Get Full Government Meeting Transcripts, Videos, & Alerts Forever!
Get email alerts on the Cybersecurity topic
No spam. Unsubscribe anytime.
District implements cyber controls after insurer PACE flags vulnerabilities; grant covers initial MFA costs
Summary
Operations staff told the board insurer PACE has required security measures after a wave of K–12 cyberattacks; the district is implementing password policies, backups, MFA and endpoint protection and secured a grant to fund multifactor authentication for the first two years.
The district’s operations director briefed the board on mandated cybersecurity steps requested by the insurance provider PACE following a spate of cyberattacks in Oregon school districts.
He described insurer-driven expectations the district must meet — password expiration, restricted administrative rights, daily backups, multifactor authentication, endpoint protection and a cyber incident response plan — and characterized the list as an unfunded mandate from the insurer.
"They're forcing you to do unfunded manage," he said, noting the district intends to comply but that costs must come from somewhere. He said staff member Peter Klingler secured a grant that paid for key fobs and multifactor authentication for the first two years, a creative approach to cover implementation costs.
The director described existing and in-progress work: daily server backups, a backup server hosted at Pioneer Elementary School, rolling staff trainings on phishing and suspicious emails, endpoint monitoring software (identified by brand in the presentation) and an incident response plan that remains about halfway completed.
Board members asked whether PACE provided funding or a resource list; the director said PACE did not supply a friendly vendor list and the district found some grant funding internally.
The district will continue phased implementation, report on grant-funded costs, and finish its incident response plan.
