Reading, writing, and arithmetic may be the best-known 3Rs in education. But as schools increasingly rely on digital tools to teach, communicate, and manage student information, district leaders need to adopt another set of 3Rs: Reduce, Replace, and Recover.
Introduced by CISA for Cybersecurity Awareness Month, these three actions offer a practical way to strengthen cybersecurity. Reduce everyday risks. Replace technology that can no longer be kept secure. Recover quickly when something goes wrong. For K-12 schools, the goal is not just to protect systems; it’s to protect student information and keep learning on track.
Reduce Everyday Risks
Not every cyber threat begins with an attack on a server. A convincing email may persuade an employee to share login credentials. A reused password may unintentionally give someone account access. An unvetted classroom app may collect more student information than necessary.
Reducing risk begins by taking routine steps: Use strong, unique passwords; turn on multifactor authentication; regularly update software; and learn to recognize and report phishing attempts. These are among the core practices CISA recommends for reducing vulnerabilities. Make sure staff know where to report a suspicious message or unexpected login prompt and encourage them to report it promptly rather than investigate it themselves.
In schools, reducing risk also means limiting unnecessary access to data. Review who can view student records, remove access when roles change, and consider what information is shared with each vendor. Before adopting a new tool or app, determine what data it collects, who can use that data, and whether its privacy settings can be adjusted. Teachers, administrators, students, and families all have a part to play, but districts must provide clear rules and support, so individuals are not left to make these decisions alone.
Replace Technology That Can No Longer Be Secured
Installing updates is essential, but updates cannot protect a device or application that is no longer supported by the manufacturer. CISA warns that end-of-support technology may stop receiving security patches, leaving known weaknesses available for attackers to exploit.
For districts, replacement planning may involve computers, network equipment, operating systems, or software used in classrooms and offices. An IT asset inventory can help technology teams identify what is currently in use, what still receives security updates, and what should be retired first. The inventory can also reveal tools that no longer serve a clear educational purpose but still maintain or connect to student data.
Replacing every aging system at once may not be realistic. Prioritize the technology that supports critical operations or handles sensitive information, then build a phased plan that reflects the district’s budget and school calendar. Cybersecurity Awareness Month is an opportunity to begin that conversation before an unsupported system forces an urgent decision.
Recover Quickly and Keep Schools Operational
Even well-prepared organizations can fall victim to a security breach. A solid recovery plan can help your district quickly respond to a cyber incident, restore essential services, and communicate with your community.
Backup critical data and test recovery and restoration protocols. Create an incident response plan that identifies decision-makers, staff contacts, and district communication procedures, should standard systems become unavailable. Consider the practical questions: How will schools take attendance if the student information system is down? How will staff reach families? Which services must be restored first? CISA recommends exercising response plans and preparing ways to continue essential functions during a disruption.
This work does not have to begin from scratch. CISA offers K-12-specific guides and materials designed to help schools prevent, mitigate, and respond to cyber threats. The FCC has also selected more than 700 schools, libraries, and consortia for a pilot program, offering up to $200 million over three years for eligible cybersecurity services and equipment.
Cybersecurity awareness matters most when it changes what a district does next. This October, use the 3Rs to identify one risk to reduce, one outdated system to replace, and one recovery procedure to test. Each step helps protect the information families entrust to schools and the services that students count on every day.
