School cybersecurity warning prompts call for federal funds

WASHINGTON, D.C.: The National Parents Union is calling on federal and state leaders to put real money into school cybersecurity after the federal Cybersecurity and Infrastructure Security Agency issued an urgent warning about two critical vulnerabilities in software services that could affect school districts nationwide.

NPU President Keri Rodrigues released the statement on Oct. 22, saying the warning should push policymakers to treat school cybersecurity as a standing investment in public education rather than an afterthought.

"The National Parents Union calls on federal and state leaders to prioritize proactive school cybersecurity protections and ensure that every district has the resources and expertise necessary to keep students' information secure and schools operating safely," Rodrigues said.

The statement follows the CISA warning on flaws in widely used software services. The parents' group said districts across the country could feel the impact, and it warned that many schools are not equipped to respond.

Why school cybersecurity matters to families

Schools hold some of the most sensitive information about children and families, Rodrigues noted, including student records, health information, disability services files and personal identifying information. A breach can expose that data and, in serious cases, force a school to shut down its systems.

Yet many districts are often left to handle emerging cyber threats without the dedicated staff, technical knowledge or money to stop attacks before they happen, the statement said. Small and rural districts face the sharpest gaps, since they may have no information technology specialist on staff at all.

The group argued that the current approach is too reactive. "We need to move beyond a reactive approach to school cybersecurity," Rodrigues said. "That means sustained federal and state investments in modern technology infrastructure, routine security assessments, timely software updates, stronger data protections, workforce training, and access to cybersecurity specialists, particularly for rural and under-resourced school districts."

What the National Parents Union wants

The statement lays out a list of actions. Keri Rodrigues called for sustained federal and state funding for modern technology infrastructure in schools, regular security assessments, prompt software updates, stronger data protections and training for school staff.

She also asked for better access to cybersecurity specialists for districts that cannot hire their own, with rural and under-resourced districts named as the priority. And she urged stronger coordination among federal agencies, states, school districts and technology providers so that critical alerts turn into quick, practical protections for students and educators.

"Protecting our children in the digital age means protecting the systems that serve them," Rodrigues said. "Families should not have to wait for a major data breach or a school shutdown before policymakers recognize cybersecurity as an essential investment in public education."

School cybersecurity and the funding gap

The call lands as school cybersecurity threats keep growing. Districts have become regular targets for ransomware and data theft, a risk the parents' group ties to the thin staffing and budgets many districts face.

Federal programs have offered some help, but parent advocates say the support is uneven and hard for small districts to tap. Keri Rodrigues argued that one-time grants are not enough: districts need ongoing money for staff, tools and training, the same way they budget for buildings and buses.

The National Parents Union says it speaks for more than 2,200 affiliated parent organizations and 2 million members across all 50 states, Washington, D.C. and Puerto Rico. The group describes itself as the independent voice of modern American families on education policy.

The CISA warning did not name specific districts at risk, and the parents' group did not cite a breach tied to the newly disclosed flaws. The statement's point, Rodrigues said, is to act before one happens. For districts watching the alert, the standard school cybersecurity advice is the routine kind: patch software promptly, review who has access to student data systems, and confirm that backup and recovery plans work.