CISA Releases K-12 Cybersecurity Guidance Amid Rising Risks

K-12 schools in the United States are increasingly vulnerable to cyberattacks, with data breaches, ransomware attacks, and other threats posing significant risks to students' education and sensitive data. According to CISA, the most common cybersecurity threats faced by K-12 schools include data breaches, ransomware attacks, business email compromises, denial of service attacks, and invasions. Cybercriminals often target schools due to the availability of public information about their policy, planning, budgeting, resources, and personnel. CISA notes that cybersecurity may often take a back seat to other priorities in school systems, as schools are often forced to choose between students' education and other cyber defense options like equipment, information technology infrastructure, personnel, and software. Between 2018 and 2021, CISA found that schools and districts disclosed over 1,300 cybersecurity incidents, although not all incidents are publicly reported. The release of CISA's K-12 cybersecurity guidance comes at a time when the education sector is facing significant challenges in terms of cybersecurity support. The agency's workforce was reduced by nearly a third in the first half of 2025 due to staff cuts across the federal government. Additionally, the Multi-State Information Sharing and Analysis Center (MS-ISAC) lost its federal funding last year and has since lost 70% of its membership, including dozens of states and over 10,000 local jurisdictions that can no longer afford its crucial cybersecurity services. K-12 cyberattacks have led to significant school disruptions in recent years, including temporary closures and widespread exposure of sensitive student and staff data. In the first half of 2026, there were a total of 34 ransomware attacks in the U.S. targeting both K-12 and higher education institutions, with 12 cases confirmed and 22 unconfirmed. To strengthen their networks, CISA advises K-12 district and cybersecurity leaders to implement the following objectives: - Protect the login credentials of students and staff. - Safeguard student and staff devices. - Perform, verify, and test backups. - Create and practice a cyber incident response plan. - Tap into available cybersecurity training and awareness campaigns. - Protect sensitive data. - Prioritize and invest in strategies outlined in the full list of applicable CISA Cross-Sector Cybersecurity Performance Goals. - Develop a customized long-term cybersecurity plan that leans on the National Institute of Standards and Technology Cybersecurity Framework. By implementing these objectives, K-12 schools can better protect themselves against the growing threat of cyberattacks and ensure the continued safety and security of their students and staff.