Can ESSER III funds pay for managed security services like CoreRecon?

Yes. ESSER III (Elementary and Secondary School Emergency Relief Fund) explicitly allows cybersecurity-eligible expenditures including managed detection and response, SOC monitoring, endpoint protection, and security assessments. Funds must be obligated by September 30, 2026. Districts need to document their cybersecurity use case against ESSER III allowable uses — CoreRecon provides procurement documentation to support this.

What FERPA obligations apply to school district cybersecurity?

FERPA requires districts to protect education records (PII) from unauthorized disclosure. A breach exposing student records — names, grades, discipline records, IEPs, or directory info — triggers FERPA breach notification obligations and potential loss of federal funding. Texas Education Code §32.151–§32.156 additionally requires student data privacy agreements with all vendors accessing student data and a published student data use policy.

Do school resource officers (SROs) create CJIS compliance requirements for the district?

Yes. Any district with SROs who access TCIC/NCIC (criminal justice databases) must comply with FBI CJIS Security Policy for all systems and personnel with CJI access. This includes the district's IT infrastructure, any devices accessing criminal justice information, and staff training requirements. CJIS v6.0 auditing is active as of October 2025 — districts are in scope and often unaware.

Why are ransomware attackers targeting Texas K-12 districts specifically?

Texas K-12 districts combine three attacker incentives: high-value PII (student SSNs, medical/IEP records, parent financial data), underfunded IT teams that lack 24/7 monitoring, and operational pressure to pay — because a district can't keep buses running or payroll processing on paper. Dallas ISD, Fort Worth ISD region, and multiple ESC-served districts were hit in 2024–2025 waves. Ransomware groups have published 'education sector playbooks' targeting semester-start timing.

Does CoreRecon's pricing include student 1:1 device fleets?

No. CoreRecon's K-12 endpoint pricing covers staff devices, servers, and administrative infrastructure — not 1:1 Chromebook or student tablet fleets, which operate on managed ChromeOS/MDM with limited threat surface. A typical 2,000-student district might have 200–400 staff/admin endpoints in scope. The free assessment maps your actual endpoint footprint so there are no surprises.

Security for Texas K-12 Districts • FERPA • ESSER III • CJIS (SRO) • SDVOSB

Texas school districts are the most attacked sector you don't hear about.

Dallas ISD, Fort Worth ISD region, and dozens of ESC-served districts were hit in the 2024–2025 ransomware wave. The average K-12 breach exposed 47,000 student records including SSNs, IEPs, and disciplinary data. ESSER III cybersecurity funds expire September 2026 — districts have budget for this. Most haven't spent it.

Get your free $2,500 assessment → K-12 cyber checklist (CJIS quiz) ↗

⏳

ESSER III Cybersecurity Spend Window Closing. Federal cybersecurity-eligible ESSER III funds must be obligated by September 30, 2026. Districts that haven't documented a cybersecurity use case will lose this funding permanently. CoreRecon provides procurement documentation to support ESSER III eligibility. Most districts have unspent budget right now.

Threat Reality — Texas K-12

They target districts because
downtime is not optional.

Ransomware groups have published K-12 targeting playbooks. Districts run on tight timelines — semester start, payroll, bus routing, state reporting. Attackers know that a district can't wait 48 hours for IT to respond. Limited SOC coverage and underfunded security budgets make Texas K-12 the highest-value, lowest-resistance target in the state.

Ransomware / Operational Shutdown

The #1 K-12 Attack Vector

Ransomware encrypts SIS, payroll, student records, and bus management systems simultaneously. Districts have missed opening days, delayed payroll, and lost state reporting deadlines. Average downtime in K-12 ransomware: 9 days. Average recovery cost (no insurance): $2.7M. Texas ESC Region 11 coordinated response to three simultaneous district attacks in fall 2024.

Student PII Exfiltration

FERPA's Nightmare

Modern ransomware groups exfiltrate before encrypting. Student records — including SSNs, IEP/504 accommodations, disciplinary data, and parent financial information — are extracted and held for double extortion. A published student PII leak triggers FERPA breach notification, TX Ed Code §32.151 obligations, and potential loss of federal Title funding. The average K-12 breach exposed 47,000 student records in 2024.

SIS / SSO Compromise

Single Sign-On = Single Point of Failure

Student Information System compromise cascades. A single set of stolen admin credentials in PowerSchool, Skyward, or Infinite Campus gives attackers access to every student record, staff file, and parent contact in the district. The December 2024 PowerSchool breach affected 6,500+ school districts including multiple Texas LEAs — attackers accessed historical student and teacher data going back years.

K-12 Compliance Landscape

Five frameworks.
One team to manage them all.

Texas K-12 districts operate under more compliance frameworks than most healthcare organizations — and with a fraction of the IT staff. Here's every regulation in scope and how CoreRecon covers it.

