A district can train every employee and still be exposed through a company it pays. New data shows why vendor management belongs on the cybersecurity checklist.
When a district thinks about cybersecurity, it usually thinks about its own staff, its own network, and its own accounts. A report from the Center for Internet Security and the Consortium for School Networking, covered by K-12 Dive on October 27, points to a quieter exposure: the vendors that hold student data. Citing a Moody’s report from October, the coverage notes that 57 percent of education-sector debt issuers surveyed reported a third-party cyber incident since 2020, compared with 40 percent across all industries. Across all sectors, third-party incidents rose from 19 percent to 39 percent between 2020 and 2025.
A district can lock every door in its own building and still lose data through a door it does not own.
What the Examples Show
The article cites the 2024 PowerSchool ransomware attack and the 2026 Instructure Canvas breach as incidents that exposed sensitive data of millions of teachers and students. These are widely used products, and districts that adopted them did so for good reasons. The lesson is not that those tools are uniquely risky. It is that the more systems touch student records, the more places a problem can start.
Start With an Inventory
Most districts cannot say, on a single page, which vendors hold student data. Tools get added by individual schools, grant programs, and teachers, and many are never reviewed. An inventory is the first step: the vendor’s name, what data it holds, who owns the relationship, when the contract ends, and whether a data privacy agreement is in place. A shared spreadsheet is enough. The point is to see the list.
Ask Five Questions
For each major vendor, a district can ask five plain questions. How is student data stored and protected? Who at the vendor can access it? How quickly will we be told if something goes wrong? What happens to our data when the contract ends? Do you use multi-factor authentication for your own staff? Good vendors answer these quickly and in writing. Slow or vague answers are information too.
The best vendors treat security questions as a sign of a serious customer.
Put It in the Contract
Contracts are where promises become obligations. Districts can ask for incident notification within a set number of hours, limits on how student data may be used, deletion or return of data at termination, and the right to review security documentation. Many states and consortia publish model agreements that smaller districts can adopt without starting from scratch.
Budgets Are the Constraint
The same report found that 56 percent of leaders said their cybersecurity programs were underfunded, and 70 percent said budget problems forced them to delay projects, tools, or staffing. Vendor management is one of the cheapest places to make progress, because it relies on questions and paperwork more than new software. A part-time owner, a quarterly review, and a one-page standard are within reach of almost any district.
What Vendors Can Do
Companies that serve schools can make this easier. Publish a clear data protection summary. Offer a standard privacy agreement. Name a security contact. Commit to notification timelines. Support multi-factor authentication for customer accounts. Districts notice these things, and in a crowded market they can make the difference between a renewal and a replacement.
Review on a Schedule
Vendor risk changes as contracts renew and products add features. A short quarterly review of the inventory, with the owner for each relationship confirming that nothing material changed, keeps the list honest. Add a trigger for new tools: no new product touches student data until someone has asked the five questions.
A Fair Reading of the Data
Some caution is in order. The MS-ISAC figures cover only organizations that use its services, the survey included 426 leaders, and the coverage gives no incident cost figures. The Moody’s numbers describe debt issuers, not every district. Treat the findings as a strong signal that vendor risk is real, and not as a precise national count.
For the full findings, the habits that work, and a 30-day readiness plan, read K12 Data’s analysis of the K-12 cybersecurity report. If you serve technology leaders, business officials, or superintendents and want to reach them, you can build a targeted K-12 contact list here.
About the Author: Charlie Isham is the Founder and CEO of K12 Data, Inc., which operates K12 Data, College Leads, and K12 Talent. He has spent more than 15 years building education data infrastructure and has watched how schools, colleges, and the companies that serve them buy for over a decade. He is based in Encinitas, California.
