How South Carolina is bringing together foundational cybersecurity protections, organizational maturity, and student data privacy through a coordinated statewide strategy.

Cybersecurity readiness and student data privacy are often approached as separate initiatives in K-12 education. Districts are asked to implement security controls, assess cybersecurity risks, demonstrate compliance, protect student information, and build trust with their communities.

Each responsibility is important. But when these efforts are managed independently, school systems can find themselves navigating multiple frameworks, collecting similar evidence, and working toward goals that are more closely connected than they might realize.

What if these efforts were not separate initiatives, but part of one coordinated statewide strategy?

That’s exactly what South Carolina is working to accomplish, bringing three complementary frameworks together to help school districts strengthen cybersecurity readiness, protect student data, and make meaningful progress toward shared goals.

threeframeworks

Through the South Carolina Department of Education, the state is bringing together three complementary frameworks to help school districts establish essential cybersecurity protections, evaluate and improve organizational cybersecurity maturity, and strengthen student data privacy practices.

The strategy connects:

  • South Carolina’s SC SAFE K-12 Cybersecurity Initiative: Establishing foundational cybersecurity protections.
  • CoSN’s Cybersecurity Readiness for Education (CCRE) Cybersecurity Rubric: Assessing organizational cybersecurity maturity and guiding continuous improvement.
  • CoSN’s Trusted Learning Environment (TLE): Strengthening student data privacy, responsible data practices, and community trust.

Each framework serves a distinct purpose. Together, they offer school systems a more comprehensive approach to cybersecurity readiness and student data privacy.

Three Frameworks, Three Important Questions

South Carolina’s strategy begins with recognizing that cybersecurity protections, organizational readiness, and student data privacy are interconnected, but they are not interchangeable.

1. SC SAFE K-12: Are the essential cybersecurity protections in place?

SC SAFE K-12 establishes foundational cybersecurity expectations for South Carolina school districts.

Grounded in the Center for Internet Security (CIS) Critical Security Controls v8, Implementation Group 1, the framework emphasizes essential protections, including asset inventory, access control, vulnerability management, incident response, and recovery.

These safeguards help districts address fundamental cybersecurity risks and establish a baseline for protecting school systems and operations.

But implementing cybersecurity controls is only part of the challenge.

Having protections in place does not necessarily mean an organization has developed the leadership, processes, and capacity to sustain and improve them over time.

That’s where the second framework becomes particularly valuable.

2. CoSN’s CCRE Cybersecurity Rubric: How mature and sustainable are our cybersecurity practices?

CoSN’s Cybersecurity Readiness for Education (CCRE) Cybersecurity Rubric helps school systems move beyond implementing individual cybersecurity controls to understanding their overall organizational cybersecurity maturity.

Aligned with the NIST Cybersecurity Framework 2.0, the rubric evaluates cybersecurity readiness across six functions:

Through the South Carolina Department of Education, the state is bringing together three complementary frameworks to help school districts establish essential cybersecurity protections, evaluate and improve organizational cybersecurity maturity, and strengthen student data privacy practices.

The strategy connects:

  • South Carolina’s SC SAFE K-12 Cybersecurity Initiative: Establishing foundational cybersecurity protections.
  • CoSN’s Cybersecurity Readiness for Education (CCRE) Cybersecurity Rubric: Assessing organizational cybersecurity maturity and guiding continuous improvement.
  • CoSN’s Trusted Learning Environment (TLE): Strengthening student data privacy, responsible data practices, and community trust.

Each framework serves a distinct purpose. Together, they offer school systems a more comprehensive approach to cybersecurity readiness and student data privacy.

Three Frameworks, Three Important Questions

South Carolina’s strategy begins with recognizing that cybersecurity protections, organizational readiness, and student data privacy are interconnected, but they are not interchangeable.

1. SC SAFE K-12: Are the essential cybersecurity protections in place?

SC SAFE K-12 establishes foundational cybersecurity expectations for South Carolina school districts.

Grounded in the Center for Internet Security (CIS) Critical Security Controls v8, Implementation Group 1, the framework emphasizes essential protections, including asset inventory, access control, vulnerability management, incident response, and recovery.

