Districts eye proactive cyber threat protection as risks increase

This press release originally appeared online.

Key points:

Cybersecurity threats to K-12 schools are growing in frequency, sophistication, and cost, yet many school districts remain under-resourced and underprepared, according to the CoSN 2025 State of EdTech District Leadership report.

The report highlights state-level actions to strengthen K-12 cybersecurity amid escalating threats and shrinking federal support and details recent legislative activity across five states. It also provides recommendations on governance, funding, workforce development, incident response, and data standards to help state and district leaders across the country secure the future of digital learning.

Sixty-one percent of school districts rely on general funds rather than dedicated cybersecurity budgets to protect their networks and data, the report notes.

Recent federal policy shifts, including the elimination of funding for the Multi-State Information Sharing and Analysis Center (MS-ISAC), have weakened national support for school districts. In response, states such as Arkansas, Massachusetts, Oregon, Pennsylvania and Texas are taking action. The 2025 legislative actions reviewed in the report provide ideas for developing and adopting policies that will help school districts and their partners address these challenges.

“While federal support for K-12 cybersecurity is in turmoil, several states are advancing innovative, bipartisan legislation to help safeguard student data, improve incident response, expand insurance access, and build the cybersecurity workforce we urgently need,” said Keith Krueger, CEO, CoSN. “These states’ common strategies offer actionable ideas for state and district leaders across the country and underscores the importance of system-wide collaboration and strategic leadership.”

Key findings

• Eighteen K-12 cybersecurity bills were introduced in 2025 across the five states studied.
• Seven bills became law–all in Arkansas and Texas–focused on insurance access, training and infrastructure support, cyberattack response, data practices, and risk assessments.
• Sixty-one K-12-focused and broader cybersecurity bills were introduced across the five states in 2025 that would indirectly benefit K-12 cybersecurity, covering government systems, postsecondary institutions or crosscutting issues such as insurance, incident response, AI accountability and workforce development.
• Several common policy strategies emerged across the cybersecurity legislation introduced or enacted in the tracked states:
  • Centralized cybersecurity governance and oversight
  • Cybersecurity insurance and risk management
  • Cybersecurity workforce development and education
  • Integration of cybersecurity into K-12 and higher education policy
  • Incident reporting and crisis response readiness
  • AI, privacy and cybersecurity intersection

Policy recommendations

• Establish or Strengthen Statewide K-12 Cybersecurity Governance: Designate a cybersecurity lead within the state education agency and ensure that school districts are included in state-level cybersecurity planning and governance bodies.
• Fund and Require School District Cybersecurity Risk Assessments: Allocate funding for school districts to conduct risk assessments and develop mitigation strategies.
• Align Workforce Policy with K-12 Needs: Support teacher certification in cybersecurity and create K-12 student pathways aligned with current and emerging workforce demand.
• Mandate Incident Reporting and Create Response Protocols: Require timely reporting of cybersecurity incidents and support districts with coordinated response plans and training exercises.
• Update Procurement and Data Governance Standards: Require that vendors meet minimum cybersecurity standards and align procurement processes with national frameworks.

By adopting well-designed strategies–centralized oversight, insurance requirements, workforce investment, integrated planning and responsible innovation oversight–states can help their school districts move from reactive to resilient. Cross-sector collaboration and sustained investment will be critical to protecting students, educators and the integrity of public education systems.