Cyberattacks on schools don’t start with high-tech code. They start with a click.
Whether it’s a phishing email disguised as a district invoice or a fake login page spoofing Google Workspace, most breaches begin with one thing: human error.
This page is your go-to toolkit for building a human-layer defense strategy that works for real-world school environments — even with limited time and budget.
🎯 Why Focus on Phishing?
- Over 80% of K‑12 breaches start with human error
- Staff are targeted more than systems
- Quick clicks can cost thousands in downtime, lost data, or insurance denial
🧰 What You Need: The Core Toolkit
1. Phishing Simulation Platforms
Cybersecure California recommends every district implement a phishing simulation program that mimics real-world email threats. The platform should allow you to schedule regular, automated campaigns, track click-through rates, and follow up with targeted training for staff who fall for simulated attacks.
2. Staff Awareness Posters
Place engaging, easy-to-read posters in high-traffic staff areas to reinforce what phishing looks like and what to do if you suspect an email is fake. Posters should include sample phishing formats, reminder tips like “Think Before You Click,” and reporting instructions specific to your district.
3. Phishing Incident Report Template
A simple, standardized reporting form empowers staff to report incidents quickly and without fear. It should clearly state who to contact, what details to include (e.g., sender, subject, what was clicked), and immediate steps they should take (e.g., disconnect from Wi-Fi, don’t delete the email).
🧠 Train Smart, Not Long
You don’t need hour-long webinars. You need:
- Micro-trainings: 5-minute explainers once a month
- Sample email debriefs: “Here’s one we caught this week”
- New hire onboarding modules with phishing examples
📋 Example Staff Memo Template
Subject: What to Do If You Get a Suspicious Email
If it feels off, don’t click it.
Forward it to: security@district.org
If you clicked it, report immediately — no judgment.
We’d rather act fast than assign blame.
🚨 When to Escalate
Have a district-wide checklist for when to involve IT leadership or your MSP:
- Multiple staff report similar phishing attempts
- A staff member clicked and entered login info
- Unusual account activity is detected
- Systems are inaccessible or passwords reset unexpectedly
💡 Final Word
You don’t need to eliminate human error — just plan for it.
Schools that prepare their people protect their systems. And every teacher, admin, and aide who knows how to spot a fake email is one more layer of defense.
Cybersecure California is here to help districts move from reactive to ready with free tools, curated content, and clarity over complexity.
Use this toolkit. Share it freely. And let your staff know: it’s safe to report, and it’s never too late to learn.