Framework	Who's in Scope	Key Requirements	Penalty / Consequence	CoreRecon Coverage
FERPA	All districts receiving federal funding (nearly all TX LEAs)	Protect education records PII; breach notification; restrict third-party access	Loss of federal Title funding; reputational damage; OCR investigation	Sentinel Data access monitoring, breach detection, audit logging
COPPA	Districts using online services for students under 13	Parental consent or school authorization for online services; data minimization	FTC fines up to $51,744 per violation; vendor liability exposure	Sentinel Vendor access controls, data classification, policy documentation
TX Ed Code §32.151–§32.156	All Texas public school districts and charter schools	Student data privacy agreements with all vendors; published data use policy; annual reporting to TEA	TEA corrective action; loss of state accreditation in extreme cases	Fortress Vendor agreement tracking, data use policy templates, TEA reporting support
CJIS (SRO programs)	Districts with SROs accessing TCIC/NCIC criminal justice data	FBI CJIS v6.0 compliance for all 13 policy areas; annual security awareness training; MFA; audit logging	Loss of NCIC access; FBI audit findings; federal funding risk	Command Full CJIS v6.0 coverage — 13 policy areas, audit-ready evidence packages
CIPA (E-Rate)	Districts accepting E-Rate Category Two (infrastructure) funds	Internet safety policy; content filtering for minors; monitoring of student online activity	USAC audit finding; E-Rate funding clawback; disqualification from future E-Rate	Sentinel Internet safety policy documentation, monitoring posture assessment

Read the CJIS v6.0 Compliance Guide (applies to SRO programs) →

Federal Funding — ESSER III & E-Rate

Your district has budget
specifically for this.

Most district IT directors don't realize that ESSER III and E-Rate Category Two can fund managed security services directly. The ESSER III spend window closes September 2026 — unspent funds disappear. Here's how to use what you already have.

ESSER III — Expires Sept 2026

Elementary & Secondary School Emergency Relief

ESSER III explicitly allows cybersecurity expenditures including MDR/SOC services, endpoint protection, security assessments, and staff training. Texas districts collectively received over $12B in ESSER III. Cybersecurity use must be documented against allowable uses language.

What districts need to document: A written cybersecurity improvement plan, vendor quotes, and a connection to student safety or continuity of operations. CoreRecon provides all documentation at no additional cost.

E-Rate Category Two

FCC Schools & Libraries Program

E-Rate Category Two covers internal connections including network equipment, managed Wi-Fi, and cybersecurity components such as firewall management and content filtering required for CIPA compliance. Funding windows run July–June. CIPA compliance documentation is required for all E-Rate recipients.

CoreRecon can support: CIPA policy documentation, firewall assessment, and network security posture that satisfies E-Rate compliance requirements.

Cyber Insurance Pressure

Renewals Now Require MDR Documentation

K-12 cyber insurers — Coalition, Beazley, AXA XL, Cowbell — are now requiring documented MDR/SOC coverage as a condition of renewal. Districts without a managed security provider are seeing premiums increase 30–80% or coverage denied outright.

CoreRecon provides: A Letter of Engagement and Security Posture Summary formatted for cyber insurance carrier requirements — included at no additional cost with any tier.

Anonymized Texas K-12 Incidents

What actually happened.
What would have changed it.

Three confirmed Texas K-12 incidents. Attack vectors, impact, and the specific detection capability that would have stopped each one before encryption.

North Texas District — Fall 2024

SIS Vendor Credential Compromise

Attack Vector

Phishing email targeting a vendor support account with elevated SIS access. Credentials reused across district VPN and the vendor portal. Attacker pivoted from vendor credentials to district domain admin within 4 hours.

Impact

Student records for 38,000+ students exfiltrated. Ransomware deployed during a weekend. District missed first day of school. State reporting deadline missed — TEA notification required.

What would have changed it: Privileged account monitoring with anomalous login detection. The vendor account's 2am lateral movement would have triggered an alert within minutes. This is Sentinel-tier coverage.

ESC Region-Served District — Spring 2025

Ransomware via Unpatched RDP

Attack Vector

Remote Desktop exposed on a finance workstation with a weak local admin password. LockBit affiliate accessed over a holiday weekend, established persistence, and deployed ransomware on Monday at 6:45am — before staff arrived.

Impact

Payroll system encrypted — 400 staff checks delayed. Financial records going back 7 years encrypted. $285,000 ransomware demand. District paid $140,000 negotiated settlement. Recovery took 22 days.

What would have changed it: Attack surface management with exposed RDP detection plus after-hours anomaly monitoring. The RDP exposure existed for 6 months before the attack. This is Sentinel-tier coverage.

DFW Metro District — Late 2024

PowerSchool Supply Chain Breach

Attack Vector

Third-party SIS vendor (PowerSchool) breach in December 2024. Attacker used compromised vendor maintenance credentials to access the customer support portal and export historical student/teacher data for affected districts.

Impact

Student and teacher records — including SSNs and medical data for IEP students — exfiltrated for all affected districts. District received vendor notification 3 weeks after breach occurred. FERPA breach notification required.

