NACS Board updated on cybersecurity changes | News | #hacking | #cybersecurity | #infosec | #comptia | #pentest | #ransomware

“It has to follow industry standards, not just industry standards K-12, but industry standards that are built for businesses,” Gebers said, adding the district does already have some cybersecurity precautions in place. “What this bill really wants is it listed out, documented, tested, proven and then, when the auditor of state comes in, they’ll ask for these certain documents that you’ll have to provide.”

Superintendent Dr. Erik Belcher added districts who have had ransomware incidents in the past have claims paid through their insurance companies, which have been pushing to implement some of these safeguards in recent years by offering better rates on insurance coverage.

Gebers said he recently attended a training and became certified as a cybersecurity rubric evaluator and will be making recommendations on what needs to be included in the plan and then staff will work to create a policy with the necessary information and action steps.

“That helps us as a district be able to have some validity behind how we’re evaluating our school district on where we stand and what we need to enact … and help us evolve that into a document that we can then follow,” Gebers said.

It’s anticipated that policy will be presented to the board for consideration in May or June as the bill requires it to be in place by July 1.

The bill also outlines specific deadlines to report any cybersecurity incidents, including ransomware attacks, to state agencies. Ransomware is a type of malicious software or malware that prevents users from accessing their computer files, systems or networks and demands they pay a ransom for their return. Gebers noted one change in the bill requires board approval to pay a ransom whereas previously a superintendent or treasurer could authorize the payment.

Due to the sensitive nature of the material, Gebers noted cybersecurity plans are exempt from public records requests.

While this is being required through the state, Gebers added it is an unfunded mandate where the district will not receive additional funds to meet requirements such as updates or trainings.