Best-practice guides

Cybersecurity glossary for school districts

Plain-language definitions of the terms and acronyms used in the Cybersecurity Rubric guides, from MFA and EDR to RTO and DMARC.

3

3-2-1 backup 3-2-1 backup rule: Keep three copies of important data, on two different kinds of storage, with one copy offsite or offline.

A

API Application programming interface: A way for two systems to exchange data automatically, such as rostering from the SIS to an app. Integrations need owners and limited permissions.
Asset inventory: A maintained list of the district's devices, software, cloud services and data, with an owner for each. You cannot protect what you do not know you have.
Audit log: A record of who did what in a system, such as grade changes in the SIS or admin changes in Google or Microsoft 365.
AUE Auto Update Expiration: The date after which a Chromebook model no longer receives ChromeOS security updates. Plan replacements before devices pass it.
AUP Acceptable use policy: The rules staff and students agree to when they use district technology and accounts.

B

BEC Business email compromise: Fraud where an attacker uses a hacked or look-alike email account to redirect payments or payroll, often pretending to be a vendor or an employee.
BIA Business impact analysis: A short review of which services matter most, how long each can be down and what depends on it. It is where recovery priorities and RTO/RPO targets come from.
Board policy: Rules adopted by the school board. A cybersecurity or acceptable use policy gives administrators authority to require practices such as MFA.
Breach coach: An attorney, usually assigned or approved by the cyber insurer, who directs the incident response so communications and findings are handled correctly.

C

Chain of custody: A record of who handled evidence, when and how, so logs and devices stay usable for insurers, investigators and law enforcement.
CIPA Children's Internet Protection Act: The federal law that requires E-Rate funded schools to filter harmful content and adopt an internet safety policy.
CIS Controls Center for Internet Security Critical Security Controls: A prioritized list of security safeguards. Version 8.1 groups them into Implementation Groups so smaller organizations know where to start.
CISA Cybersecurity and Infrastructure Security Agency: The federal agency that publishes free guidance and services for schools, including Cyber Hygiene vulnerability scanning, the K-12 report and the #StopRansomware Guide.
Conditional Access Microsoft Entra Conditional Access: Microsoft 365 rules that decide when a sign-in is allowed, for example requiring MFA for all staff or blocking sign-ins from outside the United States.
Content filter: The web filtering service required for CIPA. Many filters can also block known malicious sites.
COPPA Children's Online Privacy Protection Act: The federal law that limits how online services collect personal information from children under 13. Schools can consent for educational use only in limited cases, so app reviews matter.
CoSN Consortium for School Networking: The national association of K-12 technology leaders. GLET is its Georgia chapter, and CoSN publishes the Cybersecurity Rubric.
CPG CISA Cross-Sector Cybersecurity Performance Goals: A short list of baseline practices from the Cybersecurity and Infrastructure Security Agency that reduce common, high-impact risks, such as MFA, patching known exploited vulnerabilities and tested backups.
CR 2.0 Cybersecurity Rubric 2.0: The self-assessment used in this program: 22 categories under the six NIST CSF functions, each rated from Level 1 (Initial) to Level 5 (Optimized).
CVE Common Vulnerabilities and Exposures: The public ID system for software weaknesses, such as CVE-2024-12345, used in patch notes and scan reports.
Cyber insurance: Insurance that helps pay for incident response, recovery, notification and some liability after a cyberattack. Applications ask about specific controls, and answers must match reality.

D

DDoS Distributed denial of service: An attack that floods a network or website with traffic so legitimate users cannot reach it, for example during online state testing.
DKIM DomainKeys Identified Mail: A digital signature added to outgoing email so receivers can confirm it came from your domain and was not changed.
DLP Data loss prevention: Rules in email and cloud storage that detect and block sensitive information, such as Social Security numbers, from being shared where it should not go.
DMARC Domain-based Message Authentication, Reporting and Conformance: An email setting published in DNS that tells receiving mail servers what to do with messages that fail SPF or DKIM checks, and sends you reports. It makes it much harder to send email that pretends to come from your district.
DNS Domain Name System: The internet's address book that turns names like example.org into network addresses. Filtering DNS requests is a simple way to block known malicious sites.
DPA Data privacy agreement: A contract with a vendor that sets how student and staff data may be used, protected, shared and deleted.

