NCDPI, Friday Institute, MCNC Highlight Scope of No-Cost Cybersecurity Resources and Services for the First Time During NCDPI K-12 Cybersecurity Bootcamp

The same day IT professionals across the state convened for a Public School Unit (PSU) Cybersecurity Bootcamp, North Carolina schools’ student data was under threat, with potential connections to last year’s PowerSchool data breach. Cyber threats continuously face schools, whose student data is valuable and untarnished and whose IT staff are underfunded and understaffed. The North Carolina Department of Public Instruction (NCDPI)’s K-12 Cybersecurity Program is combating these cyber threats with a goal of strong cyber hygiene and dozens of resources and tools provided at no cost to keep schools safe. 

On May 6-7, 85 IT professionals from 50 PSUs across the state participated in NCDPI’s PSU Cybersecurity Bootcamp, an intense two-day in-person training opportunity aimed at helping PSUs fully leverage the NCDPI K-12 Cybersecurity Program services and resources. The bootcamp was hosted and facilitated by NCDPI partner the Friday Institute for Educational Innovation, in collaboration with NCDPI,  MCNC, the North Carolina Local Government Information Systems Association (NCLGISA) IT Strike Team, the North Carolina Department of Information Technology (NCDIT) and the NC Joint Cybersecurity Task Force (JCTF).

“In past years, there has not been training/professional development available to technicians, engineers or people doing cybersecurity in districts,” said Cory Rankin, director of technology for Pitt County Schools and a member of the NCLGISA IT Strike Team. “The K-12 space is, for a great reason, focused on curriculum and not as much the other aspects of running the operation. Just having an event that is specialized professional development for that job function, I think, is incredible.”

In 2021, NCDPI established the K-12 Cybersecurity Program to address a growing need to ensure that all PSUs across the state had the tools, structure and strategic support necessary to build a strong cybersecurity foundation. From the beginning, the program was designed to be more than a collection of tools. It was meant to be a coordinated, statewide effort that brought clarity and cohesion to how cybersecurity is approached in K-12 education. At its core, the program helps PSUs understand the landscape of people, processes and technologies involved in protecting their digital environments. PSUs are identified as public school districts and charter schools.

To do this, NCDPI works in close partnership with several teams including the Friday Institute, MCNC, NCDIT and the NC Joint Cybersecurity Task Force—each contributing expertise in areas like training, infrastructure, threat monitoring and incident response. Together, these teams deliver coordinated services and guidance aligned around key work streams that address real-world PSU needs.

Mike Ramsey, senior director of IT infrastructure for the Wake County Public School System, started the K-12 Cybersecurity Program at NCDPI as director of school connectivity and cybersecurity. Although he is no longer at NCDPI, he is proud of what has been created.

“It’s exceeded where I thought it would be,” said Ramsey. “The level of participation is great. There’s always slow adoption with K-12 because they’re busy with teaching kids. That’s their business. We’ve tried to make it as easy as possible…we make it the obvious decision.”

The pilot PSU Cybersecurity Bootcamp allowed PSUs, for the first time, to not only gain a deeper understanding of the tools and services provided to them at no cost but to also understand the why, the what and the how of the program. Participants learned why cybersecurity concepts are important and the risk of not doing something, what the PSUs need to do to mitigate that risk and have strong cyber hygiene, and how to utilize the full scope of program services and resources to accomplish that goal of strong cyber hygiene.

During the bootcamp, participants got a deeper understanding of many of NCDPI’s cybersecurity services including email and web browser protection, security awareness and skills training, incident response management, K-12 CORE controls and safeguards, and more. Friday Institute Systems Architect Sammie Carter and MCNC Security Consultant Jason Shirley facilitated each session, providing an introduction to the material. Then subject matter experts from teams within the NCDPI K-12 Cybersecurity Program showed how the program provides a tool or resource that enables the PSU to attain good cyber hygiene.  

“Events like this are important for me and my team because they provide a vital opportunity to stay on the forefront of cybersecurity trends, tools and best practices,” said Julia Burns, business systems support analyst for technology at Cumberland County Schools. “They allow us to connect directly with experts in the field, gaining insights we can immediately bring back and apply to strengthen our systems. Just as important, these events create space for meaningful networking with other districts and agencies like the Friday Institute, MCNC, NCDPI and others across the state. Collaborating with these organizations and other PSUs helps us build a more unified, informed approach to cybersecurity. By sharing knowledge and aligning our efforts, we collectively become harder targets for bad faith actors, ultimately protecting our students, staff and communities more effectively.”

IT professionals in school districts battle issues with time, money and resources every day. This bootcamp provided insight into the program as well as how NCDPI and its partners can support them.

“From the resources, services and supports we have, we’re one of the leaders around the U.S. for what we do in the K-12 support area,” said Tim Wease, director of PSU cybersecurity for NCDPI. “There’s a lot of services from the JCTF, the Strike team, the services that are provided through MCNC and DPI and the Friday Institute—a lot of states don’t have that. I think that we are improving in the right way, and I think we’re a leader in that environment.”

Looking forward, the NCDPI K-12 Cybersecurity team hopes to make the bootcamp a key piece of the program. They have already scheduled a fall bootcamp for October 14-15.

“I hope that in the future the event is looked at as the premiere cybersecurity event in the state where PSUs convene to learn about cybersecurity concepts and fundamentals, engage with the K-12 Cybersecurity Program and network with other like-minded individuals who want to make cybersecurity a priority in their district,” said Amir Lawrence, a cybersecurity analyst at the Friday Institute who helped organize the event.

Participants agreed that the program had promise and should continue in the future not only in the state but beyond.

“I think this is terrific, and to learn about the resources and the CIS [Center for Internet Security] controls and then to have training available for all those controls, I mean, this is like a masterpiece way to do this,” said Laura Rodgers, director of cybersecurity practice in the Secure Computing Institute at NC State University and director of the North Carolina Partnership for Cybersecurity Excellence (NC-PaCE). “It’s a fantastic model that needs to be throughout the country.”