Hidden

score_text_good

A S "Satisfactory" estimated S2Score^® means that you have really spent time, effort and made investments in building a good information/cybersecurity program. The foundation of your program is laid, and now you're in "maintenance mode," although you still have some major projects and tasks to accomplish. Your risk exposure starts to diminish for Districts with a "Satisfactory" S2Score, so it's very important to spend your time and investments wisely and to effectively communicate your information/cybersecurity measurement of risk. To accomplish this, schedule the full S2School assessment with your info/cybersecurity partner, which will give you a clear picture of where to focus via a detailed Action Plan.

To support district leaders CoSN has partnered with the Cybersecurity Collaborative to provide their members with access to trusted security experts in a confidential venue. With a Satisfactory S2Score we recommend that you join Cybersecurity Collaborative to have access to these key artifacts: Planning for a Ransomware Attack, Measuring & Minimizing Third-Party Risk, Data Loss Prevention In-Depth, Social Engineering In-Depth, Cloud Assessment Checklist, and the IT Security Solution One-pager. As a CoSN Member you qualify for a discount off the list prices of the annual subscriptions, click here to learn more https://www.cosn.org/JointMembership or https://cyberleadersunite.com/request-access/

Hidden

score_text_excellent

An E or "Exceeds" S2Score^® is a rarity and something to take pride in. It's obvious that your District has spent significant amounts of time, effort and investments to build a best-in-class information/cybersecurity program. You have the proper structures in place to maintain what you've painstakingly built, and now you can focus on 1) continuous improvement and 2) finding more tangible returns for your investment. Schedule the full S2School assessment with your info/cybersecurity partner, which will give you a clear picture of where to focus via a detailed Action Plan, so you can share this with your team, District Leadership, and School board. A compromise of your defenses will always be a possibility, but you will likely detect such an event early on and be able to limit damages.

To support district leaders CoSN has partnered with the Cybersecurity Collaborative to provide their members with access to trusted security experts in a confidential venue. With a Exceeds S2Score we recommend that you join Cybersecurity Collaborative to have access to these key artifacts: Innovative ways to get your message out across the company, CISO reflections – Cloud Challenges, Security Operations BC Checklist for Pandemics, Tips on how your company can avoid social engineering cyber-attacks, Integrating Tools and Adjusting Thresholds to Identify AI Attacks, Sample Security Team Organizational Chart and Security Solution Capabilities. As a CoSN Member you qualify for a discount off the list prices of the annual subscriptions, click here to learn more https://www.cosn.org/JointMembership or https://cyberleadersunite.com/request-access/

Hidden

score_text_fair

A P "Progressing" estimated S2Score^® means that you have done some good things with respect to your Districts information/cybersecurity; however, significant gaps/risks still exist. Some of the foundational components of the program are in place, and it's time for the program to mature into a more formal initiative. This is the point in the program where information/cybersecurity efforts and investments need to start providing real and tangible results. The question, "where should we focus our time and investments?" is an important one to support with facts instead of gut instinct. Start by scheduling the full S2School assessment with your info/cybersecurity partner, which will give you a clear picture of where to focus via a detailed Action Plan. A compromise is still very much possible, but you are more likely to detect it and respond with some effectiveness. If District Leadership is involved with information/cybersecurity, which they probably are, continued improvement will only help them make better risk-based decisions.

To support district leaders CoSN has partnered with the Cybersecurity Collaborative to provide their members with access to trusted security experts in a confidential venue. With a Progressing S2Score we recommend that you join Cybersecurity Collaborative to have access to these key artifacts: How to Be Better Prepared and How to Recover from a Ransomware Attack, Information Security Assessments Third Party Vendors, The Anatomy of a Breach Five Key Steps to Prevent One, Know Who is Accessing your Systems and How, Incident response checklist and Ten key Security Policies. As a CoSN Member you qualify for a discount off the list prices of the annual subscriptions, click here to learn more https://www.cosn.org/JointMembership or https://cyberleadersunite.com/request-access/

Hidden

score_text_poor

A I "Insufficient" estimated S2Score^® means that you have significant areas of improvement for information/cybersecurity in your District. Your information/cybersecurity program is not mature enough for sustained improvement, and a significant compromise is possible in the short term. Whether or not your District would notice the threat, attack, data loss, or system compromise is not well known. Without significant improvements in your information/cybersecurity program, District Leadership’s decisions regarding security may not be easily defended should an adverse event occur. It’s imperative that you schedule the full S2School assessment with your info/cybersecurity partner, which will give you a clear picture of where to focus via a detailed Action Plan.

