# Email security for K-12 schools: the threats and a practical checklist

URL: https://iblockspam.com/blog/email-security-for-k12-schools
Last updated: 2026-10-10
Published: 2026-10-10
Topic: Choosing a filter
Author: iBlockSpam Team

> Email security for K-12 schools and districts: ransomware, payroll and vendor fraud, student data and FERPA, CISA advice, free resources and a checklist.

## Short answer

K-12 schools face phishing that leads to ransomware, fake payroll and vendor payment requests, and stolen accounts that expose student records. CISA's K-12 report puts multifactor authentication first. Add DMARC on your domain, verified payment changes, filtering in front of staff and student mailboxes, tested backups and a practiced incident plan, using free government resources where you can.

Schools and districts hold a lot of what attackers want: payroll for hundreds of staff, payments to vendors, and records about children. They also tend to have small IT teams and tight budgets. Email is where many attacks start. This guide covers the email threats K-12 organizations face, what CISA and the Department of Education say, which free resources still exist after the 2025 funding changes, and a checklist you can work through.

## What email threats do K-12 schools face?

The threats aren't unique to schools, but how schools work makes some of them more likely.

| Threat | How it usually starts | What's at risk |
| --- | --- | --- |
| Ransomware | A phishing link, a malicious attachment or a stolen password | Classes, systems and student data |
| Payroll diversion | A fake email from a staff member asking HR to change bank details | A paycheck |
| Vendor invoice fraud | A fake or hijacked supplier email with "new" bank details | Large vendor payments |
| Account takeover | A fake sign-in page for Microsoft 365 or Google Workspace | Student records, staff mailboxes, further phishing |
| Tax form phishing | A request "from the superintendent" for staff W-2s | Staff identities |
| Student-facing phishing | Fake scholarship, gift card or game offers to student accounts | Student accounts and devices |

### Ransomware

Ransomware is usually the end of an attack that started weeks earlier. Phishing delivers a malware loader or captures a password, and attackers use that access to spread. Our [ransomware delivery guide](https://iblockspam.com/blog/ransomware-email-delivery-prevention) walks through how email leads there and what CISA's #StopRansomware Guide advises.

### Payroll and vendor fraud

School districts publish staff directories and approve payments on a predictable schedule. That makes it easy to impersonate a teacher asking HR to change their direct deposit, or a bus company, food supplier or construction contractor sending "updated" bank details. See [payroll diversion scams](https://iblockspam.com/blog/payroll-diversion-scam-emails) and [vendor invoice fraud](https://iblockspam.com/blog/vendor-invoice-fraud-payment-redirection) for the patterns and the verification steps that stop them.

### Stolen accounts and student data

A teacher's or administrator's mailbox often contains grades, attendance, special education notes and messages with parents. An attacker with that password can read it all and send convincing phishing to colleagues and families from a trusted address. Watch for the [signs of a compromised account](https://iblockspam.com/blog/signs-email-account-compromised).

## What does CISA's K-12 report recommend?

CISA published [Protecting Our Future: Partnering to Safeguard K-12 Organizations from Cybersecurity Threats](https://www.cisa.gov/protecting-our-future-partnering-safeguard-k-12-organizations-cybersecurity-threats) in January 2023. It makes three recommendations:

1. "Invest in the most impactful security measures and build toward a mature cybersecurity plan."
2. "Recognize and actively address resource constraints."
3. "Focus on collaboration and information sharing."

For the first, CISA tells leaders to "Begin with a small number of prioritized investments":

- "Deploy multifactor authentication"
- "Mitigate known exploited vulnerabilities"
- "Implement and test backups"
- "Regularly exercise an incident response plan"
- "Implement a strong cybersecurity training program"

For email, MFA comes first. A phished password is far less useful to an attacker when a second factor is required. Start with administrators, finance, HR and payroll staff, and anyone who can see student records, then roll out to everyone. CISA also recommends that K-12 entities "Utilize no- or low-cost services" and "Join relevant collaboration groups, such as MS-ISAC and K12 SIX."

CISA's joint phishing guidance with the NSA, FBI and MS-ISAC adds a domain-level step: "Ensure DMARC is set to 'reject' for sent emails", which "provides robust protection against other users receiving emails that impersonate a domain" ([CISA and partners](https://www.cisa.gov/sites/default/files/2023-10/Phishing%20Guidance%20-%20Stopping%20the%20Attack%20Cycle%20at%20Phase%20One_508c.pdf)). For a school, that means fewer fake emails reaching parents that look like they came from your district.

## Where does FERPA fit in?

FERPA is "a federal law that affords parents the right to have access to their children's education records," with rights moving to the student at 18 or on entering postsecondary education ([US Department of Education](https://studentprivacy.ed.gov/faq/what-ferpa)). It applies to schools that receive funds under programs administered by the Department of Education.

