Why do schools struggle with cybersecurity, and what helps?

Schools struggle with cybersecurity mainly because of limited resources and capacity, not lack of concern. CISA's K-12 report finds many districts have insufficient IT resources, and that no single school can identify and prioritize emerging threats alone. Its advice is to do a few high-impact things first and share information with peers.

What does the CISA K-12 report find?

In January 2023, CISA published "Protecting Our Future: Partnering to Safeguard K-12 Organizations from Cybersecurity Threats." The accompanying one-page summaries state three findings:

1. With finite resources, K-12 institutions can take a small number of steps to significantly reduce cybersecurity risk.
2. Many school districts struggle with insufficient IT resources and cybersecurity capacity.
3. No K-12 entity can singlehandedly identify and prioritize emerging threats, vulnerabilities and risks.

The report's tone is practical. It does not say schools are careless. It says the work is large, the staff is small, and a smarter allocation of effort is possible.

Which measures does it put first?

CISA's one-page guide on the most impactful measures lists six, in this order:

• Implement multifactor authentication.
• Prioritize patch management.
• Perform and test backups.
• Minimize exposure to common attacks.
• Develop and exercise a cyber incident response plan.
• Create a training and awareness campaign at all levels.

After those, it suggests aligning further near-term investment with CISA's Cross-Sector Cybersecurity Performance Goals, and over the long term building a unique cybersecurity plan using the NIST Cybersecurity Framework. This is a sequence, not a menu. The first six are cheap relative to their effect.

How should a small team deal with limited resources?

The recommendations for the second finding read like a budget plan:

• Work with the state planning committee to use the State and Local Cybersecurity Grant Program.
• Use free or low-cost services for near-term improvements.
• Expect and call for technology providers to enable strong security controls by default at no additional charge.
• Minimize the security burden by moving IT services to more secure cloud versions.

The third item is a procurement habit that any district can adopt. When buying a product, ask whether MFA, logging and secure defaults are included, and treat a "no" or an upcharge as a cost.

Why does information sharing matter?

For the third finding, CISA recommends joining collaboration groups such as MS-ISAC and K12 SIX, working with fusion centers, state school safety centers, and associations, and building a lasting relationship with CISA and FBI regional cybersecurity personnel.

A district of a few thousand students cannot hire a threat analyst. It can read a shared alert from a peer who saw the same phishing campaign last week.

What does this look like in a real district?

Constructed example. A district with two IT staff supports 4,000 students and 600 employees. The staff sign in to email and the student information system with passwords only. The backup server sits in the same room as the main server. In one term, they could enable MFA for staff and administrators, move backups to an offline or cloud copy and restore one system as a test, and join a sharing group. None of that needs a new department, and it addresses three of CISA's six measures.

What is hard about schools in particular?

Schools run a wide mix of devices and apps, many chosen by individual teachers. They hold sensitive data about minors. Students and staff change every year, so training and access removal never stop. And an outage during a school day affects families directly. Those factors make backups, accounts clean-up and a rehearsed response especially valuable.

How to check or apply this

1. Enable MFA for staff email, the student information system and all administrator accounts.
2. Patch internet-facing systems first, and keep a list of what runs where.
3. Keep one backup copy offline or isolated, and restore a system from it once a term.
4. Close unneeded exposed services, such as remote desktop access from the internet.
5. Write a one page response plan with phone numbers, and run a tabletop each year.
6. Join an information-sharing group and subscribe to its alerts.
7. Ask vendors about default security features before you sign.

Quick check

Sources

• CISA, Report: Partnering to Safeguard K-12 Organizations from Cybersecurity Threats
• CISA K-12 media kit, Key Findings and Recommendations (PDF)
• CISA K-12 media kit, Implement Most Impactful Security Measures (PDF)

Last reviewed: 18 October 2026.