Best-practice guides
Plain-language guides to the 22 areas of the Cybersecurity Rubric 2.0: why each one matters, what good looks like at every maturity level, quick wins with effort and cost, common pitfalls and trusted free resources.
Set direction, assign authority and keep leadership informed.
Govern · GV.OC
When ransomware or an outage hits, the first question is which systems come back first. A district that has already ranked its student information system (SIS), identity platform, payroll and transportation routing can restore in a sensible order instead of debating it while buses, lunch lines and attendance wait.
Govern · GV.RM
A small technology team will always have more open issues than time. A written, scored risk register lets the superintendent and technology director agree on what gets fixed first, so untested backups or staff accounts without multi-factor authentication (MFA) are not pushed aside by the newest urgent ticket.
Govern · GV.RR
In a small district, cybersecurity often rests on one person. If that person is out when an account is compromised, a written list of duties with named backups is what lets someone else disable accounts, call the insurer and reach vendors without guessing.
Govern · GV.PO
Written, board-adopted policy lets the technology director require multi-factor authentication (MFA), restrict personal devices or remove an unapproved app without it becoming a personal argument with a principal or teacher. Enforcement points to the policy, not to IT.
Govern · GV.OV
Security programs drift quietly: multi-factor authentication (MFA) exceptions pile up, a backup job fails without anyone noticing, and training lapses for new hires. Regular review of a few measures catches that drift before an incident, audit or insurance claim exposes it.
Govern · GV.SC
Student information systems, learning platforms, transportation, nutrition and special education software keep district data on vendor servers. When one of those vendors is breached, families and reporters call the district, and the district carries the notification work and the loss of trust.
Know what you have, what could go wrong and what to improve.
Identify · ID.AM
Every other safeguard depends on the inventory. A server, camera controller or old wireless controller that nobody listed is one nobody patches, backs up or monitors, and that is exactly the kind of system attackers look for.
Identify · ID.RA
Attackers scan the internet for exposed, unpatched systems such as old virtual private network (VPN) appliances and remote desktop servers. Regular external scanning and a patch calendar let you find those openings on your schedule, not during a ransomware event that closes schools.
Identify · ID.IM
Without a lessons-learned step, the same weakness causes the next outage: the same unmonitored circuit, the same phishing lure, the same missing phone list. A short review after each event turns it into one or two concrete fixes.
Put the everyday safeguards in place for accounts, data, devices and networks.
Protect · PR.AA
When a staff password is phished or reused from another breach, multi-factor authentication (MFA) is what stops the attacker at the sign-in screen instead of inside the payroll mailbox, the SIS gradebook or the Google or Microsoft admin console.
Protect · PR.AT
Payment-change scams and business email compromise (BEC) aim at the business office, payroll and HR with convincing requests, and a trained clerk who calls the vendor back at a known number stops the loss before money leaves the district.
Protect · PR.DS
Special education, health, discipline and counseling records are among the most sensitive information a district holds, and attackers have published stolen student records to pressure districts into paying, which harms students and families long after systems are restored.
Protect · PR.PS
Attackers scan the internet for firewalls, VPN appliances and servers missing known patches, and an unpatched internet-facing device can let them in without anyone in the district clicking anything.
Protect · PR.IR
On a flat network, malware on one student or staff device can reach servers, the business office and building systems; segmentation keeps an incident inside one zone so the rest of the district keeps teaching.
Notice when something is wrong, early enough to act.
Detect · DE.CM
Attackers who get in through a phished staff account or an unpatched remote-access device often look around quietly before they encrypt anything, and they favor nights, weekends and school breaks when no one is at the console. If no one is watching, the first sign may be a locked student information system (SIS) and transportation software with no bus routes on a Monday morning.
Detect · DE.AE
The difference between one compromised teacher account and a district-wide outage is often how quickly someone recognizes the first odd sign-in or new mail forwarding rule for what it is. Without a written picture of normal and clear declaration criteria, warning signs get explained away until the student information system (SIS), payroll or the phone system goes down.
Lead a calm, documented response when an incident happens.
Respond · RS.MA
When ransomware locks the student information system (SIS) at 6:40 a.m., someone has to decide within minutes whether to cut the internet connection, whether buses run and whether schools open. A plan that names an incident commander and a backup means those calls are made by the right person instead of whoever happens to answer the phone.
Respond · RS.AN
Whether the district must notify families, staff or the state depends on which records were actually accessed. Without logs and a careful scope, leaders are left choosing between notifying broadly, which alarms the community and adds cost, and staying silent without proof, which carries legal risk.
Respond · RS.CO
Cyber insurance policies set conditions for giving notice and often require the carrier's approved breach counsel and forensic firms. Hiring outside help before calling the carrier, or waiting too long to call, can put coverage for those costs at risk.
Respond · RS.MI
Speed decides scale. A phished account contained within the hour stays one person's bad day; left running overnight, it can become forwarding rules in the payroll office, changed direct deposit details or encrypted servers in every school.
Bring instruction and operations back and keep people informed.
Recover · RC.RP
When ransomware encrypts servers and there is no agreed restore order, staff rebuild whatever someone is shouting about, and identity, the network and the student information system (SIS) come back out of sequence or not at all. Schools may close or run on paper for days or weeks, and every attendance mark, meal count and grade recorded on paper has to be re-entered later.
Recover · RC.CO
During recovery, district email, phones and the student information system (SIS) may be unavailable at the moment families most want answers. Without a planned backup channel and a named spokesperson, students and social media set the story, and principals improvise answers that later have to be walked back.
Georgia schools. Stronger together.
Participating districts rate all 22 areas, see these guides beside every question and leave with a prioritized, resourced improvement path.