E

E-Rate Schools and Libraries Universal Service Program: The FCC program, run by USAC, that discounts internet access and internal network equipment for schools. Basic firewalls are eligible; most other security tools are not.
EDR Endpoint detection and response: Security software on laptops and servers that records suspicious behavior, alerts someone and can isolate a device. It goes beyond traditional antivirus, which only matches known bad files.
Encryption: Scrambling data so only someone with the key can read it. Device encryption (BitLocker, FileVault, ChromeOS by default) protects data on lost laptops.
ERM Enterprise risk management: Managing all of an organization's major risks (safety, finance, legal, technology) in one consistent way so cyber risk is weighed alongside the others.

F

FBI Federal Bureau of Investigation: The federal law enforcement agency that investigates cybercrime such as ransomware and payment fraud. Report incidents through IC3 or your local field office.
FCC Federal Communications Commission: The federal agency that oversees E-Rate and the Schools and Libraries Cybersecurity Pilot Program.
FERPA Family Educational Rights and Privacy Act: The federal law that protects the privacy of student education records and limits when they can be shared without parent consent.
Firewall: A network device or service that controls which traffic can enter or leave the network. Basic firewalls are E-Rate eligible.
FTE Full-time equivalent: A way of counting staff time: two half-time technicians are one FTE. Useful when sizing who can cover recovery work and after-hours response.

G

GEMA/HS Georgia Emergency Management and Homeland Security Agency: Georgia's state emergency management agency. Under Georgia law, governmental entities, including school districts, report cyberattacks to its director; GTA guidance asks districts to contact their local emergency management agency within an hour of recognizing an incident.
GSBA Georgia School Boards Association: The association that supports Georgia school boards, including model board policy language districts often adapt.
GTA Georgia Technology Authority: The state agency that manages technology for Georgia state government and publishes the state's cyber incident reporting guidance.

H

HVAC Heating, ventilation and air conditioning: Building systems that are increasingly network-connected and should sit on a separate network segment managed with facilities.

I

IC3 Internet Crime Complaint Center: The FBI's online portal for reporting cybercrime, including business email compromise and ransomware.
IDF Intermediate distribution frame: A network closet in a school building that connects classrooms back to the main network. It should be locked.
IEP Individualized Education Program: The legal plan for a student receiving special education services. IEP records are among the most sensitive student information a district holds.
IG1 CIS Controls Implementation Group 1: The essential cyber hygiene set of CIS safeguards: the minimum every organization, including a small district, should have in place.
Immutable backup: A backup copy that cannot be changed or deleted for a set period, even by an administrator account, so ransomware cannot destroy it.
Indicator of compromise: A clue that an attack happened, such as a malicious IP address, file hash or unusual sign-in. Shared through MS-ISAC, K12 SIX and CISA alerts.
IRP Incident response plan: The written plan for who does what when a cybersecurity incident happens: how to report, who leads, who to call (insurer, counsel, law enforcement) and how decisions are made.
ISP Internet service provider: The company that supplies the district's internet connection. A second provider or path keeps schools online if one fails.

K

K12 SIX K12 Security Information eXchange: A nonprofit for U.S. school districts that shares threat information and publishes the Essential Cybersecurity Protections, a baseline list of protections for districts.
KEV Known Exploited Vulnerabilities catalog: CISA's list of software weaknesses that attackers are actively using. Fix anything on it in your environment first.
KPI Key performance indicator: A measure tracked over time to show whether something is improving, such as the percent of staff with MFA or days to patch critical issues.

