1. Hardware and Software Inventory

The first step is to identify all devices, applications, and cloud services used by the school. Without an up-to-date inventory, it is impossible to manage updates effectively, identify outdated equipment, or assess potential vulnerabilities.

Checklist:

• Create an inventory of computers, servers, tablets, and network devices.

• Document installed operating systems and applications.

• Identify hardware and software that are no longer supported.

• Identify systems that store or process personal data.

• Assign responsibility for maintaining each critical infrastructure component.

The inventory should be updated whenever new equipment is introduced, configurations change, or devices are decommissioned.

2. School Network Segmentation

If administrative computers, student devices, and guest Wi-Fi operate on the same network without access restrictions, a compromised device can pose a threat to other systems.

Network segmentation divides the infrastructure into separate zones with controlled communication between them. VLANs and firewalls are commonly used for this purpose.

Checklist:

• Separate networks for administration, teachers, students, and guests.

• Restrict communication between network segments using firewall rules.

• Isolate IoT devices, including cameras and interactive classroom equipment.

• Secure network equipment management interfaces.

• Use modern Wi-Fi security protocols.

Guest devices should have internet access without being able to connect directly to internal administrative resources.

3. Identity and Access Management

A compromised teacher or administrator account can lead to personal data breaches and unauthorized access to educational systems.

The fundamental security principle is to grant users only the permissions necessary to perform their responsibilities.

Checklist:

• Use individual user accounts for employees.

• Enable multi-factor authentication (MFA), prioritizing critical accounts.

• Separate access permissions for teachers, administrative staff, and IT specialists.

• Keep privileged accounts separate from everyday user accounts.

• Promptly disable accounts belonging to former employees and students who have left the school.

Active Directory, Microsoft Entra ID, and other identity and access management (IAM) solutions can be used for centralized administration.

4. Computer and Mobile Device Protection

School IT environments typically include desktop computers, laptops, tablets, and students' personal devices. Differences in configurations and security controls increase the risk of malware infections.

Checklist:

• Install endpoint protection software on managed devices.

• Implement centralized security policy management.

• Restrict local administrator privileges.

• Enable disk encryption on devices containing sensitive information.

• Provide remote locking capabilities for lost devices.

If the school allows students or staff to use personal devices under a Bring Your Own Device (BYOD) policy, these devices should connect to a separate network segment with restricted access to internal resources.

5. Patch Management and Vulnerability Management

Outdated operating systems, applications, and network equipment firmware may contain known security vulnerabilities. Attackers can exploit these weaknesses to gain access to infrastructure and spread malware.

Checklist:

• Implement centralized patch management.

• Prioritize remediation of critical and actively exploited vulnerabilities.

• Regularly update network equipment firmware.

• Test updates for compatibility with educational applications.

• Replace unsupported software.

Major updates can be scheduled during periods of low activity. However, critical security patches should not be postponed simply to wait for school holidays.

6. Data Backup and Recovery

Data backups protect schools against the consequences of hardware failures, accidental deletion, and ransomware attacks. Particular attention should be given to electronic gradebooks, administrative databases, educational materials, and financial records.

The 3-2-1 backup strategy can be used: maintain three copies of data, store them on two different types of media, and keep one copy off-site.

Checklist:

• Identify critical systems and data.

• Configure automated backups.

• Store protected backup copies separately from the primary infrastructure.

• Monitor backup job execution.

• Regularly perform test restorations.

• Define Recovery Point Objectives (RPO) and Recovery Time Objectives (RTO).

RPO defines the maximum acceptable period of data loss, while RTO specifies the target time for restoring a system. These metrics help determine the required backup frequency and disaster recovery capabilities.

7. Cloud Service Security

Microsoft 365 Education, Google Workspace for Education, and LMS platforms allow schools to use modern IT tools without deploying their own server infrastructure.

However, cloud providers are not responsible for every aspect of security. Account management, access permissions, and data processing configurations often remain the responsibility of the educational institution.

Checklist:

• Enable MFA for employees and administrators.

• Restrict public access to documents and folders.

• Regularly review user permissions.

• Disable unused applications and integrations.

• Configure security event logging.

• Review third-party service data processing terms.

Special attention should be paid to applications requesting access to student information. Before integrating such services, schools should assess whether the requested permissions are necessary.

8. Student Data Protection

Schools process personal data belonging to minors, including contact information, academic records, and, in some cases, medical information.

In the European Union, the processing of such information is governed by the General Data Protection Regulation (GDPR) and applicable national legislation. Educational institutions must ensure lawful processing, restrict access, and comply with relevant data protection requirements.

Checklist:

• Identify categories of personal data and the purposes for processing them.

• Restrict access to confidential information.

• Use encryption for data in transit and, where necessary, at rest.

• Establish data retention periods and deletion procedures.

• Review agreements with providers that process personal data.

• Develop a data breach response procedure.

For certain personal data breaches, GDPR requires notification of the supervisory authority within 72 hours of becoming aware of the incident. Schools should therefore designate personnel responsible for assessing such situations in advance.

9. Security Monitoring and Incident Response

Even well-protected infrastructure can be successfully attacked. It is therefore important to detect suspicious activity promptly and have a prepared response plan.

Security monitoring relies on event logs, endpoint protection tools, intrusion detection systems, and network traffic analysis solutions.

Checklist:

• Collect security events from critical systems.

• Monitor suspicious login attempts.

• Assign responsibility for handling security incidents.

• Prepare response procedures for ransomware attacks and data breaches.

• Establish procedures for isolating infected devices.

• Periodically test incident response processes.

Smaller schools can outsource security monitoring to a Managed Security Services provider if they lack sufficient internal technical resources.

10. Cybersecurity Awareness Training for Staff and Students

Technical security controls cannot completely eliminate human error. Phishing emails, fake login pages, and fraudulent messages remain common methods of gaining unauthorized access to organizational systems.

Teachers and administrative staff should understand the main indicators of cyberattacks and know how to report suspicious activity. Digital security training for students should be adapted to their age.

Checklist:

• Conduct regular cybersecurity awareness sessions.

• Train employees to recognize phishing messages.

• Explain secure account management practices.

• Establish a clear channel for reporting security incidents.

• Incorporate digital safety topics into student education.

Practical exercises help reinforce knowledge and assess staff readiness to respond to common threats.

Where Should Schools Start Improving Cybersecurity?

For educational institutions with limited budgets, implementing all security measures simultaneously may be too challenging. Therefore, improvements should be prioritized.

The first steps should include conducting an IT infrastructure inventory, enabling MFA for critical accounts, addressing the most dangerous vulnerabilities, and verifying that backups can be successfully restored.

The next stage involves network segmentation, centralized device management, security monitoring, and incident response planning.

More advanced solutions, including Security Information and Event Management (SIEM) systems and extended Endpoint Detection and Response (EDR) platforms, should be implemented based on infrastructure size and risk assessment results.

If a school does not have its own security team, some responsibilities can be outsourced to an external IT provider. However, the institution should retain control over critical systems and decisions related to personal data protection.