How South Carolina is bringing together foundational cybersecurity protections, organizational maturity, and student data privacy through a coordinated statewide strategy.

Cybersecurity readiness and student data privacy are often approached as separate initiatives in K-12 education. Districts are asked to implement security controls, assess cybersecurity risks, demonstrate compliance, protect student information, and build trust with their communities.

Each responsibility is important. But when these efforts are managed independently, school systems can find themselves navigating multiple frameworks, collecting similar evidence, and working toward goals that are more closely connected than they might realize.

What if these efforts were not separate initiatives, but part of one coordinated statewide strategy?

That’s exactly what South Carolina is working to accomplish, bringing three complementary frameworks together to help school districts strengthen cybersecurity readiness, protect student data, and make meaningful progress toward shared goals.

threeframeworks

Through the South Carolina Department of Education, the state is bringing together three complementary frameworks to help school districts establish essential cybersecurity protections, evaluate and improve organizational cybersecurity maturity, and strengthen student data privacy practices.

The strategy connects:

  • South Carolina’s SC SAFE K-12 Cybersecurity Initiative: Establishing foundational cybersecurity protections.
  • CoSN’s Cybersecurity Readiness for Education (CCRE) Cybersecurity Rubric: Assessing organizational cybersecurity maturity and guiding continuous improvement.
  • CoSN’s Trusted Learning Environment (TLE): Strengthening student data privacy, responsible data practices, and community trust.

Each framework serves a distinct purpose. Together, they offer school systems a more comprehensive approach to cybersecurity readiness and student data privacy.

Three Frameworks, Three Important Questions

South Carolina’s strategy begins with recognizing that cybersecurity protections, organizational readiness, and student data privacy are interconnected, but they are not interchangeable.

1. SC SAFE K-12: Are the essential cybersecurity protections in place?

SC SAFE K-12 establishes foundational cybersecurity expectations for South Carolina school districts.

Grounded in the Center for Internet Security (CIS) Critical Security Controls v8, Implementation Group 1, the framework emphasizes essential protections, including asset inventory, access control, vulnerability management, incident response, and recovery.

These safeguards help districts address fundamental cybersecurity risks and establish a baseline for protecting school systems and operations.

But implementing cybersecurity controls is only part of the challenge.

Having protections in place does not necessarily mean an organization has developed the leadership, processes, and capacity to sustain and improve them over time.

That’s where the second framework becomes particularly valuable.

2. CoSN’s CCRE Cybersecurity Rubric: How mature and sustainable are our cybersecurity practices?

CoSN’s Cybersecurity Readiness for Education (CCRE) Cybersecurity Rubric helps school systems move beyond implementing individual cybersecurity controls to understanding their overall organizational cybersecurity maturity.

Aligned with the NIST Cybersecurity Framework 2.0, the rubric evaluates cybersecurity readiness across six functions:

Govern | Identify | Protect | Detect | Respond | Recover

The rubric provides a structured way to assess how cybersecurity practices are established, implemented, managed, measured, and continuously improved across an organization.

Rather than asking only whether a particular security control exists, the rubric encourages districts to consider deeper questions:

  • Are cybersecurity responsibilities clearly defined and supported by leadership?
  • Are security practices consistent across the organization?
  • Do we have the processes and resources needed to sustain our protections?
  • Can we measure our progress and demonstrate improvement?
  • What should we prioritize next?

This distinction is important.

A district might have backup systems in place, for example. But does it have documented recovery procedures? Are responsibilities assigned? Are recovery processes tested? Does leadership understand the district’s ability to restore critical services following an incident?

The CCRE Cybersecurity Rubric helps districts evaluate these organizational dimensions of readiness.

The value of an assessment isn’t simply the score it produces. It’s the organizational improvement it inspires and the results it achieves.

For South Carolina, this creates an opportunity to build on the foundational protections established through SC SAFE K-12, helping districts understand where they are, identify gaps, establish priorities, and measure their progress toward stronger cybersecurity readiness.

3. CoSN Trusted Learning Environment (TLE): Are we protecting student data responsibly and building trust?

Cybersecurity readiness is essential to protecting student information, but student data privacy requires additional considerations.

CoSN’s Trusted Learning Environment (TLE) Seal Program provides a framework for evaluating and strengthening student data privacy practices across five domains:

Leadership | Business | Data Security | Professional Development | Classroom

These domains address important organizational responsibilities, including privacy governance, vendor management, data protection, staff training, and the responsible use of student information in instructional environments.

Through South Carolina’s statewide TLE subscription, districts have access to a structured framework for strengthening student data privacy practices.

The TLE framework complements SC SAFE K-12 and the CCRE Cybersecurity Rubric by emphasizing how student data is collected, managed, shared, protected, and used responsibly.

Together, the three frameworks help districts consider not only whether their systems are secure, but whether their organizational practices support the responsible use and protection of student information.

The Power Is in the Alignment

The real opportunity in South Carolina’s approach is not simply adopting three frameworks. It’s understanding where they intersect and using that alignment to create a more coordinated, strategic approach to cybersecurity readiness and continuous improvement.