What would have changed it: Vendor risk monitoring and data classification. While the initial breach was at the vendor, districts with a documented FERPA incident response plan activated in <72 hours vs. weeks. This is Fortress-tier readiness.

Pricing for Texas School Districts

Endpoints = staff devices.
Not student Chromebooks.

CoreRecon's K-12 pricing covers staff workstations, servers, and administrative infrastructure — not 1:1 student device fleets. A typical 2,000-student district has 200–400 endpoints in scope. Month-to-month. No minimums. ESSER III procurement documentation included.

Tier	Price / Endpoint / Month	What's Included	Best For
Sentinel	$89	24/7 SOC monitoring, endpoint detection & response, FERPA breach detection, anomalous access alerts, attack surface management, CIPA policy posture, monthly reports, IR Letter for insurance	Districts with no SRO program; FERPA + COPPA compliance baseline; basic insurance requirement coverage
Fortress	$109	All Sentinel + firewall management, network segmentation, SIEM, vendor risk monitoring, TX Ed Code §32.151 documentation support, E-Rate firewall posture assessment	Districts with active vendor integrations (PowerSchool, Google, Microsoft 365); E-Rate compliance; supply chain risk
Command	$129	All Fortress + full CJIS v6.0 coverage (all 13 policy areas), SRO program security, annual CJIS audit support, audit-ready evidence packages, TX DPS reporting coordination, ESSER III procurement documentation	Districts with SRO programs (CJIS in scope); maximum insurance coverage; ESSER III-funded deployments requiring full documentation

* K-12 endpoints = staff/admin devices, servers, and network infrastructure. Student 1:1 device fleets (Chromebooks, iPads, student tablets) are not in scope and are not priced. The free assessment maps your actual footprint.

Frequently Asked Questions

What superintendents
and IT directors ask us.

Yes. ESSER III explicitly allows cybersecurity expenditures including managed detection and response, SOC monitoring, endpoint protection, and security assessments. Funds must be obligated by September 30, 2026. Districts need to document their cybersecurity use case against ESSER III allowable uses language — CoreRecon provides procurement documentation to support this at no additional cost.
FERPA requires districts to protect education records (PII) from unauthorized disclosure. A breach exposing student records — names, grades, discipline records, IEPs, or directory info — triggers FERPA breach notification obligations and potential loss of federal funding. Texas Education Code §32.151–§32.156 additionally requires student data privacy agreements with all vendors accessing student data and a published student data use policy.
Yes. Any district with SROs who access TCIC/NCIC (criminal justice databases) must comply with FBI CJIS Security Policy for all systems and personnel with CJI access. This includes the district's IT infrastructure, any devices accessing criminal justice information, and staff training requirements. CJIS v6.0 auditing is active as of October 2025 — districts are in scope and often unaware. The CJIS readiness quiz will tell you where your gaps are in 6 minutes.
Texas K-12 districts combine three attacker incentives: high-value PII (student SSNs, medical/IEP records, parent financial data), underfunded IT teams that lack 24/7 monitoring, and operational pressure to pay — because a district can't keep buses running or payroll processing on paper. Dallas ISD, Fort Worth ISD region, and multiple ESC-served districts were hit in 2024–2025 waves. Ransomware groups have published education sector targeting playbooks keyed to semester-start timing when operational disruption is maximum.
No. CoreRecon's K-12 endpoint pricing covers staff devices, servers, and administrative infrastructure — not 1:1 Chromebook or student tablet fleets, which operate on managed ChromeOS/MDM with limited threat surface. A typical 2,000-student district might have 200–400 staff/admin endpoints in scope. The free assessment maps your actual endpoint footprint so there are no surprises. Scope and pricing are finalized before any contract is signed.

Free Security Assessment — $2,500 Value

Find out before the next semester starts whether your district has been quietly breached.

Most K-12 breaches aren't discovered until ransomware detonates. The average dwell time in Texas education networks is 8 days. Our free assessment maps your endpoint exposure, benchmarks against FERPA and CJIS requirements, and delivers a prioritized remediation plan with ESSER III documentation if applicable. No credit card. No commitment.

Request your free assessment →

Delivered within 14 days • No credit card • ESSER III procurement docs included

Texas school districts are the most attacked sector you don't hear about.

They target districts becausedowntime is not optional.

Five frameworks.One team to manage them all.

Your district has budgetspecifically for this.

What actually happened.What would have changed it.

Does Your SRO Program Create CJIS Compliance Obligations?

Endpoints = staff devices.Not student Chromebooks.

Texas clients. Real outcomes.Sectors that can't afford downtime.

What superintendentsand IT directors ask us.

Find out before the next semester starts whether your district has been quietly breached.

They target districts because
downtime is not optional.

Five frameworks.
One team to manage them all.

Your district has budget
specifically for this.

What actually happened.
What would have changed it.

Endpoints = staff devices.
Not student Chromebooks.

Texas clients. Real outcomes.
Sectors that can't afford downtime.

What superintendents
and IT directors ask us.