A 2026 report from the Center for Internet Security, MS-ISAC and CoSN found that more than half of K-12 schools and districts experienced a cybersecurity incident during the 2025-26 school year, with over 11,600 incidents requiring escalation and response and 1 in 3 reporting disruption to operations. A RAND survey of K-12 school principals found that 60% reported a cybersecurity incident at their school during the 2023–2024 or 2024–2025 school years. For school boards and local government bodies, those numbers carry direct legal and operational weight.
Elected leaders are responsible for cybersecurity policy, regulatory compliance and the crisis plans that govern how their organizations respond when something goes wrong. The attack surface has grown year on year, through Internet of Things devices in hardware and AI tools and chatbots in software, and incident disclosure timelines have tightened. A board that understands its specific legal obligations is in a considerably stronger position than one that treats cybersecurity as an IT department problem.
Public sector organizations, from school boards to community colleges and city councils, operate under strict requirements for disclosing data breaches, protecting sensitive information and storing personal data securely.
The practical case for understanding those requirements in depth goes beyond avoided penalties. Board members who understand the regulatory landscape can ask sharper questions in IT briefings, push for adequate resourcing and hold leadership to specific standards rather than vague assurances. When a breach does occur, ransomware can inflict serious financial costs, followed quickly by the harder-to-repair damage to public confidence. And there's a straightforward ethical dimension: public boards hold personal data on behalf of the communities they serve, and protecting it well is part of that obligation.
This article covers:
Get our latest public sector regulations outlook report and avoid costly surprises with expert-backed, actionable guidance
Cybersecurity regulation in local government and public education spans digital safety, data management, informed consent, user authorizations and more. These regulations continue to evolve as both security measures and cyber threats develop. In 2024, 258 cybersecurity bills were proposed in 42 US statehouses, and 29 passed. The pace hasn't let up: CoSN's 2025 State Cybersecurity Legislation Report highlights new K-12-focused cybersecurity bills in states including Arkansas, Massachusetts, Oregon, Pennsylvania and Texas, a sign of sustained legislative momentum, even as federal support for school cybersecurity infrastructure has come under pressure. Requirements are tightening across reporting obligations, encryption standards, user protections and AI safety.
School boards face a substantial and growing list of federal cybersecurity and data protection requirements. The most significant of these are:
Importantly, although FERPA does not require districts to alert the public of data breaches, state laws typically do (as we'll explain momentarily). The federal Privacy Technical Assistance Center (PTAC) publishes breach response resources for schools to help fill that gap, and the National School Boards Association offers guidance on notifying affected individuals, state Attorneys General and others following a breach.
A number of programs and centralized resources make it easier for schools to comply with these requirements. The Federal Communications Commission (FCC) is running a $200 million pilot program to support cybersecurity infrastructure, equipment and training for K-12 schools, though demand far exceeds its current capacity. The Readiness and Emergency Management for Schools (REMS) office of the U.S. Department of Education publishes cybersecurity guidance for K-12 leaders, including fact sheets covering common threats and response steps. CISA has published dedicated K-12 cybersecurity guidance, including a joint report covering the most common attack types targeting schools and practical steps districts can take.
Local government faces a similarly detailed set of obligations. Key cybersecurity measures include:
Like school boards, local governments must have plans and contingencies in place for responding to data breaches. The laws governing those responses vary from one jurisdiction to the next, with some states requiring notification within 30 days and others allowing indefinite time windows. We suggest consulting this state-by-state overview of data breach notification laws for the specifics that apply to your jurisdiction.
In most states, local governments and school boards must comply with law governing information systems security and consumer privacy, incident disclosures after data breaches and other cybersecurity requirements set by state Departments of Education.
To illustrate these interacting requirements in detail, consider the contrasts between Florida (public school population 2.4 million) and Connecticut, where public schools serve just over half a million students.
Floridians' personal data benefit from four major regulations covering cybersecurity:
Connecticut has designated cybersecurity as a state priority and built a substantial central resource library to support school boards, local governments and other bodies. A published state strategy sets goals and additional resources help local leaders comply with key laws, including:
Almost every state in the union legislates cybersecurity in two basic ways: They require elected public officials to faithfully and promptly report any breaches in publicly held data, and they establish a set of baseline information privacy measures, sometimes presented as guidelines and in other cases as strict regulatory requirements with associated penalties for noncompliance.
For representative examples, consider the Alabama Data Breach Notification Act and the Hawaii Breach of Personal Information Law. Every single US state has a law on the books that shares a general structure with these examples. Typically, such laws protect vital identifying information (Social Security Numbers, driver's license numbers, etc.) as well as contact information and medical/biometric information. The laws vary in specifics, such as the timing of the disclosure, how citizens must be notified and when exceptions apply, but most share basic characteristics.
Information privacy guidelines are more varied. Several states have developed frameworks that go beyond breach notification. California's student data privacy laws are among the most detailed in the country. State IT agencies in Illinois and Georgia publish cybersecurity best practices that apply to public sector bodies. For readers in states not covered specifically here, the PTAC state search tool and CoSN's annual report (both listed in the helpful sources below) are the most efficient starting points for finding what applies to you.
Meanwhile, cybersecurity laws in Arkansas include a "self-funded" program to help cover the costs of certain types of data breaches. Many states use policies like this Massachusetts law creating a cybersecurity council or center to plan both requirements and responses for state agencies and municipal bodies (including school boards).
Due to the complexity of these statutes and the variance state-to-state, local officials, school board representatives and other elected leaders in the public sector should consult the most recent guidance from their state's Department of Education (DoE), consumer protections agency (if applicable) and similar bodies. Almost all states issue guidelines, some with requirements for implementation, through their DoE.
Helpful sources for recent updates include:
Given the specificity of data privacy laws for schools, and the wide range of penalties that can accrue to districts that flout them, a good starting point is an overview of the current cyber threat landscape: Understanding what districts are actually up against shapes every decision that follows.
From there, building a cyber risk framework gives the board a practical structure for assessing and prioritizing its exposure.
For a wider view of how boards are approaching this, a survey of publicly elected leaders covers what's working and where boards are struggling. A detailed checklist then works through the specific duties of the board and translates them into concrete actions.
Districts that rely on free file-sharing tools or personal email take on specific, documented risks: no enforceable access controls, no audit trail for sensitive documents, and limited ability to respond quickly when a breach must be reported. These gaps tend to surface at the worst possible moment, during an incident investigation or when a state agency asks for evidence of compliance.
Purpose-built security closes each of those gaps by design. It also makes it safer to adopt new tools: AI and productivity software can be brought in within a governed, auditable environment rather than connected to an uncontrolled stack.
Diligent Community is built specifically for public boards, with capabilities that map directly to the compliance, disclosure and data protection requirements those boards operate under:
If your board is working through its cybersecurity obligations and wants to understand what purpose-built platform security looks like in practice, schedule a demo.
