What Do Cyber Insurance Carriers Require of K–12 Districts?

Why Cybersecurity Threats to K–12 Schools Are on the Rise

In K–12 schools, advanced technologies aid learning, but they also introduce new risks. In its 2025 K–12 cybersecurity report, the Center for Internet Security found that 82% of schools had experienced impacts from cyberthreats, with 8,100 confirmed cybersecurity incidents.

Schools are a tempting target for bad actors. “They have a lot of sensitive information about students and teachers and other constituents,” says Rob Sheldon, senior director for public policy and strategy at CrowdStrike.

In addition, “schools and districts are often seen as softer targets,” says CoSN cybersecurity project director Amy McLaughlin. Ransomware gangs and cybercriminals know that schools may be under-funded when it comes to security, and that helps fuel the steady rise in attacks.

They’re not wrong. According to CoSN’s U.S. State of EdTech 2026 report, two-thirds of K–12 districts say they lack the budget and staff to prioritize cybersecurity challenges, including cyber insurance. But many district leaders also say the ramifications of an attack would be severe, especially if it disrupted network or administrative functions.

From Attestation to Proof: What Cyber Insurers Require Districts To Prove

Cyber insurers have the same expectation as property or liability insurers: They want to know that the insured is taking steps to actively mitigate risk. In the case of cyber liability insurance, this means schools must have “a strong cybersecurity baseline,” Sheldon says. “They’re looking to see what cybersecurity defenses exist — practically, concretely.”

Insurers might require schools to have the following safeguards in place:

• Multifactor authentication for staff and student accounts
• Endpoint detection and response for district devices
• Verified backups that are separate from the main network
• Ongoing staff cybersecurity training
• A documented incident response plan

Schools generally tee up their cyber coverage through attestation. The insurer sends out a survey, “and you could say, I have all the things. I checked all your boxes,” McLaughlin says. But a demand for proof may come later, and that can be problematic if districts have overpromised.

“If you have a cybersecurity incident and they come in and say, ‘You haven’t done patches in nine months, and we’re only going to pay 25% percent,’ then that’s on you,” she says.

What K–12 Cyber Insurance Covers (and What It Excludes)

There’s no federal mandate for K–12 to have cyber coverage. Across states, policy is a mixed bag, CoSN reports.

Arkansas, for example, requires all public school districts to obtain cybersecurity insurance. In West Virginia, a state risk pool buys cyber liability coverage for every county school board. In Indiana, cyber coverage for schools is optional, while a bill in Texas would require districts to report on how much they spend on cyber insurance, but would not require them to buy it.

Click the banner below to receive the latest K-12 EdTech content directly in your inbox.

“It can vary widely from state to state,” McLaughlin says. “And insurance companies have variability in what they include in their cybersecurity coverage.”

A policy may offer protection for impacts caused by hacking or virus incidents, as well as for data loss, and it may help to cover the costs of crisis management, according to the Washington Federation of Independent Schools.

But the policy typically won’t cover “preventable security issues, such as poor configuration management or mishandling digital assets,” WFIS reports. And therein lies the problem.

Conducting a True K–12 Cybersecurity Risk Assessment

It’s ironic that sometimes schools remain nonsecure because they have cyber coverage. People may think, “I don’t need to worry about securing my environment because I’ve transferred my risk, I bought insurance,” McLaughlin says.

That can lead to IT teams overlooking the basics. “Do you have multifactor authentication? Do you do some kind of identity validation? Do you patch your machines every month?” she says. When schools don’t attend to the basic block-and-tackle of cyber hygiene, bad actors have room to operate.

Cyber insurers will send a questionnaire, but schools need to conduct a true risk assessment to support real cyber resilience.

That assessment should be based on live data, not logs and reports. “Static reporting gives insufficient signal,” Sheldon said. To that end, CrowdStrike, for example, will “deploy sensors out on the network and be able to give a real-time, accurate depiction of vulnerabilities.”

McLaughlin points to the National Institute of Standards and Technology’s Cybersecurity Framework and the Center for Internet Security’s 18 Critical Security Controls as free resources that can provide a basis for a robust risk assessment. “You can look at those and ask: Am I doing this? Yes or no? And if I’m not doing it, what risk does that entail?” she says. Or, if there’s money in the budget, “you can hire somebody to come in and do a risk assessment. Sometimes having an outside risk assessment is really helpful.”

UP NEXT: Learn how districts can measure their cybersecurity return on investment.

How K–12 Districts Can Create Cybersecurity Systems That Stick

Once they’ve assessed the risk, IT leaders can work to build cybersecurity systems that stick, even in a fast-changing threat landscape.

Longevity in cyber resilience depends on diligence. “It’s not a one-and-done,” McLaughlin says. “It’s a constant practice of continuous process management and improvement.”

That means tending to the fundamentals: routine patching, turning off unused accounts and shutting off excess permissions. “All of those pieces go to making your environment harder to get into than somebody else’s environment,” she says.

But even that might not be enough. As artificial intelligence and other factors elevate the threat level, “it’s just getting harder and harder to be able to credibly say that you could do these things yourself,” Sheldon says.

The right partner can help schools stay safe. “With some of these AI-assisted attacks, it really makes sense to contemplate having a managed security service — specifically, managed threat hunting and managed detection and response,” he says.