Five Strategies for Strengthening Cybersecurity in Small School Districts Lessons from CoSN 2026

CHICAGO — As the digital landscape of American education becomes increasingly complex, small school districts find themselves at a critical crossroads, balancing the rapid integration of instructional technology with the growing sophistication of global cyber threats. During a featured session at the Consortium for School Networking (CoSN) 2026 annual conference in Chicago, three prominent K-12 technology leaders addressed the unique vulnerabilities of smaller educational institutions, offering a comprehensive blueprint for maintaining cyber-readiness on a limited budget. Ed McKaveney, Technology Director at Hampton Township School District; Richard Platts, Chief Technology Officer of Allegheny Intermediate Unit; and Chris Smallen, Chief Technology Officer of Lenoir City Schools, outlined a strategic framework designed to help under-resourced districts bridge the gap between their current security posture and the rising tide of digital risk.

The presentation underscored a sobering reality: small school districts are often the most attractive targets for cybercriminals precisely because they lack the robust IT departments and multimillion-dollar security budgets of their larger counterparts. However, the data they steward—social security numbers, medical records, and academic histories of thousands of students and staff—remains a high-value asset on the dark web. The speakers argued that size and budget should no longer be viewed as insurmountable barriers to security, but rather as catalysts for more creative, collaborative, and resourceful defense strategies.

The Evolving Threat Landscape: Beyond Ransomware

While ransomware remains a primary concern for K-12 IT leaders, the CoSN session highlighted that "disruptions" come in many forms, some of which are entirely untethered from malicious actors. Ed McKaveney shared a poignant example from Hampton Township School District in Pennsylvania, where a severe weather event served as a "stress test" for the district’s infrastructure. A massive storm system, characterized by multiple tornado-like paths across the county, decimated the local power grid.

"We ended up having no power for however many days, plus no internet for the rest of the week after we had power restored," McKaveney told the audience. This anecdote served to redefine the concept of "cyber-readiness." In the modern era, being cyber-ready does not just mean stopping a hacker; it means ensuring the continuity of educational services regardless of the cause of the outage. Whether the threat is a Russian hacking collective or a downed power line, the result is the same: a total cessation of learning and administrative operations.

The chronology of threats facing K-12 institutions has shifted dramatically over the last decade. From 2015 to 2020, most incidents were limited to simple data breaches or localized phishing attempts. However, the post-pandemic era (2021–2026) has seen a surge in "triple extortion" tactics, where attackers encrypt data, steal it for public release, and then harass parents and students directly to force a payment. For small districts, these tactics are psychologically and financially devastating.

A Five-Point Model for District Resilience

To combat these multifaceted threats, the presenters introduced a five-point model specifically tailored for small-to-mid-sized districts. This model emphasizes structural preparedness over expensive software solutions, focusing on the human and procedural elements of security.

1. Asset Management and Risk Assessment

Before a district can protect its network, it must understand what is on it. Small districts often suffer from "shadow IT," where individual departments or teachers purchase software or hardware without the IT department’s knowledge. The first step in the model is a comprehensive audit of all digital assets, prioritizing those that house sensitive personal identifiable information (PII).

2. Strategic Communication and Board-Level Advocacy

One of the most significant hurdles for tech leaders is translating technical risks into "boardroom language." The presenters emphasized that cybersecurity is not an IT problem; it is a business continuity and student safety problem. By framing security needs in terms of risk mitigation and legal compliance, tech leaders can more effectively lobby for the necessary resources from superintendents and school boards.

3. Leveraging the "Power of the Shared"

Resource scarcity is the defining characteristic of small-district IT. The model advocates for "shared services," such as those provided by intermediate units or regional educational service agencies. By pooling resources with neighboring districts, small systems can gain access to enterprise-level tools, such as Security Operations Centers (SOC-as-a-Service) or managed detection and response (MDR) platforms, that would be unaffordable on an individual basis.

4. Incident Response and Continuity Planning

The presenters stressed that the middle of a crisis is the worst time to develop a plan. A robust incident response plan must be written, tested through "tabletop exercises," and kept in a physical format—since digital copies may be inaccessible during a network lockout. This plan should include pre-defined roles for communications, legal counsel, and technical recovery.

