Why it matters
- Security programs drift quietly: multi-factor authentication (MFA) exceptions pile up, a backup job fails without anyone noticing, and training lapses for new hires. Regular review of a few measures catches that drift before an incident, audit or insurance claim exposes it.
- The superintendent and board answer for a risk that can close schools, disrupt state testing windows and delay payroll. Scheduled briefings with real measures give them a basis for decisions and a record that they exercised oversight.
- Trend data from annual self-assessments and outside reviews makes budget conversations concrete. Showing that a funded control moved a score, or that a finding stayed open for a year, is more persuasive to a board than general concern.
This category asks whether leadership checks that the security program is working — on a schedule, with measures — rather than approving documents once and moving on. Programs drift: MFA exceptions accumulate, policies age, and training lapses, until an incident, audit finding, or denied insurance claim reveals the gap. Regular review of outcomes and metrics is also how superintendents and boards discharge their duty over a risk that can close schools for weeks.
What good looks like at each level
Level 1 · Initial
Policies and plans were approved once, if at all, and no one checks whether they are still followed. Leadership hears about cybersecurity mainly when something breaks.
- No cybersecurity item in cabinet or board minutes apart from incidents or purchases
- Security documents with no review history
- No measures of MFA coverage, patching, backups or training reported to anyone
Moving up: Put executive leadership formally in the approval chain and establish at least annual review of cybersecurity documentation and risk management outcomes, adjusting them to cover district requirements and risks.
Level 2 · Repeatable
Executive leadership formally approves security policies and plans, and documentation is reviewed at least once a year. Leadership looks at outcomes such as incidents and audit findings and adjusts priorities, though without consistent measures.
- Signed approval or cabinet minutes for each security policy and plan
- Annual documentation review notes
- Year-end summary of incidents, findings and changes made
Moving up: Start measuring program performance — a metrics dashboard reviewed on a schedule — and use the results to adjust strategic direction, while moving key document reviews from annual to quarterly.
Level 3 · Defined
A short set of measures is reviewed with the superintendent on a schedule, and the results change priorities. Key documents are reviewed each quarter and every review is logged.
- One-page dashboard covering MFA coverage, patch status, restore test results, training completion, phishing reports and open findings
- Quarterly document review log with owners and next-review dates
- Corrective-action log showing findings assigned, dated and verified closed
Moving up: Verify governance against every applicable federal, state, and local regulation using a compliance matrix with evidence, and close the gaps you find.
Level 4 · Managed
The district can show, requirement by requirement, how its governance meets federal, state and local rules, with evidence linked for each. Gaps found in the compliance review are tracked and closed.
- Compliance matrix covering the Family Educational Rights and Privacy Act (FERPA), Children's Internet Protection Act (CIPA) certification, the Children's Online Privacy Protection Act (COPPA), the Protection of Pupil Rights Amendment (PPRA), Georgia student data privacy requirements and breach notification, with evidence links
- Annual board briefing on performance and compliance, with sensitive details handled as counsel advises
- Year-over-year self-assessment results kept and compared
Moving up: Add an annual independent review by an outside party — a third-party assessment, audit, or penetration-test-backed evaluation — and act on its findings.
Level 5 · Optimized
An independent outside party reviews the cybersecurity program every year, and its findings flow into the corrective-action log with owners and deadlines. Leadership reports progress on those findings to the board.
- Annual independent assessment or audit report stating its scope and methods
- Penetration test or external vulnerability scan results included in the review
- Board minutes showing review of the independent findings and the status of corrective actions
Quick wins
Free means staff time, existing licenses or free government services. Hours, days and weeks describe the effort.
Assemble a one-page metrics dashboard from Google/Microsoft admin, filter, and backup consoles
Pull MFA enrollment from the Google Admin console or Microsoft Entra admin center, the last successful backup and restore test from the backup console, filter and phishing-report data, training completion from HR, and open findings from the corrective-action log. Keep the same six to eight measures every time so trends are visible.
Add a standing 15-minute cybersecurity slot to the monthly cabinet agenda
Add the item to the cabinet agenda template, have the technology director walk through the dashboard and any decisions needed, and record decisions in the minutes so oversight is documented.
Enroll in CISA's free Cyber Hygiene vulnerability scanning service
Email the Cybersecurity and Infrastructure Security Agency (CISA) at vulnerability@cisa.dhs.gov to request Cyber Hygiene services, then sign the service agreement and list the district's public IP addresses and domains. Reports arrive by email; add critical findings to the corrective-action log.
Create the document review log with next-review dates
In a shared spreadsheet, list every governance document (policies, procedures, incident response plan, continuity plan, vendor contract template) with owner, last review, next review and notes. Sort by next review date and check it at each monthly cabinet slot.
