Quarterly School & Campus Hardening

Every 90 days, with a trend line on every check.

What it is

Runs twenty-three checks on this office computer, the network it is on, the classroom devices it can hear and the domains you declare, asks your school's questions once, and maps everything to NIST CSF 2.0 in one report. Nothing is changed.

A locked student information system closes the school for days, and families, your state education department and your insurer ask how student records are kept, which vendors receive them and who can reach them. This bundle gathers what one school can show: its office computers, the classroom devices and cameras sharing its network, the student records at rest, your domain and e-mail, and your own answers.

This is the quarterly form of the School & Campus Hardening Bundle (IND-EDU-88): the same 23 checks, run four times a year, each report showing what changed since the last.

The framework

Mapped to NIST CSF 2.0 — with FERPA, CIPA and COPPA as expectations. The report maps what the scan observed on this computer, this network and the domains you declare to that framework's expectations and shows where each finding sits. It is a map of findings to the framework, not a ruling on whether you meet it, and it is not a risk analysis; your industry's expectations stand beside the findings, never in place of them.

Who it is for

A K-12 public, charter or private school, or a small college, with its own computers and domain. A large district or a university is measured across every campus and system and is the human-delivered engagement's customer; this bundle is one school's first look.

A large district or a university is measured across every campus, every student system and every vendor that receives student records, with a program that covers the whole. That is the work of the human-delivered ThreatVector engagement. This report is still correct about the office computer it ran on and is a useful first look for the technology lead who ran it.

What runs (23 checks)

• Windows Security Health Check (ENDPOINT-01)
• Ransomware Readiness Check (RANSOM-READY-03)
• Account & Access Review (INSIDER-ACCESS-05)
• Credential Hygiene Check (PW-HYGIENE-11)
• Out-of-Date Software Scan (EOL-16)
• Startup & Persistence Check (PERSIST-24)
• Wi-Fi & Home Network Check (WIFI-LAN-02)
• Router & Wi-Fi Settings Checklist (ROUTER-22)
• Email Spoofing & BEC Check (BEC-08)
• Breach & Identity Exposure Check (BREACH-10)
• Insider Risk Self-Assessment (INSIDER-21)
• Industry Readiness Questionnaire (READINESS-91)
• Internet Exposure Scan (EXPOSURE-06)
• Website & Storefront Checkup (STOREFRONT-07)
• Certificate & Encryption Check (TLS-09)
• Domain & DNS Security Check (DNS-63)
• Medical & Operational Device Scan (DEVICES-77)
• Sensitive Data at Rest Check (SENSDATA-78)
• Workstation Policy & Logging Check (POLICY-79)
• Cloud Storage Exposure Check (BUCKET-28)
• Business Impersonation & Typosquat Sweep (IMPERSON-19)
• AI Usage & Shadow-AI Exposure Review (AIUSE-70)
• Digital Asset Register & Ownership Check (REGISTER-74)

Before it runs: one question you can say no to

• May the Sensitive Data at Rest Check count files in this computer's profile folders whose contents match regulated-data patterns (such as Social Security number shapes beside a name)? It reports counts only: never a match, a file name or a path. Optional. Say no and the report records that this check was skipped at your request.

Price

$649 a year, four runs, one every 90 days, with a trend line on every check from the second run. One run on its own is $499: the School & Campus Hardening Bundle (IND-EDU-88).

What it never does

It never changes a setting, installs anything, tries a password or signs in to an account. Where a check reads inside files it reports counts only — never a value, a file name or a path. Nothing is exploited and no credential is guessed. Your own answers are recorded as yours and never upgraded into something the scan observed.