L

LAPS Local Administrator Password Solution: A Microsoft feature that gives every Windows device a unique, rotating local administrator password stored in Active Directory or Entra ID, so one stolen password cannot unlock every computer.
Least privilege: Giving each account only the access it needs for the job, and no more. Admin rights stay on separate admin accounts.
LMS Learning management system: The platform teachers use for assignments and course materials, such as Google Classroom, Canvas or Schoology.
Log retention: How long sign-in, email and system logs are kept. Investigations often need months of history, longer than many default settings.

M

MDBR Malicious Domain Blocking and Reporting: A Center for Internet Security service that blocks connections to known malicious websites at the DNS level.
MDF Main distribution frame: The district's main network room or closet where core switches, internet connections and often servers live.
MDM Mobile device management: Tools that configure, update and lock down devices centrally, such as Google Admin for Chromebooks, Intune, Jamf or Apple School Manager.
MDR Managed detection and response: A service where an outside security team watches your EDR and other alerts around the clock and responds or calls you when something looks wrong. Useful when the district has no after-hours staff.
MFA Multi-factor authentication: Signing in with something you know (a password) plus something you have or are, such as an authenticator app prompt, a security key or a fingerprint. A stolen password alone is then not enough to get into a staff account.
MS-ISAC Multi-State Information Sharing and Analysis Center: The Center for Internet Security community for state and local governments, including public school districts. It shares threat alerts and offers security services; check current membership terms and which services your tier includes.

N

NDPA National Data Privacy Agreement: A standard student data privacy agreement developed through the Student Data Privacy Consortium so districts and vendors do not have to negotiate terms from scratch.
NIST National Institute of Standards and Technology: The federal agency that publishes the Cybersecurity Framework and many security standards. Its guidance is free and widely used by schools.
NIST CSF 2.0 NIST Cybersecurity Framework 2.0: A framework that organizes cybersecurity into six functions: Govern, Identify, Protect, Detect, Respond and Recover. The Cybersecurity Rubric 2.0 aligns with it.
NIST SP NIST Special Publication: A numbered NIST guidance document, such as SP 800-61 on incident response or SP 800-88 on media sanitization.

O

Offboarding: Removing access when someone leaves or changes roles: disabling accounts, collecting devices and transferring files the same day.

P

Patch: A software update that fixes a security weakness. Patching quickly, especially internet-facing systems and known exploited vulnerabilities, is one of the most effective protections.
PD Professional development: Training for staff; districts may count cybersecurity awareness courses toward local professional learning.
Penetration test: An authorized test in which a qualified tester tries to break in the way an attacker would, to show which weaknesses are actually exploitable.
Phishing: A message (email, text, call or QR code) that tricks someone into giving up a password, opening malware or sending money.
Phishing-resistant MFA Phishing-resistant multi-factor authentication: MFA that a fake sign-in page cannot capture or replay, such as FIDO2 security keys, passkeys or certificate-based sign-in. Best first used for administrators and the business office.
PII Personally identifiable information: Information that identifies a person, such as a name with a birth date, student ID or address. Student and staff PII is what attackers and extortion demands usually target.
PIO Public information officer: The person who speaks for the district to media and the public, including during an incident.
PPRA Protection of Pupil Rights Amendment: The federal law that gives parents rights over surveys and data collection on sensitive topics, such as student surveys in apps.

R

RACI Responsible, accountable, consulted, informed: A simple chart that makes clear who does the work, who owns the decision, who gives input and who is kept informed.
Ransomware: Malicious software that encrypts or steals files and demands payment. Recovery depends on tested offline backups and a practiced response plan.
RDP Remote Desktop Protocol: Windows remote desktop. It should never be reachable directly from the internet; put it behind a VPN with MFA.
RESA Regional Educational Service Agency: Georgia's regional service agencies that support groups of school districts with shared services and professional learning.
Risk register: A living list of the district's cybersecurity risks with likelihood, impact, owner, planned response and status.
Risk tolerance: How much risk leadership is willing to accept in pursuit of its goals. It turns into practical rules, such as which systems must be restored first.
RMM Remote monitoring and management: Tools IT staff or managed service providers use to manage and patch computers remotely. They are powerful and must be protected with MFA.
RPO Recovery point objective: How much data you can afford to lose, measured in time. A 24-hour RPO means a nightly backup is acceptable; a one-hour RPO needs more frequent backups.
RTO Recovery time objective: How long a system can be down before the impact is unacceptable, for example the student information system back within 24 hours. It sets how fast restores must work.

