CASE STUDY OF THE ORGANIZATION Green Prairie Elementary School District 18 (District 18) is an elementary school district in Weld County, Colorado. The district spans 9,500 students and 850 staff among

a dozen elementary schools and four middle schools. The district manages an abundance of student, employee, and staff data on its servers. The pandemic that began in Spring 2020 wreaked havoc on the district’s systems. Classes were relegated to online only. Beginning in April 2020 the problems began. Some classes were repeatedly subjected to “Zoom bombing” (unwanted intrusions in online classrooms) from outsiders, disrupting courses and forcing some teachers to reset the classrooms, only to find themselves disrupted again and again. Teachers were complaining to the district offices that they could not access their courses at times, seeing only “404 – Not Found” errors when trying to access the learning management platform. Parents began complaining to the district that the standard Chromebooks that students need for coursework were prevented from connecting to classes and were seeing the same “404 – Not Found” errors. The IT support department for District 18 was at a loss as to what was happening and found themselves unable to perform their jobs. They added their voices to the many complaints coming into district administration about what was happening to the district’s systems. Recently, a staff member in the office of one of the elementary school principals mentioned a suspicious email she received after clicking a link in the message. She reported that nothing seemed to happen, so she quickly forgot about it until these other incidents were underway. In public school districts, technology adoption and support is often behind the curve compared to the commercial sector. As with most school districts across the county, the District 18 tech support department is understaffed and has severely limited budget and resources due to reductions in the tax base as businesses shut down. The district has no formal cybersecurity program and the staff of four people who are charged with IT security are only able to accomplish limited work, primarily managing credentials for students, parents, teachers, and staff for accessing their IT systems. By May 2020, just before the semester’s end, district administrators were frustrated, fed-up, and demanded that something be done to shore up resources and put a program into place to prevent future problems of the current scale. Furthermore, compliance to the Family Educational Rights and Privacy Act (FERPA) was at risk for District 18 and administrators saw the need for an emphasis on protecting student data as well as proprietary and staff data under their care. After pleading with the Colorado State Department of Education, District 18 was provided budget and resources from a Denver-based security consultancy, CyberCorps, to conduct an evaluation of the problems District 18 was experiencing and was asked to develop a strategy for ongoing cybersecurity and cyber resilience. As a five-year employee of CyberCorps, you were placed on the team to develop a recommendation to the District 18 School Board regarding what their cyber-strategy should contain, along with a rationale for the strategy.