Ransomware readiness for school districts: five questions to answer now

Schools are an attractive target for ransomware. They hold years of sensitive records about students and staff, they run on tight budgets and small IT teams, and an outage stops something the whole community notices: the school day.

The useful question is not whether your district has security tools. It is whether you could recover quickly if those tools were bypassed. These five questions help you find out, and each one points to a practical next step.

1. Who would notice an attack at 2am on a Saturday?

Many attacks start outside working hours, when nobody is watching. If your security alerts go to an inbox that nobody reads until Monday, an attacker can have most of a weekend to move through your systems.

What good looks like: someone is watching alerts around the clock and is authorized to act, for example by isolating a device or disabling an account. For most districts that means a managed detection and response service or a security operations center as a service, rather than a team you build and staff yourself.

2. Is multi-factor authentication on everything that matters?

Stolen passwords remain one of the most common ways in. Multi-factor authentication (MFA) stops most of those attempts, but only where it is turned on.

Check these first: email, remote access, your student information system, finance and HR systems, and every administrator account. Admin accounts deserve the strongest protection, because they are what an attacker wants most.

CISA’s guidance for K-12 organizations puts MFA near the top of its recommendations for exactly this reason.

3. Could you restore your critical systems, and how long would it take?

Backups only help if they survive the attack and you can restore from them. Attackers often go after backups first.

Ask your team or provider:

• Are backups kept offline or immutable, so ransomware cannot encrypt or delete them?
• When did you last restore a critical system as a test, not just check that a backup job finished?
• How long would it take to bring back the student information system, finance and phones, in what order?

The answers usually reveal the most important gap. A restore that takes two weeks is a very different conversation with the superintendent than one that takes two days.

4. Does everyone know their role when something goes wrong?

An incident is a stressful time to work out who calls the insurer, who talks to families and who decides whether to take systems offline.

A written incident response plan should name:

• who leads the response and who can make decisions,
• who to call first: your insurer, legal counsel and any incident response provider,
• how you will communicate with staff and families if email and phones are down,
• which systems come back first.

Then walk through it with a tabletop exercise at least once a year. The first time a plan is used should not be during a real incident.

5. Do your protections still apply when devices leave the building?

Laptops and tablets go home with staff and students. If filtering, endpoint protection and updates only work on the district network, those devices are exposed the moment they leave.

What good looks like: endpoint protection and filtering that follow the device, updates that install wherever the device is, and the ability to lock or wipe a device that is lost.

Where to start

If several of these answers were uncertain, focus on the three that reduce the most risk soonest:

1. Turn on MFA for email, remote access and administrator accounts.
2. Confirm you have offline or immutable backups, and test a restore.
3. Make sure someone is watching alerts outside school hours.

Then write the incident response plan down and rehearse it. None of this requires a large team. It does require deciding who owns each piece, and checking that it works before you need it.