These safeguards help districts address fundamental cybersecurity risks and establish a baseline for protecting school systems and operations.

But implementing cybersecurity controls is only part of the challenge.

Having protections in place does not necessarily mean an organization has developed the leadership, processes, and capacity to sustain and improve them over time.

That’s where the second framework becomes particularly valuable.

2. CoSN’s CCRE Cybersecurity Rubric: How mature and sustainable are our cybersecurity practices?

CoSN’s Cybersecurity Readiness for Education (CCRE) Cybersecurity Rubric helps school systems move beyond implementing individual cybersecurity controls to understanding their overall organizational cybersecurity maturity.

Aligned with the NIST Cybersecurity Framework 2.0, the rubric evaluates cybersecurity readiness across six functions:

alignment

The rubric provides a structured way to assess how cybersecurity practices are established, implemented, managed, measured, and continuously improved across an organization.

Rather than asking only whether a particular security control exists, the rubric encourages districts to consider deeper questions:

  • Are cybersecurity responsibilities clearly defined and supported by leadership?
  • Are security practices consistent across the organization?
  • Do we have the processes and resources needed to sustain our protections?
  • Can we measure our progress and demonstrate improvement?
  • What should we prioritize next?

This distinction is important.

A district might have backup systems in place, for example. But does it have documented recovery procedures? Are responsibilities assigned? Are recovery processes tested? Does leadership understand the district’s ability to restore critical services following an incident?

The CCRE Cybersecurity Rubric helps districts evaluate these organizational dimensions of readiness.

The value of an assessment isn’t simply the score it produces. It’s the organizational improvement it inspires and the results it achieves.

For South Carolina, this creates an opportunity to build on the foundational protections established through SC SAFE K-12, helping districts understand where they are, identify gaps, establish priorities, and measure their progress toward stronger cybersecurity readiness.

3. CoSN Trusted Learning Environment (TLE): Are we protecting student data responsibly and building trust?

Cybersecurity readiness is essential to protecting student information, but student data privacy requires additional considerations.

CoSN’s Trusted Learning Environment (TLE) Seal Program provides a framework for evaluating and strengthening student data privacy practices across five domains:

tlealign

These domains address important organizational responsibilities, including privacy governance, vendor management, data protection, staff training, and the responsible use of student information in instructional environments.

Through South Carolina’s statewide TLE subscription, districts have access to a structured framework for strengthening student data privacy practices.

The TLE framework complements SC SAFE K-12 and the CCRE Cybersecurity Rubric by emphasizing how student data is collected, managed, shared, protected, and used responsibly.

Together, the three frameworks help districts consider not only whether their systems are secure, but whether their organizational practices support the responsible use and protection of student information.

The Power Is in the Alignment

The real opportunity in South Carolina’s approach is not simply adopting three frameworks. It’s understanding where they intersect and using that alignment to create a more coordinated, strategic approach to cybersecurity readiness and continuous improvement.

SC SAFE K-12 identifies foundational controls needed to manage access to systems and information.

The CCRE Cybersecurity Rubric takes the district a step further. It helps leaders assess their current level of organizational cybersecurity maturity, establish a shared vision of where they want to be, and develop a strategic plan for getting there. Through its Govern function, the rubric emphasizes leadership engagement, policies, accountability, and risk-informed decision-making. It helps districts move beyond implementing individual controls toward building sustainable cybersecurity practices that can be measured and continuously improved.

The TLE framework adds important considerations about access to student information, vendor responsibilities, and privacy practices.

Together, these frameworks help districts move from implementing foundational protections to building an organization-wide strategy that aligns cybersecurity readiness, student data privacy, and continuous improvement.

This alignment creates several practical benefits for districts.

Less duplication. Documentation, policies, and other evidence developed for one framework may support requirements or expectations in another.

Better prioritization. Districts can identify improvements that strengthen cybersecurity readiness and student data privacy at the same time.

