CISA’s new resources outline eight cybersecurity objectives to help K-12 schools and districts strengthen their defenses against growing cyber threats.
The Cybersecurity and Infrastructure Security Agency (CISA) on Aug. 12 released a new package of cybersecurity resources to help K-12 schools and districts prevent, mitigate, and respond to cyber threats.
The K-12 Cybersecurity Foundations Resource Package includes guides, a six-part video series, and quick-reference materials tailored to school leaders, non-technical staff, and cybersecurity and IT professionals, according to a press release from the agency.
“Cyberattacks on K-12 schools and districts jeopardize not only the integrity of our educational mission, but the safety and security of our students and teachers as well,” said Nick Andersen, CISA’s acting director. “These impacts are often felt well beyond the classroom.”
“The K-12 Cybersecurity Foundations Resource Package empowers school communities with practical strategies and supports our school safety mission,” Andersen added. “CISA is helping the K-12 community proactively defend against cyber threats, minimize disruption and better protect the systems our nation’s children, parents and educators depend on every day.”
CISA said schools and districts face increasing cybersecurity threats because they maintain sensitive student and staff data, depend on a range of technologies and systems, and have users with varying access privileges. The agency also pointed to limited resources for cybersecurity programs as a risk for K-12 institutions.
Cyber incidents can disrupt school operations and learning, compromise student privacy and safety, and consume limited resources, CISA said.
The package features a Getting Started Guide and a more detailed Implementation Guide. The guides organize cybersecurity practices around eight objectives:
- Protecting login credentials
- Safeguarding devices and assets
- Testing backups
- Strengthening incident response capabilities
- Improving cybersecurity training
- Appropriately managing sensitive data
- Aligning investments with recognized cybersecurity frameworks
- Developing customized long-term plans
“K-12 cybersecurity has evolved beyond an IT department concern and must now be recognized as a fundamental pillar of school safety and security,” said Scott Breor, CISA acting executive assistant director for infrastructure security.
“The K-12 Cybersecurity Foundations Resource Package provides a roadmap for schools and districts to increase cyber awareness, evaluate current defenses, and strengthen cyber resilience in the face of a growing and evolving threat landscape,” Breor added.
CISA said it developed the resources with input from K-12 stakeholders and cybersecurity experts. The package aligns with the agency’s earlier guidance for K-12 organizations, as well as the National Institute of Standards and Technology Cybersecurity Framework.
The agency also tied the package to a March 2025 executive order, which aims to equip state and local educational agencies with information and tools for risk-informed decision-making.