To support district leaders CoSN has partnered with the Cybersecurity Collaborative to provide their members with access to trusted security experts in a confidential venue. With a Insufficient S2Score we recommend that you join Cybersecurity Collaborative to have access to these key artifacts: How to be prepared before an incident happens, Employee Equipment Remote Use Policy, Cyber Insurance what’s covered what’s not, Lessons learned and a Case Study of Identifying High Risk Areas. As a CoSN Member you qualify for a discount off the list prices of the annual subscriptions, click here to learn more https://www.cosn.org/JointMembership or https://cyberleadersunite.com/request-access/

Hidden

score_text_verypoor

A GS "Getting Started" estimated S2SCORE^® usually means that you’re at the beginning of your security journey or that haven't yet taken the necessary basic steps to protect your District from a variety of risks and threats. The information/cybersecurity program lacks formality, and a significant compromise is highly probable in the short term. To make matters worse, depending upon the type of threat, the system compromise may go unnoticed for an extended period of time. If a systems compromise were to become publicly known, District Leadership may not have the necessary proof to defend the District against civil actions. It’s imperative that you schedule the full S2School assessment with your info/cybersecurity partner, which will give you a clear picture of where to focus via a detailed Action Plan.

To support district leaders CoSN has partnered with the Cybersecurity Collaborative to provide their members with access to trusted security experts in a confidential venue. With a Getting Started S2Score we recommend that you join Cybersecurity Collaborative to have access to these key artifacts: The Security & IT Leaders Handbook, Build your Security Program Essentials PT 1-2, What is a critical asset? Webinar, CRI Improving your password game, CRI Update your software and Cyber Insurance what’s covered what’s not, Lessons learned. As a CoSN Member you qualify for a discount off the list prices of the annual subscriptions, click here to learn more https://www.cosn.org/JointMembership or https://cyberleadersunite.com/request-access/

ADMINISTRATIVE CONTROLS

Administrative Controls are the way that we define the information/cyber security strategy, roles and responsibilities of workforce members (People).

RISK MANAGEMENT

Please select all statements that apply to your District:

Information/cyber security risk management processes are formally established, managed and agreed to by District leadership.

Yes
No

Risk Management is the set of activities taken to reduce or prevent a risk from having a negative impact to District operations.

The District approach to information/cyber security risk management is comprehensive; accounting for administrative (people), physical and technical threats as well as potential risks (vulnerabilities).

Yes
No

Comprehensive approach means to have cross functional teams comprised of stakeholders from each District function not just District technology team. Technical threats usually come in the form of virus, ransomware, DDOS or systems compromise.

The District has transferred some information security risk by obtaining cyber liability insurance.

Yes
No

Having cyber liability insurance is a critical component of any basic information/cyber security program, having adequate and appropriate coverage can be the difference between recovering quickly from an event or being down for weeks.

INFORMATION SECURITY GOVERNANCE

Please select all statements that apply to your District:

The District has defined a set of information security guidelines or procedures (policies) that are formally approved by District leadership (superintendent and/or school board).

Yes
No

Having formal security guidelines or procedures for how you are going to deal with the various aspects of info/cyber security is a critical part of any Districts security program. Sometimes guidelines or procedures are referred to as IT Security Policy, this is not school board policy, at a minimum you should have a school board policy that refers to the security guidelines or procedures for specifics.

Information security guidelines or procedures (policies) have been school board or District leadership within the last twelve (12) months or less.

Yes
No

It is necessary for District leadership to review any security guidelines or procedures at least annually or after any changes to ensure they are up to date and adequate. This responsibility can be delegated to a director of technology or a similar role.

District has identified and empowered a director of technology, school board member, CISO or similar position within the District.

Yes
No

Having a single point person appointed to be responsible for the day to day info/cyber security operations is a must have, most Districts allow for the superintendent to delegate this responsibility to the CTO or Director of technology for the District.

HUMAN RESOURCES SECURITY

Please select all statements that apply to your District:

District leadership endorses and complies with the District's security guidelines or procedures (policies).

Yes
No

Having official support of the adopted security guidelines or procedures from District leadership is important to a successful security operations program.

The District has developed and implemented a formal curriculum for information/cyber security security awareness, security education and training programs.

Yes
No

Formal curriculum for information/cyber security can come in many forms, it could be a webinar, all staff presentation, phishing awareness training with just in time training or a you tube video, at a minim the curriculum should include safe use of user names and passwords, what a security event looks like, who to report it to and when to report.

Background checks are performed on employees, third-party contractors and other associates in accordance with their roles and responsibilities, job functions and sensitive data access.

Yes
No

Background checks are not only important for physical safety but digital safety as well. Only allowing cleared people to access sensitive data is one more step you can take to keep students and staff safe from cybercrime.

