The Cybersecurity Checklist Every School Board Should Demand
Schools hold sensitive data on thousands of minors but often run on weak defenses. Seven controls — in plain language — that move you from exposed to resilient.
A school is a high-value, low-defense target: lots of personal data on children and staff, tight budgets, and small IT teams. You do not need a military-grade program to be safe. You need the fundamentals, done consistently. Here is the checklist I give every board.
1. Multi-factor authentication everywhere
The single highest-impact control. Enforce MFA on every staff and admin account — email, finance systems, and the student information system. Most breaches start with one stolen password; MFA stops the majority of them.
2. A real backup you have actually restored
Ransomware is the top threat to schools. Keep backups that are offline or immutable, and — this is the part people skip — test a full restore at least twice a year. A backup you've never restored is a hope, not a plan.
3. Email protection and phishing training
Over 90% of attacks arrive by email. Turn on advanced filtering, and run short, regular phishing simulations for staff. Awareness is cheaper than any tool and works.
4. Least privilege and offboarding
Not everyone needs admin rights, and leavers must lose access on day one. Review who can touch financial and student data every term.
5. Patch the things that face the internet
Unpatched firewalls, VPNs, and servers are the most common way in. Have a defined monthly patch cycle and a way to act fast on critical alerts.
6. A written incident plan
When something happens at 2 a.m., people should not be improvising. One page is enough: who to call, what to disconnect, who speaks to parents and regulators.
7. Know your data and your obligations
Map where student data lives and which regulations apply to you. You cannot protect what you have not inventoried.
Three years with zero major incidents wasn't luck. It was these fundamentals, applied every single term.
If you can't confidently tick all seven, that gap is your roadmap. A focused assessment turns this list into a prioritized plan — reach out and we'll start with the highest risks.
Facing a similar challenge?
Book a free 30-minute discovery call and let's turn these ideas into a practical plan for your institution.