Why education became a favorite ransomware target, the obligations schools already carry (FERPA, GLBA, CMMC for research), and a realistic security agenda for lean IT teams.
The education sector spent years assuming obscurity was protection: who attacks a school district? The answer, it turned out, is anyone optimizing for victims with valuable data, thin defenses, lean IT staffing, and enormous pressure to restore operations quickly. Districts and universities now rank among the most-attacked sectors, ransomware groups publish stolen student records when unpaid, and vendor compromises have repeatedly turned one supplier’s breach into hundreds of institutions’ incidents. Education’s data is unusually durable loot: a child’s stolen identity can be exploited for years before anyone checks the credit file.
The obligations schools already carry
- FERPA governs student education records for any institution taking federal education funds. It predates modern security practice and prescribes little technically, but a breach of records it protects triggers federal scrutiny, state breach statutes, and the community’s trust all at once.
- GLBA applies to higher education. Colleges and universities participating in federal student aid are financial institutions under the Safeguards Rule, and compliance is checked through the federal student aid audit process. That means a written information security program, a designated qualified individual, risk assessments, prescribed safeguards including MFA and encryption, and vendor oversight, obligations many institutions still meet only on paper.
- CMMC and NIST 800-171 reach research universities. Defense-funded research involving CUI brings the same obligations as any defense contractor, and research environments, built for openness and collaboration, are structurally the hardest place to drop an enclave. Universities that map and contain their CUI footprint early spend a fraction of what late movers spend.
- State student privacy laws add a second layer for K-12, commonly regulating what vendors may do with student data and pushing districts toward formal vendor agreements and inventories.
A realistic agenda for lean teams
Education IT cannot buy its way to an enterprise security program, and does not need to. The highest-return agenda is short and concrete. Know your data: an inventory of where student, financial, and research data lives, including the ed-tech vendors holding most of it. Control identity: MFA on staff and administrative accounts defeats the most common attack outright, and prompt deprovisioning closes the revolving-door exposure of student and seasonal accounts. Segment what matters: business systems, student information systems, and research environments should not share a flat network with lab machines and classroom devices. Backup like ransomware is coming, because it is: offline or immutable copies, tested restores, and a written decision framework for the worst week. Train the money paths and the help desk, the two human targets attackers prefer. And govern vendors, because in education the vendor is the attack surface: contracts, questionnaires, and an exit plan for data when the relationship ends.
The governance piece
Every one of those items is achievable with modest budget; what they require is ownership, and that is the gap in most institutions, where security accountability sits informally with whoever runs IT. A named responsible individual, an annual risk assessment that drives the project list, board or cabinet visibility, and a tested incident plan convert scattered good intentions into a program. For higher education under GLBA, that structure is not advice, it is the rule.
Daytol works with K-12 districts and higher education institutions on right-sized security programs: risk assessments, GLBA Safeguards compliance, CUI scoping for research environments, incident response, training, and the physical security of the buildings themselves. The first conversation is free, and school-year timing is real, so summer is the season to move.