CIS Report Highlights K-12 Cyber Incident Preparedness Gaps

A Center for Internet Security (CIS) report cited in a November 10, 2026 article found that 51% of surveyed K-12 organizations experienced a cyber incident in the prior year, while just 15% regularly practiced their incident-response plans. The findings highlight a practical preparedness gap for school organizations: districts may have plans on paper but lack regular opportunities to rehearse decisions, responsibilities and operational responses under pressure. For government contractors serving education customers, the statistics offer a market signal—not evidence of a specific funded program or procurement action.

The article, published by GovTech and written by Julia Gilban-Cohen, describes the kinds of decisions school leaders may face when an attack disrupts district systems: who determines whether systems should be shut down, who communicates with families, and how the district responds when compromised technology is operated by an outside vendor. Rob Lelewski, Senior Vice President of Cyber at Marsh, said school districts are familiar with emergency response for severe weather and school safety threats, but cyber incidents add complications involving sensitive information, third-party services and decisions extending beyond the IT department. Those operating realities can shape requirements for planning and readiness support.

Third-party risk is a particularly relevant area for potential contractor offerings. Districts may rely on vendors to store student information, including sensitive health records, yet may not know where the data is held or what notification duties their agreements impose. Lelewski described a tabletop exercise in which district representatives initially assumed a vendor holding electronic health records would notify the district after a compromise. When asked whether notification was contractually required, participants were uncertain about what their agreement specified. The example points to possible needs for vendor-risk reviews, contract-obligation mapping, breach-notification procedures and exercises that test how district and provider responsibilities work in practice.

The article also emphasizes that the issue should not be framed as schools being universally unprepared. Lelewski noted that districts often have limited personnel and resources while managing large amounts of sensitive information, much of it held by outside providers. Matt Berninger, Senior Vice President and Principal Cyber Analyst at Marsh, said schools face overlapping threats: criminals may target widely used platforms to reach many organizations, while also seeking victims under pressure to restore essential services quickly. For contractors, the 15% practice rate can inform service design around realistic scenarios, leadership decision-making and continuity of school operations. However, the source identifies no solicitation, contract value, procurement contact, funding source or timeline, so firms should treat this as an indicator of potential need and monitor district and state-level procurement activity rather than assume a near-term opportunity.

• CIS report: 51% of surveyed K-12 organizations experienced a cyber incident in the prior year; only 15% regularly practiced incident-response plans.
• Potential service areas: Incident-response planning, tabletop exercises, third-party risk reviews, breach-notification readiness and continuity planning.
• Leadership decisions to rehearse: System shutdown authority, family communications and response when an outside vendor’s technology is compromised.
• Vendor-risk gap: District representatives in a Marsh tabletop exercise were uncertain whether vendor agreements required notification of a compromise affecting electronic health records.
• Data exposure: K-12 providers may store student information, including sensitive health records, making data location and contractual responsibilities important review areas.
• Threat context: Shared platforms can expose multiple organizations, while pressure to restore essential services can make schools attractive targets.
• Contractor positioning: Use the reported practice gap to shape practical, scenario-based offerings that account for limited district staffing and resources.
• Acquisition caveat: The article identifies no specific solicitation, funded requirement, contract value, procurement contact or procurement timeline.
• Expert guidance: Lelewski advised, “The easiest thing I would say is, look at past incidents for inspiration.”