5. Continuous Training and Culture Building

Finally, the model identifies the human element as the most common point of failure. Cybersecurity must become part of the district’s culture. This involves regular phishing simulations and, more importantly, a non-punitive environment where staff feel comfortable reporting mistakes immediately.

Utilizing Free and Federal Resources

A significant portion of the session was dedicated to the wealth of free resources currently available to K-12 institutions. With the federal government increasingly recognizing schools as "critical infrastructure," agencies like the Cybersecurity and Infrastructure Security Agency (CISA) have expanded their offerings.

The presenters highlighted the CISA "Toolkit for Protecting K-12 Organizations," which provides a step-by-step guide to aligning school security with the NIST Cybersecurity Framework. They also praised CoSN’s own library of resources, particularly their "one-pagers." These documents are designed to be "conversation starters" with non-technical stakeholders.

"CoSN’s one-pagers in particular can be useful as conversation starters when communicating needs to superintendents," McKaveney noted. These tools help bridge the gap between the IT closet and the superintendent’s office, ensuring that security remains a top-tier administrative priority.

Furthermore, the presenters encouraged tech leaders to look toward higher education. Many small school districts are comparable in size and complexity to small private colleges. By establishing Best Practice Sharing (BPS) agreements with local universities, districts can gain insights into emerging threats and even collaborate on student internship programs that provide the district with extra hands while giving college students real-world experience.

The Role of Law Enforcement: Building the FBI Relationship

Perhaps the most unconventional advice offered during the session was the necessity of building a proactive relationship with federal law enforcement. Richard Platts and Ed McKaveney discussed the importance of knowing their local FBI field office contacts before an emergency occurs.

"The first time that you’ve made contact with your FBI liaison shouldn’t be the first time you end up having an issue. Just at least know the person and have their phone number," McKaveney advised.

Platts added a lighter note to the serious topic, remarking on the unusual nature of modern IT leadership: "I never imagined I would have multiple FBI special agents’ cell phone numbers in my contacts." While it may feel "weird," as McKaveney admitted, these relationships are vital. In the event of a ransomware attack, the FBI can provide critical intelligence on the threat actor and, in some cases, provide decryption keys that are not publicly available.

Data Analysis: The Cost of Inaction vs. The Cost of Preparation

Supporting the presenters’ arguments is a growing body of data regarding the financial impact of cyber incidents on the education sector. According to 2025 industry reports, the average cost of a data breach in the K-12 sector has risen to over $2.1 million when considering downtime, recovery, and legal fees. For a small district with a total annual operating budget of $20 million, a single incident can be catastrophic, potentially leading to the elimination of programs or staff to cover recovery costs.

Conversely, the "Five-Point Model" emphasizes low-cost interventions. Implementing Multi-Factor Authentication (MFA), which is often free or low-cost through existing productivity suites like Google Workspace or Microsoft 365, can block up to 99% of automated cyberattacks. The presenters argued that by focusing on these "high-yield, low-cost" actions, small districts can achieve a level of security that rivals much larger organizations.

Broader Implications and the Future of K-12 Tech

The CoSN 2026 conference takes place at a time when the federal government is considering new mandates for school cybersecurity. There is ongoing discussion in Washington regarding the inclusion of cybersecurity hardware and services in the E-Rate program, which historically has only funded telecommunications and internet access.

The strategies shared by McKaveney, Platts, and Smallen represent a shift in the philosophy of educational technology. It is no longer enough to simply provide devices to students; districts must now ensure the "digital safety" of the environment in which those devices operate.

The implications of this shift are profound. As AI-driven attacks become more common, the "shared resource" model will likely become the standard rather than the exception. Small districts will increasingly rely on regional "cyber-fortresses"—centralized hubs of security expertise that serve dozens of smaller systems.

In his closing remarks, Chris Smallen emphasized that the goal is not perfection, but resilience. By utilizing free tools, building relationships with law enforcement, and following a structured model of preparedness, even the smallest district can become a difficult target for cybercriminals. The message from Chicago was clear: in the battle for digital security, collaboration is the most powerful weapon a small district possesses.