Govern
Direction, accountability, policy, oversight and supplier risk. Who decides, and how decisions are followed through.
6 categories
How it works
From a common rubric to practical progress.
K12 Cyber Forward follows one guided improvement cycle: join, build a Cybersecurity Rubric 2.0 baseline, own the next steps and show the work. Each district moves at its own pace, with support from GLET and Georgia peers.
- 22
- rubric categories
- 6
- functions, NIST CSF 2.0-aligned
- 5
- maturity levels per category
- 3
- review pathways
The journey at a glance
Measure. Prioritize. Improve. Prove. Sustain.
Every district follows the same five-stage path at its own pace, then loops back each school year as practice matures.
The journey at a glance: five stages, repeated as practice matures.
- MeasureBuild an honest Cybersecurity Rubric 2.0 baseline across all 22 categories, with the reasons behind each rating.
- PrioritizePick the few areas that matter most this year and agree who leads each one.
- ImproveTurn priorities into dated actions that fit the school calendar, with practical tools and peer support.
- ProveKeep supporting evidence next to the work and choose the review pathway that fits.
- SustainReturn to the baseline each year, recognize progress and set the next priorities.
The improvement cycle
Four steps, repeated as practices mature.
The cycle is designed for real district calendars. Work happens in short sessions, owners are named and evidence builds up as a by-product of doing the work.
- 01
Join the program
An authorized district contact requests participation. GLET reviews the district and the contact before preparing any account access, and the requester receives a private receipt link to follow the status. Nothing is provisioned automatically.
This week: agree internally who will be the district's program contact.
- 02
Build the baseline
Agree on the scope, then rate each of the 22 categories of the Cybersecurity Rubric 2.0. Every category comes with authored guidance: what the control is for, how it looks in a school district, evidence examples, quick wins and crosswalks to NIST CSF 2.0 subcategories and CIS Controls v8.1. Record the method, your confidence and the rationale behind each rating.
This week: invite the people who own the processes being rated, not just IT.
- 03
Own the next steps
Turn the lowest or least-supported areas into an improvement plan with owners and dates. Connect it to school-year operations such as account rollover and access reviews, tabletop exercises, vendor renewals and policy discussions, so improvement fits the calendar instead of competing with it.
This week: pick three actions you can finish this semester.
- 04
Show the work
Keep redacted supporting evidence next to the work it supports. Evidence is reviewed by people and can expire, so the record stays honest. Choose the review pathway that fits, then return to the baseline as practices improve.
This week: decide what "good evidence" looks like for your top three actions.
The rubric, mapped
How the Cybersecurity Rubric 2.0 fits NIST CSF 2.0.
The rubric is what districts rate. NIST CSF 2.0 is the alignment layer that keeps the language consistent with the wider field.
The rubric leads; NIST CSF 2.0 is the alignment layer. The Cybersecurity Rubric 2.0 rates 22 categories, grouped under the six NIST CSF 2.0 functions, and describes each category across five maturity levels.
- 1Initial
- 2Repeatable
- 3Defined
- 4Managed
- 5Optimized
- Govern 6 categoriesOrganizational Context · Risk Management Strategy · Roles, Responsibilities, and Authorities · Policy · Oversight · Cybersecurity Supply Chain Risk Management
- Identify 3 categoriesAsset Management · Risk Assessment · Improvement
- Protect 5 categoriesIdentity Management, Authentication, and Access Control · Awareness & Training · Data Security · Platform Security · Technology Infrastructure Resilience
- Detect 2 categoriesContinuous Monitoring · Adverse Event Analysis
- Respond 4 categoriesIncident Management · Incident Analysis · Incident Response Reporting and Communication · Incident Mitigation
- Recover 2 categoriesIncident Recovery Plan Execution · Incident Recovery Communication
Category names follow NIST CSF 2.0. Orientation graphic, not an assessment result.
The framework underneath
Six functions every district already performs.
The Cybersecurity Rubric 2.0 organizes its 22 categories under the six functions of the NIST Cybersecurity Framework 2.0. Most districts already do some of this work; the rubric helps describe how consistently.
Identify
Knowing your systems, data, dependencies and risks, and improving from what you learn.
3 categories
Protect
Accounts and access, awareness and training, data security, platform security and resilient infrastructure.
5 categories
Detect
Monitoring and analysis that turn signals into timely, informed escalation.
2 categories
Respond
Managing, analyzing, communicating about and containing incidents.
4 categories
Recover
Restoring services and communicating during recovery so learning resumes.
2 categories
Review pathways
One rubric. Three levels of review.
Rubric ratings describe practice. Review pathways describe who examined the work and how. The two stay separate, so a district can be honest about both.
Self-assessed
Your district team establishes its own baseline and records the current practice.
- Who leads
- District assessment team
- What supports it
- Scope, ratings and written rationale
- Good for
- A first baseline and annual check-ins
Guided & assisted
A named facilitator helps the team examine its baseline and work through questions.
- Who leads
- District team with a facilitator
- What supports it
- Working sessions and category review
- Good for
- Calibrating ratings and building shared understanding
Independently reviewed
A named third-party verifier reviews the stated scope and shared supporting evidence.
- Who leads
- Independent verifier
- What supports it
- Evidence, category decisions and recorded review scope
- Good for
- An issued, time-bounded review record for a stated scope
A review records what was examined, for a stated scope and period. It does not certify that a control works or predict incidents.
- Level 1 Self-assessedYour district team sets its own baseline and records current practice.
- Level 2 Guided & assistedA named facilitator helps the team examine the baseline and work through questions.
- Level 3 Independently reviewedA named third-party verifier reviews a stated scope and issues a time-bounded review record.
Rubric ratings describe practice; the pathway describes who examined the work. A review records what was examined for a stated scope and period. It is not a certification.
Inside the private portal
The tools that make the cycle stick.
Participating districts get a private, role-based workspace. A few of the tools teams use most:
- Guided assessmentCategory guidance, evidence examples, NIST CSF 2.0 and CIS Controls v8.1 crosswalks, and history that is amended, never overwritten.
- Improvement planOwners, dates and status for every action, linked to the rubric categories they improve.
- Evidence lockerSupporting files with human review, expiry dates and clear status.
- Tabletop exercisesSchool-day scenarios with injects, facilitator tips and after-action notes.
- Vendor registryData privacy agreement status and renewal dates for the services your schools rely on.
- Learning and community resourcesOriginal lessons with knowledge checks, plus handouts for staff, families and students.
How long does a baseline assessment take?
It depends on the scope and who takes part. Plan for a series of short working sessions over several weeks rather than one long meeting. A clear scope and the right people in the room matter more than speed.
Who should be on the assessment team?
Include the technology lead plus people who own the processes being rated: someone from the superintendent's cabinet, finance or business operations, human resources, student information and, where possible, a school-level leader. Each person brings knowledge the rubric asks about.
Does a low score mean we failed?
No. A baseline shows where to start. The program is supportive, not punitive: low ratings point to help and practical next steps, and individual district results are never ranked publicly.
How do the three review pathways differ?
Level 1 is self-assessed by the district team. Level 2 adds a named facilitator who helps the team examine the baseline. Level 3 is independently reviewed by a named third-party verifier who issues a time-bounded review record for a stated scope. Compare the pathways.
Does an independent review certify our district?
No. A Level 3 review records what a verifier examined, for a stated scope and period. It is not a certification that any control works, and it does not predict or prevent incidents.
Ready when your district is
Start with one conversation.
Request participation, or ask the program team how the cycle would fit your district's calendar.