The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has launched its K-12 Cybersecurity Foundations Resource Package, a new set of tools designed to help schools and school districts prevent, mitigate and respond to cyber threats.
The initiative reflects a growing concern on both sides of the Atlantic: as education becomes increasingly dependent on digital platforms, cloud services, connected devices and online learning tools, schools are becoming an increasingly attractive target for cybercriminals.
Unlike many private companies, schools often operate with limited cybersecurity budgets and relatively small IT teams, while managing vast amounts of sensitive information. Student records, teachers’ personal data, financial information, health-related information, login credentials and communications with families can all become valuable targets for attackers.
A successful attack can also have consequences that go far beyond data theft. Ransomware can bring lessons, administrative services and even entire school networks to a halt. Stolen credentials can give attackers access to email accounts and cloud platforms, while compromised devices can provide a gateway into wider school or district networks. For students, the risks can extend to identity theft, online harassment, exposure of personal information and the misuse of their digital identities.
“Cyberattacks on K-12 schools and districts jeopardize not only the integrity of our educational mission, but the safety and security of our students and teachers as well,” said CISA Acting Director Nicholas Anderson. “The K-12 Cybersecurity Foundations Resource Package empowers school communities with practical strategies and supports our school safety mission.“
Schools face a growing and increasingly complex threat
CISA’s package is designed to help school and district personnel understand these risks and adopt basic security measures. It provides resources for education leaders and non-technical staff, as well as cybersecurity and IT professionals, recognising that cybersecurity can no longer be treated as a problem belonging exclusively to the IT department.
The package includes a Getting Started Guide, a detailed Implementation Guide and a six-part video series. Its recommendations are organised around eight key objectives, including protecting login credentials, securing devices, testing backups and strengthening cybersecurity training.
That focus on basic cyber hygiene is particularly important in education, where a single compromised account can potentially provide access to multiple services. Teachers, students and administrative staff regularly use email, learning-management systems, cloud storage, video-conferencing platforms and third-party educational applications. The resulting ecosystem creates multiple entry points for attackers.
The rapid adoption of artificial intelligence is adding another layer of complexity. Students and teachers are increasingly interacting with generative AI tools, while cybercriminals are using AI to make phishing messages, impersonation attempts and social-engineering campaigns more convincing. Human error therefore remains one of the most important attack vectors.
CISA Acting Executive Assistant Director for Infrastructure Security Scott Breor said that “K-12 cybersecurity has evolved beyond an IT department concern and must now be recognized as a fundamental pillar of school safety and security.”
The problem extends beyond the United States
The challenge is not unique to American schools. European education systems face many of the same vulnerabilities as they undergo their own digital transformation.
The European Union Agency for Cybersecurity (ENISA) identifies ransomware, malware, threats against data, social engineering, attacks on availability and supply-chain attacks among the major threats affecting Europe’s digital environment. Its 2025 Threat Landscape analysed 4,875 incidents recorded between July 2024 and June 2025, with phishing accounting for about 60% of observed initial intrusion vectors.
For schools, this creates a particularly difficult combination of risks. Educational institutions are highly interconnected but often have fewer cybersecurity resources than large corporations. They also depend increasingly on third-party cloud providers, educational software, digital identity systems and connected devices. A vulnerability in one of those services can potentially affect large numbers of schools simultaneously.
The consequences can also be amplified by the nature of the information schools hold. Children’s personal data is particularly sensitive because it can remain valuable for years and may be used for identity fraud or other forms of abuse. At the same time, students themselves are frequent users of social networks, messaging platforms and online services, making them exposed not only to attacks against school infrastructure but also to phishing, account theft, cyberbullying and other forms of online exploitation.
ENISA has recognised the need to address this problem directly. Its CyberEducation platform provides cybersecurity resources tailored to primary and secondary schools across EU member states, while a separate 2024 study assessed the maturity of cybersecurity education in primary and secondary schools across the Union.
Cybersecurity is becoming part of school safety
The growing convergence between physical safety and digital security is changing how schools need to approach cybersecurity.
An attack that disables a school’s network can disrupt communications with parents, prevent access to administrative systems and interfere with teaching. A stolen teacher account can be used to impersonate staff. A compromised student account can expose private information or become a stepping stone for attacks against other users.
This means that protecting a school increasingly requires more than firewalls and antivirus software. Schools need strong authentication, regular software updates, secure backups, access controls, staff training, incident-response plans and clear procedures for dealing with compromised accounts and devices.
CISA’s resource package is intended to provide precisely that kind of roadmap. Its guidance complements other U.S. cybersecurity resources, including CISA’s Protecting Our Future: Partnering to Safeguard K-12 Organizations from Cybersecurity Threats and the National Institute of Standards and Technology (NIST) Cybersecurity Framework.
The broader message is increasingly relevant on both sides of the Atlantic: cybersecurity is no longer simply about protecting a school’s computers. It is about protecting the school itself — its students, teachers, data, services and ability to operate.
