Cyber Insurance: What Schools Need to Know | Tech & Learning

Each week, more public education sites report phishing attacks, data hacks, and ransomware demands. In 2021, 62 school districts and 26 colleges or universities were hit. On January 4, 2022, 3,000 K-12 schools were caught in an international ransomware attack.

“It’s gotten to the point that it’s not ‘if’ we are attacked, but ‘when’ it will happen,” says Sandra Paul, director of information technology at Township of Union Public Schools in New Jersey. “There are at least four districts in our area that have been hacked in the last few years.” 

While everyone is trying to save money, they are also loading more items onto their data network such as security cameras, HVAC systems, and other Internet of Things devices, which create more potential openings for hackers, says Paul. Protecting it all grows proportionally, so investing in cyber insurance is becoming a necessity. And even those districts that can’t afford it can benefit from exploring the process.

“Not everyone can buy cyber insurance. There are a lot of requirements before you can get approved, such as multifactor authorization, specific filters, and so on,” she says. “Cyber insurance doesn’t protect you from getting hacked but complying with the insurance company’s requirements can make you a lot safer.”

Paul reports that policies are different. If you have a DNS attack and your data is held for a ransom, your insurance may cover some of the ransom, but it usually just covers what it would cost to remediate your equipment back when you need it. For example, it generally takes 48 to 72 hours to get servers back in service. 

“We don’t feel safe, but we’re doing everything we can to protect our network,” says Paul. “We have a $1 million policy, which is standard, and we use outside services to help us monitor our systems looking for holes.” 

She shares the list from her insurance company to help districts see what system and process requirements are in play to be approved for cyber insurance.

Cyber Insurance: Questions about Security, Privacy, and Media Controls 

Some school leaders are upset to find out that they don’t qualify for cybersecurity insurance. Schools and districts have to make investments in protecting themselves before insurance underwriters will approve a policy. 

To start that process, here is a list of some of the typical questions an insurer wants districts to answer:

HINT: the answers to most of these questions should be “yes.”