Stronger leadership engagement. The frameworks provide a common language for discussing cybersecurity risks, organizational maturity, and responsible data practices.

More meaningful progress. Rather than treating cybersecurity and privacy as separate compliance activities, districts can establish coordinated improvement priorities and measure their progress over time.

Most importantly, the approach encourages school systems to think beyond individual tools, controls, or compliance requirements and focus on the overall readiness of the organization.

Building Capacity Through South Carolina’s CCRE Masterclass

Framework alignment becomes even more valuable when school district leaders and practitioners understand how to put it into practice.

In 2026, South Carolina supported a statewide pilot CCRE Masterclass initiative, providing an opportunity for district participants to deepen their understanding of the Cybersecurity Rubric and its alignment with other statewide initiatives.

“South Carolina’s CCRE Masterclass experience has helped school districts develop a better understanding of CoSN’s Cybersecurity Readiness for Education (CCRE) Framework and Rubric and how it complements SC SAFE K-12 and CoSN’s Trusted Learning Environment (TLE), bringing greater alignment to our statewide cybersecurity readiness and student data privacy efforts.” Valarie Byrd

This is an important part of South Carolina’s strategy.

A framework provides structure, but people turn that structure into action.

Through facilitated learning, practical application, and collaboration, school district teams can develop a shared understanding of cybersecurity maturity and how to use assessment results to guide organizational improvement.

The opportunity extends beyond individual professional development. As more district leaders and practitioners become familiar with the rubric, South Carolina can strengthen its collective capacity to assess readiness, share effective practices, and support continuous improvement across school systems.

On March 24, 2026, Greenville County Schools hosted a CCRE Masterclass in Greenville, South Carolina, bringing together school and district leaders for hands-on cybersecurity readiness training. The session provided participants with practical knowledge, experience, and confidence to strengthen cybersecurity practices, build organizational resilience, and better protect the systems that support teaching and learning.

ccreclasssc

From the Masterclass to the School District: Turning Learning into Action

South Carolina’s CCRE Masterclass experience offers an example of what happens when framework alignment moves from theory into practice.

Participants with varying levels of cybersecurity and student data privacy expertise worked together to complete the CCRE Cybersecurity Rubric, gaining confidence in conducting organizational self-assessments and identifying opportunities for improvement.

But the learning didn’t stop when the Masterclass ended.

Cross-functional teams from Richland School District One and Charleston County School District used a train-the-trainer approach to share their learning with colleagues who had not attended. This helped extend the experience beyond the original participants and build internal capacity within their districts.

Perhaps one of the most revealing takeaways was what participants wished they had done differently. Many recognized the value of including HR staff, principals, superintendents, and other district leaders in the experience.

Their realization reinforces an important principle: cybersecurity readiness isn’t simply the responsibility of the technology department. It requires shared understanding, leadership engagement, accountability, and commitment across the entire organization.

Another important discovery was the value of viewing the three frameworks through a common alignment crosswalk. Participants could more easily see how SC SAFE K-12, the CCRE Framework and Rubric, and CoSN’s Trusted Learning Environment complement one another. Rather than approaching each framework as a separate initiative, they began to recognize how a common foundation could support multiple cybersecurity and student data privacy objectives.

The experience also reinforced that meaningful cybersecurity improvement doesn’t always begin with purchasing new technology. Sometimes it begins with consistent, intentional changes in everyday practices, including how information is managed, how people communicate digitally, and how responsibilities are shared across the school community.

These lessons illustrate the broader value of South Carolina’s statewide strategy. By connecting frameworks, building local expertise, and engaging leaders across school systems, the state is helping districts move beyond individual cybersecurity activities toward a more coordinated, sustainable approach to organizational readiness.

And that may be one of the most valuable outcomes of all: helping districts understand where they are today, determine where they want to be, and build the organizational capacity to make measurable progress over time.

Beyond the Masterclass: Examples of Organizational Readiness in Action 

scmasterclass

Building Confidence and Expanding Organizational Capacity

Participants with varying levels of cybersecurity and student data privacy expertise collaborated to complete the CCRE Rubric, gaining confidence in conducting organizational self-assessments. Cross-functional teams from districts such as Richland School District One and Charleston County School District later used a train-the-trainer approach to share what they learned with colleagues who had not attended.

