• Was confidential data compromised?
• Was data lost or corrupted?
• Was equipment stolen or misused?
• Was email or Internet service interrupted?
• Did virus or spam attacks cause shutdowns?

• Inadequate technical safeguards?
• Insufficient staff training?
• Unauthorized access to or use of systems by insiders?
• Intrusion by outsiders?

• Loss of efficiency, productivity, or other costs?
• Failure to meet district educational objectives?
• Damage to reputation?
• Harm to students or staff?

• When was our security plan last updated?
• When was our security plan most recently reviewed by outside experts?
• What steps does the plan require us to do?
• What are the major risks we are still exposed to?

District security rules.

• Do we have a clear policy about data privacy?
• When were our staff and student AUPs last reviewed and updated?
• Have rules been effectively communicated to staff and students?

Legal review.

• Has the policy been reviewed by legal counsel to ensure alignment with local, state, and federal laws and regulations – including FERPA and HIPAA?

External controls.

• Are we confident that the data and communication systems of our outside service providers (payroll, email, data warehouse)?
• How have we verified those assurances?

Hardware.

• Can our network equipment support current security standards?
• Are all desktop and laptop computers individually protected from internal viruses?

Software.

• Do all our computers receive security patches or virus definition updates automatically?
• If not, how long does it take to fully install patches/updates from the time they are released?

Monitoring.

• Do we have the capacity to centrally monitor the status of all our equipment to know which machines are not secure, and to remotely perform other troubleshooting?
• Are our systems set up to enforce all our network security, system access, and data privacy policies?

Design.

• Is our network designed to prevent unwanted intrusion?
• Do we have external and internal firewalls?

Wireless security.

• Have we secured wireless networks against intruders?

Passwords.

• Do we enforce regular updates of secure passwords by all users?

Environmental hazards.

• Is all network equipment located in facilities protected against flooding, burst pipes, freezing, overheating, or fire?

Physical security.

• Do we regularly check to ensure that only authorized people can physically access key equipment?
• Is all network equipment located in locked rooms dedicated solely for that purpose (no secondary custodial or secretarial use)?
• Is all end user equipment cabled down and labeled?

Awareness.

• How well do all users understand their own self-interest in keeping our IT systems operational, and know what they need to do to maintain system security?
• How do we encourage user involvement in setting, enforcing, and reviewing security policies?

Preparedness.

• Are crisis response staff identified and trained?
• Have we done a “dry run” test of our crisis management plan recently?
• Have we improved our crisis management plan as a result of that test?