external pressure has been more effective at driving adoption than years of security recommendations. Most districts we assess now have MFA enforced on administrative accounts, and many are extending it to all staff.
Network segmentation is becoming standard. Flat networks are far less common than they once were. Most districts now maintain separate VLANs for student, staff, and IoT devices, with firewall rules controlling cross-traffic.
Board engagement is increasing. More superintendents and boards are asking for cybersecurity updates as a regular agenda item. This is partly driven by high-profile incidents at peer districts and partly by insurance carriers asking about governance. The conversations are still early in many districts, but they are happening.
Endpoint coverage is expanding. EDR (endpoint detection and response) adoption has grown significantly, and districts are doing a better job of maintaining device inventories. Insurance questionnaires that ask about endpoint coverage have helped drive this.
Where the Highest Need Remains
The areas of highest need receive the least attention: the programmatic and procedural controls that don't have a vendor or a product attached to them.
Incident response planning. Most organizations we assess lack a documented, tested incident response plan. Many have an informal understanding of who would do what during an incident, but that understanding hasn't been written down, validated, or practiced. When ransomware hits on a Friday afternoon, informal understanding is not enough. Our ransomware preparation checklist covers the practical steps.
Vendor management. Districts rely on dozens of technology vendors with access to student data, financial information, and network infrastructure. Most districts have contracts with security language, but few have a process for evaluating whether those vendors actually follow through. Vendor security questionnaires, SOC 2 report reviews, and periodic reassessment are the expectation, not the exception.
Governance structures. Security committees, designated security coordinators, documented risk acceptance, and regular policy review cycles are rare in K-12. Without these structures, security improvements depend on individual initiative rather than organizational commitment. When that individual leaves or gets reassigned, the program goes with them.
Vulnerability scanning. Regular vulnerability scanning of internal and external systems is a foundational security practice that most districts haven't yet adopted. Many rely on their firewall and endpoint tools to surface issues, but these don't replace systematic scanning for misconfigurations, missing patches, and exposed services.
Data classification. Most districts haven't classified their data by sensitivity level. Without classification, it's difficult to apply proportionate protections. Student records, financial data, and operational documents all require different handling, but they often receive the same (minimal) controls.
What the Gap Between Domains Shows
The consistent pattern across K-12 assessments is this: organizations invest in technical defenses but underinvest in programmatic foundations.
This is not a criticism; it makes sense. When you have limited budget and limited staff, you buy the firewall, deploy the endpoint tool, and enable the email filter. Those are the controls that feel like security because they are visible and immediate.
But the controls that determine whether an organization survives an incident are the programmatic ones: incident response plans, tested backups, vendor oversight, governance structures, and documented processes. These are the controls that don't have a line item in a vendor quote. They require time, attention, and organizational commitment.
The districts that score highest on the Cyber Index are not necessarily the ones with the biggest budgets; they are the ones that have built habits around security, with regular reviews, documented decisions, tested plans, and clear ownership.
Top Five Recommendations
Based on what we see across the sector, these are the five highest-impact actions for K-12 districts:
-
Write and test your incident response plan. Run a tabletop exercise with your leadership team, time the decisions, identify the gaps, and update the plan. Then repeat it on an annual cycle.
-
Designate a security coordinator. Someone in your organization needs to own the security program. This doesn't have to be a full-time security hire; it can be an IT director with dedicated time and clear authority. In districts without a named owner, routine activities such as scan review, policy updates, and vendor checks reliably stall.
-
Build a vendor assessment process. Start with your top ten vendors by data access and criticality. Request SOC 2 reports or completed security questionnaires. Document what you find. Revisit annually.
-
Implement regular vulnerability scanning. Monthly internal scans and quarterly external scans establish a baseline and surface issues before attackers find them. Several affordable tools are designed for education-sized environments.
-
Report to your board quarterly. A one-page summary covering current posture, recent incidents (or the absence of them), progress on the remediation roadmap, and upcoming priorities. Board engagement transforms cybersecurity from an IT problem into an organizational priority.
Where Districts Should Focus Next
The K-12 sector has made real progress. In recent years, many districts operated without MFA or network segmentation and with little board-level visibility into cybersecurity. That has changed. The next phase of improvement requires a shift from buying tools to building programs.
For a deeper look at how we evaluate cybersecurity maturity, see Understanding the STORM Risk Tier Framework. For a practical starting point on ransomware readiness, our preparation checklist covers what to verify now.
Have questions or need support with K-12 cybersecurity? Start a conversation.