SC SAFE K-12 identifies foundational controls needed to manage access to systems and information.

The CCRE Cybersecurity Rubric takes the district a step further. It helps leaders assess their current level of organizational cybersecurity maturity, establish a shared vision of where they want to be, and develop a strategic plan for getting there. Through its Govern function, the rubric emphasizes leadership engagement, policies, accountability, and risk-informed decision-making. It helps districts move beyond implementing individual controls toward building sustainable cybersecurity practices that can be measured and continuously improved.

The TLE framework adds important considerations about access to student information, vendor responsibilities, and privacy practices.

Together, these frameworks help districts move from implementing foundational protections to building an organization-wide strategy that aligns cybersecurity readiness, student data privacy, and continuous improvement.

This alignment creates several practical benefits for districts.

Less duplication. Documentation, policies, and other evidence developed for one framework may support requirements or expectations in another.

Better prioritization. Districts can identify improvements that strengthen cybersecurity readiness and student data privacy at the same time.

Stronger leadership engagement. The frameworks provide a common language for discussing cybersecurity risks, organizational maturity, and responsible data practices.

More meaningful progress. Rather than treating cybersecurity and privacy as separate compliance activities, districts can establish coordinated improvement priorities and measure their progress over time.

Most importantly, the approach encourages school systems to think beyond individual tools, controls, or compliance requirements and focus on the overall readiness of the organization.

Building Capacity Through South Carolina’s CCRE Masterclass

Framework alignment becomes even more valuable when school district leaders and practitioners understand how to put it into practice.

In 2026, South Carolina supported a statewide pilot CCRE Masterclass initiative, providing an opportunity for district participants to deepen their understanding of the Cybersecurity Rubric and its alignment with other statewide initiatives.

According to Valarie Byrd, District Technical Services Consultant with the South Carolina Department of Education, the Masterclass experience has helped districts develop a better understanding of the NIST Cybersecurity Framework 2.0-aligned rubric and its relationship to SC SAFE K-12 and CoSN’s TLE framework.

This is an important part of South Carolina’s strategy.

A framework provides structure, but people turn that structure into action.

Through facilitated learning, practical application, and collaboration, school district teams can develop a shared understanding of cybersecurity maturity and how to use assessment results to guide organizational improvement.

The opportunity extends beyond individual professional development. As more district leaders and practitioners become familiar with the rubric, South Carolina can strengthen its collective capacity to assess readiness, share effective practices, and support continuous improvement across school systems.

[Valarie and Spencer: This would be an excellent place to add a specific example or observation from the statewide Masterclass pilot. What did participants learn about the relationship among the three frameworks? How did the experience change their understanding of cybersecurity readiness?]

From Statewide Strategy to District-Level Action

One of the most promising aspects of South Carolina’s approach is the connection between statewide guidance and district-level implementation.

School districts vary considerably in size, staffing, technical resources, and cybersecurity capacity. Yet every district is responsible for protecting its systems, maintaining essential operations, and safeguarding student information.

A coordinated framework strategy provides a common foundation while allowing districts to identify priorities based on their own circumstances and maturity.

For district leaders, this means beginning with an understanding of current practices, identifying opportunities for improvement, and developing a plan that addresses both immediate risks and longer-term organizational readiness.

For state leaders, it creates opportunities to provide more coordinated guidance, professional development, and support.

And for the broader education community, it offers an example of how cybersecurity and student data privacy initiatives can reinforce one another rather than compete for limited time and resources.

[Spencer: This would be a valuable place to share Greenville County Schools’ district perspective. How does aligning these frameworks help your team prioritize work, communicate with leadership, or coordinate cybersecurity and privacy efforts?]

One Strategy, Continuous Improvement

South Carolina’s approach offers an important lesson for K-12 education: cybersecurity readiness and student data privacy are not destinations reached by implementing a checklist of controls or completing a single assessment.

They require ongoing leadership, organizational commitment, and continuous improvement.

SC SAFE K-12 helps districts establish essential cybersecurity protections.

The CCRE Cybersecurity Rubric helps districts assess organizational maturity, prioritize improvements, and measure progress over time.

CoSN’s Trusted Learning Environment helps ensure student data privacy and responsible data practices remain central to that work.

Together, these frameworks support a more coordinated approach to protecting school systems, strengthening organizational resilience, and building community trust.

Three frameworks. One strategy. A shared commitment to continuous improvement.

And perhaps the most important takeaway from South Carolina’s work is this:

The goal isn’t to rely on a single framework or introduce yet another initiative. It’s to strategically align existing, cost-effective national and state-level K-12 frameworks so they work better together, strengthen cybersecurity readiness and student data privacy, and ultimately achieve better outcomes for the students, educators, and communities we serve.

Learn More

Author: Valerie Byrd & Spencer Benahm

Published on: October 26, 2026

CoSN is vendor neutral and does not endorse products or services. Any mention of a specific solution is for contextual purposes.