Put the annual Cybersecurity Rubric self-assessment on the calendar with a named owner
Pick a fixed month ahead of budget planning, name the technology director as owner with cabinet members taking part, and keep each year's results so the board and the insurer can see the trend.
Common pitfalls
- Reporting activity instead of outcomes. Counts of tickets closed or emails filtered say little about risk; report measures tied to risk, such as MFA coverage, restore test results and how long critical findings stay open.
- Treating document approval as oversight. Signing a policy once does not show it is followed, so pair each approval with a scheduled check that the control is still in place.
- Briefing the board only after an incident. A board that first hears about cybersecurity during a crisis cannot make informed decisions; schedule at least an annual briefing and handle sensitive details as counsel advises under open-meetings and records law.
- Logging findings without verifying closure. A corrective-action log full of items marked done but never rechecked gives false comfort; have someone other than the person who made the fix confirm closure of high-priority findings.
- Waiting for budget before seeking outside review. Free Cybersecurity and Infrastructure Security Agency (CISA) scanning and state or risk-pool assessment programs give independent findings now; add a paid assessment or penetration test as funding allows.
Evidence that proves it
- Quarterly cybersecurity dashboard and cabinet report
- Board minutes showing at least annual cybersecurity briefings
- Document review log with owners and next-review dates
- Annual Cybersecurity Rubric self-assessment results showing year-over-year trend
- Compliance matrix with linked evidence for CIPA, FERPA, and state laws
- Independent assessment or penetration test report
- Corrective-action log showing findings tracked to closure
Who usually owns it
- Superintendent Reviews performance reports, adjusts priorities and delivers the cybersecurity briefing to the board.
- Technology director Builds the dashboard, maintains the review and corrective-action logs and coordinates outside assessments.
- School board Receives regular briefings, asks about trends and open findings, and supports funding for independent review.
- Business and finance officer Keeps compliance evidence for federal program certifications and aligns oversight findings with audit and insurance needs.
Insurance relevance
Underwriters look for signs that leadership actually monitors the program: regular reporting to the superintendent and board, vulnerability scanning, and outside testing. At renewal, these answers may be checked against scan reports or assessment summaries.
What carriers commonly ask
- Does the person responsible for security report to senior leadership and the board on a regular schedule?
- Do you scan internet-facing systems for vulnerabilities, and how often?
- Has an outside party performed a security assessment or penetration test recently, and were critical findings fixed?
- How do you track remediation of findings from audits and assessments?
Tip: State scan and assessment frequencies that match your logs, and attach the latest report summary if the carrier accepts supporting documents.
Funding and free help
- State and Local Cybersecurity Grant Program (SLCGP) — Georgia subawardsGeorgia FY2024 round closed May 15, 2026 · watch for the FY2025 round
Federal cyber grant passed through the state to local governments, including school districts. Georgia accepted FY2024 subaward applications April 1 – May 15, 2026. Federal authority beyond September 30, 2026 depends on Congress.
- CISA K-12 cybersecurity resources and toolkitAlways available
Free federal guidance for K-12: the K-12 cybersecurity report and toolkit, plus access to regional CISA advisors and no-cost services. A resource, not funding.
Programs, eligibility and deadlines change; confirm on the official page before applying.
Learn more
- Cyber Hygiene ServicesCISA
CISA's no-cost scanning of an organization's internet-facing systems for known vulnerabilities and weak configurations, with regular reports and alerts on urgent findings; web application scanning is also offered. Districts enroll by email and use the reports to find and fix exposed systems before attackers do.
- No-Cost Cybersecurity Services and ToolsCISA
A searchable catalog of CISA's own no-cost services plus no-cost tools from public and private organizations. It recommends starting with three steps: contacting your regional Cybersecurity Advisor, enrolling in Cyber Hygiene vulnerability scanning, and the other foundational measures it lists. Useful when a district needs capability without new budget.
- Cross-Sector Cybersecurity Performance GoalsCISA
A short, voluntary set of high-impact security practices that CISA recommends for organizations of every size, intended to help smaller organizations prioritize limited resources. Districts can use the goals as a baseline checklist and as a benchmark for measuring progress, and they connect directly to the actions in CISA's K-12 toolkit.
- Cybersecurity FrameworkNIST
NIST's home for Cybersecurity Framework (CSF) 2.0, organized around six functions: Govern, Identify, Protect, Detect, Respond, and Recover. It links the framework document, profiles, mappings to other standards, and quick-start guides. This portal's rubric follows the CSF structure, so districts can use it to understand each category and to build a current-versus-target profile.
- Cybersecurity Rubric (CR)CoSN
A free self-assessment rubric for schools, aligned with the NIST Cybersecurity Framework and organized as a maturity model, available as an interactive tool, Google Sheets, Excel, or PDF. CoSN also offers free training on using it and an evaluator certification. Districts can use it to score their maturity and track improvement over time.