K-12 Cybersecurity is a Leadership Issue, Not Just an IT Issue

October is Cybersecurity Awareness Month. Learn more about how the LTC can make your school’s team more cyber-aware with staff trainings, consultations, and resources →

For years, cybersecurity in K-12 schools was treated primarily as a technology department responsibility. If the issue involved passwords, phishing, firewalls, backups, or data security, the assumption was simple: send it to IT.

Hindsight being 20-20, that approach has never worked.

After more than a decade as a K-12 technology director, and now working with school technology leaders and districts across Illinois, I’ve seen firsthand how much the role of technology leadership has changed. Cybersecurity is certainly part of the technology leader’s responsibility, but protecting a district requires much more than the latest and greatest technical measures.

Cybersecurity requires strategy, coordination, and at times, tough decision-making. In other words, cybersecurity is more than just an IT issue; it’s a leadership issue that demands attention from district leadership.

K-12 technology teams can implement important safeguards. We can strengthen authentication, secure networks, improve backups, manage access, protect endpoints, and monitor systems.

But configurations and protocols only address part of the challenge.

The 2025 CIS MS-ISAC K12 Cybersecurity Report analyzed data from more than 5,000 K-12 organizations and found that 82% of reporting schools experienced cyber threat impacts. More importantly, human-targeted threats exceeded technical exploits by at least 45%.

That matters because no firewall, endpoint protection platform, or filtering solution can create a cybersecurity culture. But buy-in from the boardroom can.

Teachers, administrators, office staff, substitutes, and other employees all make decisions that affect security. They need training, clear expectations, and an environment that encourages reporting suspicious activity.

IT teams can provide the tools and training, but district leadership sets the expectation that cybersecurity is everyone’s responsibility.

That culture has to come from the top.

Cybersecurity is one way a district addresses and reduces risk. Many of the decisions that determine how much risk a district accepts aren’t decisions the technology department can make on its own. 

As a technology leader, I could identify vulnerabilities, recommend safeguards, and explain what could happen if a risk went unaddressed.

But technology leaders don’t operate with unlimited time, staffing, or budgets. Neither do school districts. Every district, through its leadership, must decide which risks to address first and what resources it is willing to commit to those priorities.

Should the district invest in stronger backup infrastructure? Endpoint protection? Staff training? A security assessment? Additional staffing or outside expertise? Should replacing an aging system take priority over a classroom technology initiative?

Those aren’t simply technical decisions. They are organizational decisions that necessitate organizational perspective.

The technology leader can and should help leadership understand the risk, possible impact, available options, and recommended course of action.  District leadership then must determine the priority and allocate the resources needed to address it.

Cybersecurity also cannot be a district priority only after an incident occurs. A significant segment of day-to-day school operations now rely on technology, making cybersecurity a non-negotiable, ongoing priority.

Without it, the impacts spread fast.

One of the strongest points the 2025 CIS MS-ISAC K12 Cybersecurity Report makes is that a cyber incident affects much more than traditional computers. Schools depend on technology for student records, communications, food service, transportation, special education, financial operations, instruction, building systems, and countless other essential functions. When those systems become unavailable, the problem quickly becomes an operational crisis.

The report recommends that schools develop and regularly review service continuity plans so that critical services can continuecarry on, even when technology systems are compromised. It specifically points to areas such as meal programs, student records, emergency communications, and manual backup procedures.

Essentially, this is a business continuity matter, and it cannot belong solely to IT.  The technology department can explain which systems are critical, how they depend on one another, and how recovery works. But district leaders and department owners must decide which operations must continue and what happens when normal systems are unavailable.

No single product or policy will make a school district completely secure. Cybersecurity is an ongoing effort to reduce risk, prepare for disruption, and protect the district’s ability to operate, teach, communicate, and serve its community.

Technology leaders play an important role in that work. We understand the threats, recommend safeguards, communicate risk, build strong technical practices, and help our districts prepare. But we cannot, and should not, carry the responsibility alone.

The 2025 CIS MS-ISAC K12 Cybersecurity Report reinforces this point by calling for a culture of shared responsibility, stronger communication, collaboration, and preparation. District leadership helps create that culture by setting priorities, providing resources, reinforcing expectations, participating in incident response, and ensuring the district can continue serving students when technology is disrupted.

In short: technology leaders can initiate and inform cybersecurity efforts, but they’re more likely to succeed when district leadership shares that essential responsibility.

Addressing vulnerabilities fueled by OSINT is one way to keep your district ahead of emergent cyber threats. Strategy, and consistent leadership, can also go a long way toward keeping your district’s cybersecurity posture durable and resilient.

Our vCISO program offers fractional cybersecurity leadership and the big-picture perspective needed to understand, manage, and communicate cybersecurity risk.

Learn more about our program or explore how a vCISO excels at contextualizing decisions impacting cybersecurity for district stakeholders →

Another sure-fire way to strengthen your cybersecurity strategy: secure dedicated leadership that can bridge the gap between technical knowledge and priority setting.

Our vCISO program offers that level of leadership, at only a fraction of the cost.

Learn more about our program or explore how a vCISO excels at answering key questions from district stakeholders, including, “Where are we most exposed?” and “Are we prepared if something happens?” →