Participants described the experience as eye-opening, recognizing the value of including HR staff, principals, superintendents, and other district leaders in cybersecurity readiness discussions. In fact, following the training, participants requested future Masterclass sessions designed specifically for school and district teams.

Understanding How the Three Frameworks Work Together

One of the most important lessons participants learned was that no single framework can address every cybersecurity and student data privacy need. By strategically aligning existing state and national frameworks and resources, South Carolina is helping districts protect systems and student information, strengthen organizational resilience, and achieve better outcomes for students, educators, and communities.

Participants also found that using an alignment crosswalk made it easier to understand how the three frameworks complement one another. The crosswalk demonstrated how a common foundation of cybersecurity protections can support multiple objectives, reducing duplication while strengthening organizational readiness and student data privacy.

Recognizing Cybersecurity as a Shared Responsibility

The Masterclass also broadened participants’ understanding of cybersecurity roles and responsibilities. They recognized that consistent, intentional improvements in everyday practices, particularly in data management and digital communications, can significantly reduce organizational risk.

The experience deepened their understanding of cybersecurity and student data privacy best practices while reinforcing an important lesson: cybersecurity readiness is not solely the responsibility of technology teams. It requires shared accountability and commitment across the entire school community.

This collective responsibility is especially important in K-12 education, where secure learning environments support instructional innovation and help prepare students for college, careers, and military service.

From Statewide Strategy to District-Level Action

One of the most promising aspects of South Carolina’s approach is the connection between statewide guidance and district-level implementation.

School districts vary considerably in size, staffing, technical resources, and cybersecurity capacity. Yet every district is responsible for protecting its systems, maintaining essential operations, and safeguarding student information.

A coordinated framework strategy provides a common foundation while allowing districts to identify priorities based on their own circumstances and maturity.

For district leaders, this means beginning with an understanding of current practices, identifying opportunities for improvement, and developing a plan that addresses both immediate risks and longer-term organizational readiness.

For state leaders, it creates opportunities to provide more coordinated guidance, professional development, and support.

And for the broader education community, it offers an example of how cybersecurity and student data privacy initiatives can reinforce one another rather than compete for limited time and resources.

Spencer Benham, Information Security Officer at Greenville County Schools,  describes the three frameworks as pieces of a cybersecurity and privacy Rosetta Stone.

“Each framework provides a different lens on risk, governance, security, and trust. Together, they create a common language that helps us prioritize work, communicate with leadership, and make the most of limited resources. Progress in one framework often supports progress in others, allowing districts to build on a strong foundation rather than treating each framework as a separate initiative.” Valarie Byrd

One Strategy, Continuous Improvement

South Carolina’s approach offers an important lesson for K-12 education: cybersecurity readiness and student data privacy are not destinations reached by implementing a checklist of controls or completing a single assessment.

They require ongoing leadership, organizational commitment, and continuous improvement.

  • SC SAFE K-12 helps districts establish essential cybersecurity protections.
  • The CCRE Cybersecurity Rubric helps districts assess organizational maturity, prioritize improvements, and measure progress over time.
  • CoSN’s Trusted Learning Environment helps ensure student data privacy and responsible data practices remain central to that work.

Together, these frameworks support a more coordinated approach to protecting school systems, strengthening organizational resilience, and building community trust.

Three frameworks. One strategy. A shared commitment to continuous improvement.

And perhaps the most important takeaway from South Carolina’s work is this:

The goal isn’t to rely on a single framework or introduce yet another initiative. It’s to strategically align existing, cost-effective national and state-level K-12 frameworks so they work better together, strengthen cybersecurity readiness and student data privacy, and ultimately achieve better outcomes for the students, educators, and communities we serve.

Learn More

Author: Valerie Byrd & Spencer Benahm

Published on: October 26, 2026

CoSN is vendor neutral and does not endorse products or services. Any mention of a specific solution is for contextual purposes.