A small school district with one technology coordinator should start with CISA's K-12 Cybersecurity Foundations Resource Package, then use the Stop Ransomware K-12 materials and the technology acquisition guidance as needs arise. All of it is published for schools, and CISA's Regional Cybersecurity Advisors can help in person.
What CISA publishes for schools
CISA's K-12 page lists several resources:
- The Protecting Our Future report from January 2023, with recommendations on systemic cybersecurity risk in schools and districts, plus threat insights and steps for school leaders.
- An online toolkit that maps resources to the report's three recommendations.
- The K-12 Cybersecurity Foundations Resource Package, with guides, videos and supporting material on preventing, mitigating and responding to common threats.
- Cybersecurity Guidance for K-12 Technology Acquisitions, which helps schools buy products designed to be secure.
- Stop Ransomware K-12 materials for administrators, staff, parents and students.
- A SchoolSafety.gov infographic of cybersecurity action steps for students, educators and staff.
Where to start by role
A superintendent or business official should read the report summary and decide who owns the work. The toolkit makes that practical.
A technology coordinator should open the Foundations package and the ransomware materials. Those are closest to day to day tasks.
A purchasing lead should read the acquisition guidance before the next renewal. Buying decisions are where a school gets the most control for the least cost.
Teachers and staff need the short action steps. Keep them to a one page handout.
Why behavior matters as much as tools
CISA's page stresses raising awareness and changing the behaviors that lead to phishing and other attacks. Schools have many accounts, many shared devices and a constant flow of new users each year. Tools help, but staff who report a strange email quickly are worth more than another dashboard.
Do not skip the people at the edges
Substitutes, student teachers, coaches and volunteers often have access and rarely get training. Give them accounts with the least access they need and remove them when the term ends.
Using the rest of the CISA ecosystem
Public bodies that count as local government may be eligible for free Cyber Hygiene scanning, so ask CISA. See our post on who qualifies for CISA scanning.
For vendor questions, see the FERPA vendor checklist for edtech.
Quick check
Does CISA list the three report recommendations on its K-12 page?
No. The page points to the report and the online toolkit for the specifics, so read those directly.
Sources
Last reviewed: 19 October 2026.