S

SDPC Student Data Privacy Consortium: A collaborative of school districts and state alliances that shares signed vendor privacy agreements and the National Data Privacy Agreement.
Service account: A non-person account used by an application or integration, such as an SIS sync. It needs an owner, a strong secret and review like any other account.
SIEM Security information and event management: A system that collects logs from many sources (firewall, email, identity, servers) in one place so they can be searched, correlated and kept long enough to investigate an incident.
SIM swap Subscriber identity module swap: A fraud where an attacker convinces a mobile carrier to move a victim's phone number to a new SIM card, then receives their text-message sign-in codes. It is why app-based or phishing-resistant MFA is preferred over text messages.
SIS Student information system: The system of record for enrollment, attendance, grades, schedules and family contacts, such as Infinite Campus or PowerSchool. Usually the district's most sensitive and most critical application.
SLA Service level agreement: The part of a contract that sets measurable commitments, such as response times or uptime, including breach notification timelines.
SLCGP State and Local Cybersecurity Grant Program: A federal grant program, managed in Georgia through the state, that funds cybersecurity projects for local government entities, which can include school districts.
SLTT State, local, tribal and territorial: The government sector served by MS-ISAC and many CISA services; public school districts are part of it.
SOC Security operations center: The team (in-house or contracted) that monitors security alerts and responds to them. Also used for SOC 2, an independent audit report vendors share about their controls.
SPF Sender Policy Framework: A DNS record listing which servers may send email for your domain.
SSO Single sign-on: One district sign-in (usually Google or Microsoft) that opens many apps. It makes MFA and account shut-off apply everywhere at once, so it is also a security control.
Supply chain risk: Risk that comes from vendors and the software and services they provide, such as a learning platform breach exposing student data.

T

Tabletop exercise: A discussion-based rehearsal where leaders walk through a realistic incident scenario to test the plan, roles and decisions without touching real systems.
Threat intelligence: Information about current attacker tools and targets, shared by groups like K12 SIX, MS-ISAC and CISA, that helps you decide what to fix or watch for.
TLE Trusted Learning Environment: A CoSN framework of student data privacy practices across leadership, classroom, data security, business and professional development. The rubric refers to its practice areas.

U

UPS Uninterruptible power supply: A battery unit that keeps network and server equipment running through short power outages and allows a clean shutdown.
USAC Universal Service Administrative Company: The organization that administers E-Rate and the cybersecurity pilot for the FCC.

V

VLAN Virtual local area network: A way to split one physical network into separate segments, for example keeping cameras, HVAC controls and student devices apart from staff and server networks.
VM Virtual machine: A software-based computer running on a shared physical server. Servers are often VMs, so restore tests should include bringing a whole VM back.
VPN Virtual private network: An encrypted connection for reaching district systems from outside the network. Remote access through a VPN should always require MFA.
Vulnerability scan: An automated check of systems for missing patches and weak settings. CISA's Cyber Hygiene service scans a district's internet-facing addresses.

W

WSUS Windows Server Update Services: A Microsoft server role that distributes Windows updates inside a network.

X

XDR Extended detection and response: Detection and response that correlates signals from devices, email, identity and cloud apps in one console, rather than endpoints alone.

Z

Zero trust: A security approach that never assumes a user or device is safe because it is on the district network; every access request is checked.

All 22 best-practice guides

Georgia schools. Stronger together.

Assess, learn and plan with your team.

Participating districts rate all 22 areas, see these guides beside every question and leave with a prioritized, resourced improvement path.

Request participation District sign in