What does meaningful cybersecurity progress actually look like?
At El Paso Independent School District, there is now a measurable answer.
The district advanced an entire organizational maturity level in cybersecurity readiness.
That kind of movement does not happen because of one new product, one policy, or one project. It happens when an organization becomes intentional about improving cybersecurity readiness and then commits to doing the work.
Earlier this year, El Paso ISD participated in a comprehensive technology review that included a third-party evaluation led by consultants from the Texas Association for School Business Officials (TASBO), using CoSN’s Cybersecurity Readiness for Education (CCRE) Framework and Rubric.
The purpose was not simply to produce another cybersecurity score or check the status of yes or no cybersecurity objectives..
It was to answer a much more important question:
What do we need to do next to become more mature in our cybersecurity readiness as a school district?
The CCRE gave district leadership and the cybersecurity team a structured way to examine cybersecurity readiness across the six NIST Cybersecurity Framework functions: Govern, Identify, Protect, Detect, Respond, and Recover. Rather than looking at cybersecurity as a collection of individual technologies or projects, the district could see it as an interconnected organizational capability.
And from that work came something especially valuable:
A clear picture of their current state. Gaps translated into Opportunities for Improvement. A roadmap.
Instead of treating the evaluation as the end of the process, El Paso ISD used it to identify priorities and translate them into an actionable improvement plan
Then came the part no framework, rubric, or assessment can do for an organization.
The team did the work.
District leadership supported the effort. Assistant Superintendent Haydee Peña established the vision and momentum, while cybersecurity leadership, Juan Moreno, and the team moved the plan forward. Priorities became actions. Actions became improvements. And those improvements began building on one another.
Within less than six months, the results demonstrated just how much progress had been made:
El Paso ISD had advanced an entire organizational maturity level.
Think about what that represents.
Moving an entire school district, not simply one system, technology, or individual cybersecurity practice, requires sustained improvement across multiple dimensions of cybersecurity readiness.
That is why this story is not really about a score.
It is about organizational movement and momentum.
The CCRE helped El Paso ISD establish a baseline, create a common language around cybersecurity maturity, identify priorities, and measure progress. The district then turned that information into action.
There is an important distinction.
A rubric cannot improve cybersecurity. People do.
A framework can show where an organization is today. An evaluation can reveal where attention is needed. A roadmap can establish a path forward.
But leadership, commitment, discipline, teamwork, and follow-through are what create results.
That credit belongs to the El Paso ISD team.
Their experience demonstrates something important about cybersecurity maturity:
Progress can be measured.
And that lesson extends well beyond El Paso ISD.
Every school system is somewhere on its cybersecurity readiness journey. The first step is understanding where you are. The next is deciding where improvement matters most and turning those priorities into action.
That is where the CCRE can help. Use the Rubric to establish a baseline. Identify the gaps that matter most to your organization. Build a roadmap around those priorities. Then return to the Rubric over time to measure whether the work is actually moving your organization forward.
Assess. Prioritize. Act. Measure. Improve.
Because sometimes the clearest evidence of a stronger cybersecurity program is not another technology product.
It is being able to look back at where your organization started, measure where you are today, and see just how far your people have moved it forward.
Author: Haydee Pena
CoSN Cybersecurity Readiness Committee
Assistant Superintendent of Technology Operations Systems, El Paso ISD (TX)
Bio: Haydee Peña serves as Assistant Superintendent of Technology Operations Support Systems for El Paso Independent School District, where she provides leadership for the district’s technology operations and support systems. Her work includes advancing the systems, services, and organizational practices that support El Paso ISD’s schools and departments. She is committed to strengthening cybersecurity readiness through strategic planning, collaboration, and continuous improvement.
Published on: October 19, 2026
CoSN is vendor neutral and does not endorse products or services. Any mention of a specific solution is for contextual purposes.