On security, the Department's student privacy site is clear that FERPA "does not require educational institutions to adopt specific security controls". It also warns that "Breaches of educational data are common and can lead to a violation of FERPA" ([US Department of Education](https://studentprivacy.ed.gov/data-security-k-12-and-higher-education)).

In practice, that means:

- Email security isn't a FERPA compliance checkbox, and no email product makes you "FERPA compliant".
- A mailbox full of student records is a privacy risk if it's compromised, so protect it like one.
- Plan your response before you need it. The Department's [Data Breach Response Checklist](https://studentprivacy.ed.gov/resources/data-breach-response-checklist) lists the components of a breach response plan. State laws may add notification duties; ask your district counsel.

This guide is general information, not legal advice.

## How should schools handle student email accounts?

Many districts give students accounts for Google Classroom, Microsoft Teams or other tools. Student accounts behave differently from staff accounts: they're numerous, passwords are often simple, and students are targeted with different lures.

- **Separate students from staff.** Put student accounts in their own organizational unit or group, with their own policies.
- **Limit who students can email.** Google Workspace's **Restrict delivery** setting, under **Apps** > **Google Workspace** > **Gmail** > **Compliance**, lets you restrict "the addresses or domains your users can exchange messages with". Google's own example is that "a school might want to allow students to exchange messages with faculty, staff, and other students" ([Google Workspace Admin Help](https://knowledge.workspace.google.com/admin/gmail/advanced/restrict-email-messages-to-authorized-addresses-or-domains-only)). Google warns that letting people post to Groups may bypass the restriction, so check Groups settings too. In Microsoft 365, you can build similar limits with [mail flow rules](https://iblockspam.com/blog/microsoft-365-mail-flow-rules-for-security).
- **Protect staff-wide lists.** A compromised student account shouldn't be able to email all staff. See [restricting who can email distribution lists](https://iblockspam.com/blog/restrict-who-can-email-distribution-lists).
- **Remove accounts when students leave**, on a schedule that matches your enrollment cycle.

## What free resources are available to schools?

Funding for some free services changed in 2025, so check current terms before you plan around them.

- **CISA Cyber Hygiene services.** Vulnerability scanning of internet-facing systems and web application scanning. CISA says the services "are available at no cost" to federal, state, local, tribal and territorial governments and to public and private critical infrastructure organizations. To enroll, email vulnerability@cisa.dhs.gov with the subject "Requesting Cyber Hygiene Services" ([CISA](https://www.cisa.gov/cyber-hygiene-services)). Confirm eligibility for your district when you apply.
- **MS-ISAC.** CIS says "Federal support for MS-ISAC ended on September 30, 2025," and that MS-ISAC "transitioned to a fee-based membership model with no federal funding." CIS now runs it as a paid membership, a change it calls "a direct response to federal funding cuts", with tiers scaled to budget. Eligibility includes "public education institutions". Some CIS resources, such as the CIS Benchmarks and CIS Controls Navigator, remain available at no cost ([CIS](https://www.cisecurity.org/ms-isac/ms-isac-membership-faq)). At the time of writing (October 2026), check the membership FAQ for current tiers and which services each includes.
- **K12 SIX.** CISA's report names it alongside MS-ISAC as a collaboration group for K-12. Check its current membership terms directly.
- **Your platform's built-in tools.** Microsoft 365 and Google Workspace for Education both include MFA and built-in spam and phishing filtering. Turn on and review what you already have before buying more.

## A practical email security checklist for schools

Work through this in order. The first five cost little beyond staff time.

1. **Turn on MFA** for every staff account, starting with admins, finance, HR and payroll. Use phishing-resistant methods for admins where possible.
2. **Publish SPF, DKIM and DMARC** for your district domain and move DMARC toward `p=reject`. Check your current setup with the [DMARC Checker](https://iblockspam.com/tools/dmarc-checker) and follow [DMARC from none to reject](https://iblockspam.com/blog/dmarc-none-to-reject-small-business).
3. **Write payment verification rules.** Any change to staff bank details or vendor payment details is confirmed by phone or in person, using contact details already on file. Never use details from the email.
4. **Lock down tax season.** Agree that W-2s and staff personal data are never sent by email in response to a request. See [W-2 tax season phishing](https://iblockspam.com/blog/w2-tax-season-phishing).
5. **Separate and restrict student accounts** as described above.
6. **Filter inbound mail** for spam, malware, phishing and risky attachments, with quarantine that staff can review. Built-in filtering is a baseline; read [how spam filters work](https://iblockspam.com/blog/how-spam-filters-work) to understand the layers.
7. **Test backups and practice your [incident plan](https://iblockspam.com/blog/email-security-incident-response-plan)**, including who calls whom when a mailbox is compromised or ransomware is found.
8. **Train staff each year**, with short refreshers before tax season and the start of the school year. Make reporting suspicious mail easy and welcome.
9. **Enroll in CISA Cyber Hygiene** and review what MS-ISAC membership would cost and include for your district.
10. **Review accounts each term.** Disable departed staff and students, and check for forwarding rules to outside addresses.