ASSET MANAGEMENT

Please select all statements that apply to your District:

An asset management guideline/process exists and accounts for all information assets (physical, software and data) from acquisition through disposition/disposal.

Yes
No

An asset is any hardware device or software application used by the District to support learning or District operations. Any time a change is made to the inventory (new purchase, disposal of old equipment or software) it should be updated. Having a complete and up to date asset inventory will reduce the time it takes to respond and ultimately recover from a security event.

Asset and/or information (data classifications per state standards, regulations, law) requirements have been defined, including the acceptable controls for protection.

Yes
No

Acceptable controls are the steps you have taken to ensure the protection of the sensitive data in your care. You may have specific steps you have to take depending on your local laws. Consult an attorney for more information on your local requirements.

A complete, up-to-date, and detailed inventory of all cloud hosted services used by the District is maintained.

Yes
No

The cloud is simply computer you don't own or have physical access to, you still have the same obligations to inventory, monitor and protect these systems and the data on them. Some examples of cloud services commonly seen in Districts include student information system (SIS), HR / payroll system, HVAC systems, meals, fess, and activities payment systems.

FACILITY ACCESS MANAGEMENT

Please select all statements that apply to your District:

The District has documented processes and procedures for the protection of physical facilities including access controls, both physical and logical.

Yes
No

Physical safety is a critical part of information/cyber security Physical controls include items such as door locks, CCTV and door alarms Logical controls include locking the device when is it not in use and monitoring for unusual or suspicious activity.

At least bi-annual reviews of user accounts, privileged accounts, and service/system accounts are conducted according to a defined procedure.

Yes
No

Reviewing user accounts, especially system/ service and privileged user accounts, is an important step to ensure that: only authorized accounts have access to sensitive data; accounts with administrative permissions (ability to install software) or elevated permissions (access to very sensitive data, e.g. HR/Payroll, Special ED or medical data) are current and the permissions are still needed.

The District has formally defined guidelines / practices for the use and protection of log-in (user account) information (passwords, PIN numbers, tokens, etc.).

Yes
No

Having clearly understood rules for the safe use and handling of user accounts and log-in information is key to keeping data and systems safe from cyber criminals.

CRYPTOGRAPHY (Encryption)

Please select all statements that apply to your District:

The District has documented requirements for encrypting data at rest and in motion.

Yes
No

Data at rest is data stored on a systems or storage device. Data in motion is data traveling across the internet or network (e.g. https://) and is usually represented by a small lock icon in the upper left corner of the browsers address bar. Having formal documentation calling out the need for and type of encryption to be used to protect data helps keep processes consistent. This is especially helpful when asking vendors to adhere to the District's encryption standards. Encryption is a technical way of making data unreadable in the event it is lost or stolen.

The District has implemented procedures for applying encryption at rest (e.g. storage) and in motion (e.g. https).

Yes
No

Encryption has to be applied for it to work. Having a solid understanding of how to apply encryption is part of a solid security program. Encryption is a technical way of making data unreadable in the event it is lost or stolen. Data at rest is data stored on a systems or storage device. Data in motion is data traveling across the internet or network (e.g. https://) and is usually represented by a small lock icon in the upper left corner of the browsers address bar.

Roles and responsibilities for encryption tool and key management have been defined by District leadership.

Yes
No

Utilization of encryption requires the use of keys just like a door lock. Given the volume of users and devices, having a solid practice for keeping track of and managing the keys is an important part of any security program.

SECURITY OPERATIONS

Please select all statements that apply to your District:

The District can monitor for and respond to security events and take appropriate action based on guidelines/procedures (policy).

Yes
No

Having visibility to activities going on with devices and across the network is needed for rapid detection and response to security events. This is accomplished by active monitoring of District devices and networks.

Vendors have been assessed for risk and vendor systems are monitored for security events (if applicable).

Yes
No

A lot of security events start with a vendor who has poor information/cyber security practices. Holding your vendors to a high standard of information/cyber security supports student and staff safety.

INCIDENT MANAGEMENT

Please select all statements that apply to your District:

The District follows a formal process to report information security events, such as loss of service, loss of equipment, loss of facilities, system malfunctions, student information security events (student as attacker), human error and non-compliance with policies and information security guidelines.

Yes
No

Knowing who and how to report security events to can be the difference between a manageable security event and a full blown disaster. Making sure all staff are trained on what to report, to whom and when, is as foundational as a fire drill.

Incident response procedures are tested on a periodic basis (bi-annually).

Yes
No

Just like we do for fire drills, severe weather drills, and other safety drills, we must also practice our information/cyber security indecent response procedures. It is simply another type of crisis for which to plan and prepare.

Evidence collection and forensic procedures are documented.

Yes
No

Having a well documented and understood evidence collection procedure can save you time and headaches. It is also necessary if you intended to pursue criminal charges. Key technology staff should be formally trained in the collection and handling of digital evidence. You may be able to get this training from a Digital Forensics Investigator course, your local School Resource Officer, Department of Homeland Security or the FBI.

BUSINESS CONTINUITY MANAGEMENT

Please select all statements that apply to your District:

The District has a documented Business Continuity Plan (BCP) and Disaster Recovery Plan (DRP).

Yes
No

The Business Continuity Plan is the set of steps and actions that are taken in the event of a significant disruption to District operations to ensure minimal impact and continued operations and learning. The Disaster Recovery Plan is for recovering from a significant physical or digital disaster e.g. tornado hits building, data center fire, fiber optic cable cut, to name a few. It will outline steps and procedures to ensure a timely recovery of critical services to restore District operations and learning as soon as possible given the nature of the disaster.

The District's critical assets have been identified and defined (critical asset defined as loss of asset would cause students to go home or District operations to stop).

Yes
No

Critical assets are necessary for District operations and learning. These can include Servers, HVAC, physical security systems such as door locks, classroom phones and CCTV. They can also include systems such as HR/Payroll, lunch payment systems, etc. Each District has to decide for themselves what is considered a critical asset. (e.g. superintendent's laptop)

Disaster recovery plans are tested at least annually (within 12 months).

Yes
No

Having a plan is great but an untested plan is as good as no plan at all, just like with fire drills we MUST practice them at least annually.

COMPLIANCE (whats the law say)

Please select all statements that apply to your District:

All Federal, state and local regulations are followed by the District and its vendors (e.g. FERPA, COPPA, CIPPA, CCPA GDPR, MNGDPA, etc.).

Yes
No

One area that is often overlooked is, vendor management. Are the vendors you do business with adhering to the relevant laws regarding student data? This can include things such as how soon they have to notify you in the event of a data breach they experience. If you are unsure if your vendors are compliant conduct a vendor risk assessment using a tool such as S2 Vendor. https://assessmentsecuritystudiocom.kinsta.cloud/vendors/

Security reviews, audits and assessments are conducted by an outside independent party on an annual basis.

Yes
No

Having an outside independent security firm perform an assessment of your security program and practices is a key part of ensuring student and staff safety. Security is a complex area and having an outside expert take a look at least annually can be the difference between finding a flaw the needs to be fixed and finding yourself on the news explaining why students had to go home due to a cyber- attack.

Step 1 of 5

CoSN Risk Assessment Powered by S2

ADMINISTRATIVE CONTROLS

RISK MANAGEMENT

INFORMATION SECURITY GOVERNANCE

HUMAN RESOURCES SECURITY

ASSET MANAGEMENT

FACILITY ACCESS MANAGEMENT

CRYPTOGRAPHY (Encryption)

SECURITY OPERATIONS

INCIDENT MANAGEMENT

BUSINESS CONTINUITY MANAGEMENT

COMPLIANCE (whats the law say)

PHYSICAL CONTROLS

FACILITY SECURITY

EQUIPMENT AND INFORMATION

TECHNICAL CONTROLS (INTERNAL)

NETWORK CONNECTIVITY

REMOTE ACCESS

DIRECTORY SERVICES

SERVERS AND STORAGE

ED-TECH SYSTEMS

MOBILE DEVICES (e.g. cell phones, laptops)

LOGGING, ALERTING, AND MONITORING

VULNERABILITY MANAGEMENT

BACKUP AND RECOVERY

TECHNICAL CONTROLS (EXTERNAL)

BEST PRACTICES

CoSN S2School

Step 1 of 5

CoSN Risk Assessment Powered by S2

ADMINISTRATIVE CONTROLS

RISK MANAGEMENT

INFORMATION SECURITY GOVERNANCE

HUMAN RESOURCES SECURITY

ASSET MANAGEMENT

FACILITY ACCESS MANAGEMENT

CRYPTOGRAPHY (Encryption)

SECURITY OPERATIONS

INCIDENT MANAGEMENT

BUSINESS CONTINUITY MANAGEMENT

COMPLIANCE (whats the law say)

PHYSICAL CONTROLS

FACILITY SECURITY

EQUIPMENT AND INFORMATION

TECHNICAL CONTROLS (INTERNAL)

NETWORK CONNECTIVITY

REMOTE ACCESS

DIRECTORY SERVICES

SERVERS AND STORAGE

ED-TECH SYSTEMS

MOBILE DEVICES (e.g. cell phones, laptops)

LOGGING, ALERTING, AND MONITORING

VULNERABILITY MANAGEMENT

BACKUP AND RECOVERY

TECHNICAL CONTROLS (EXTERNAL)

BEST PRACTICES