Our [small business email security checklist](https://iblockspam.com/blog/email-security-checklist-small-business) goes deeper on several of these steps, and most of it applies directly to schools.

## Next steps

1. Run the free [Email Health Check](https://iblockspam.com/tools/email-health-check) on your district domain to see SPF, DKIM and DMARC at a glance.
2. Confirm MFA is enforced for finance, HR and payroll staff this month.
3. Email vulnerability@cisa.dhs.gov to request Cyber Hygiene scanning.
4. If you're evaluating a filtering layer, our [buying checklist](https://iblockspam.com/blog/how-to-choose-a-spam-filter-small-business) is vendor-neutral. iBlockSpam is priced [per domain](https://iblockspam.com/pricing) with unlimited mailboxes (the mailbox count, not message volume: 100,000 inbound messages per domain per month are included), which can suit schools with many staff and student accounts. It filters inbound mail and doesn't replace MFA, backups or training.

More buying guides are in our [buying topic](https://iblockspam.com/blog/topic/buying).

## Frequently asked questions

### What does CISA recommend K-12 schools do first?

CISA's 2023 K-12 report tells leaders to begin with a small number of prioritized investments: deploy multifactor authentication, mitigate known exploited vulnerabilities, implement and test backups, regularly exercise an incident response plan, and run a strong cybersecurity training program. MFA does the most for email, because stolen passwords are the main way into a school mailbox.

### Does FERPA require specific email security controls?

No. The Department of Education's student privacy site says FERPA does not require schools to adopt specific security controls. It also says breaches of education data are common and can lead to a FERPA violation. So email security isn't a FERPA checklist item, but a compromised mailbox holding student records can still create a FERPA problem.

### Is MS-ISAC still free for school districts?

Not as a general rule. CIS says federal support for MS-ISAC ended on September 30, 2025, and MS-ISAC moved to a fee-based membership with pricing tiers scaled to budget. Eligibility includes public education institutions. Some CIS resources remain free, so check the current membership FAQ for your district.

### Should students have email accounts on the school domain?

Many schools give students accounts for classroom tools. If you do, put students in their own group with stricter rules. Google Workspace's Restrict delivery setting, for example, can limit students to exchanging mail with faculty, staff and other students. Keep student and staff accounts separate so a compromised student account can't reach staff-only lists.

### Why do schools get so many payroll diversion emails?

School staff directories are often public, payroll is regular and predictable, and many staff are paid through the same system. Attackers impersonate a teacher and ask HR to change direct deposit details. A rule that every change is confirmed by phone or in person, using contact details already on file, stops most of these.

## Sources

- [CISA: Protecting Our Future: Partnering to Safeguard K-12 Organizations from Cybersecurity Threats (January 2023)](https://www.cisa.gov/protecting-our-future-partnering-safeguard-k-12-organizations-cybersecurity-threats)
- [US Department of Education, Protecting Student Privacy: What is FERPA?](https://studentprivacy.ed.gov/faq/what-ferpa)
- [US Department of Education, Protecting Student Privacy: Data Security, K-12 and Higher Education](https://studentprivacy.ed.gov/data-security-k-12-and-higher-education)
- [US Department of Education, Protecting Student Privacy: Data Breach Response Checklist](https://studentprivacy.ed.gov/resources/data-breach-response-checklist)
- [CISA, NSA, FBI, MS-ISAC: Phishing Guidance: Stopping the Attack Cycle at Phase One (October 2023)](https://www.cisa.gov/sites/default/files/2023-10/Phishing%20Guidance%20-%20Stopping%20the%20Attack%20Cycle%20at%20Phase%20One_508c.pdf)
- [CISA: Cyber Hygiene Services](https://www.cisa.gov/cyber-hygiene-services)
- [Center for Internet Security: MS-ISAC Membership FAQ](https://www.cisecurity.org/ms-isac/ms-isac-membership-faq)
- [Google Workspace Admin Help: Restrict email messages to authorized addresses or domains only](https://knowledge.workspace.google.com/admin/gmail/advanced/restrict-email-messages-to-authorized-addresses-or-domains-only)

## Free tools for this guide

- [Email Health Check](https://iblockspam.com/tools/email-health-check): Grade your domain's MX, SPF, DKIM, DMARC and transport security in one scan.
- [DMARC Checker](https://iblockspam.com/tools/dmarc-checker): Check your policy, reporting and the safe path from p=none to reject.
- [SPF Checker](https://iblockspam.com/tools/spf-checker): Count real DNS lookups, find PermErrors, loops and risky "all" settings.
- [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer): Trace hops and authentication results — runs entirely in your browser.

---

Source: iBlockSpam, https://iblockspam.com/blog/email-security-for-k12-schools (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt