A school network used to have a visible edge: the campus gate, the server room and a manageable number of desktop computers. That edge has disappeared.

Student information now moves through cloud platforms, mobile devices, learning applications, email, home networks, administrative systems and third-party services. Teachers work from multiple locations. Students sign in from personal devices. Vendors connect to systems that may hold attendance, assessment, financial or wellbeing information.

In that environment, the old idea—trust everything inside the network and block what is outside—no longer fits. Student data has become the new campus perimeter.

What zero trust means for an educational institution

Zero trust is not a product and it does not mean treating teachers or students with suspicion. It is a security model built around a simple operational rule: access should be verified, limited to what is needed and reviewed continuously.

CISA’s Zero Trust Maturity Model describes five pillars—identity, devices, networks, applications and workloads, and data—supported by visibility, automation and governance. For schools and universities, those pillars provide a useful way to replace scattered security purchases with a coherent roadmap.

Start with identity, because accounts unlock everything else

Many education security failures begin with a compromised or over-privileged account. A former employee remains active. A shared administrator password is passed between teams. A teacher uses the same weak password across systems. A vendor receives permanent access for a short project.

Identity controls should include unique accounts, multi-factor authentication for staff and administrators, timely joining-and-leaving processes, role-based access and regular reviews of privileged users. Senior leaders should not assume that “single sign-on” automatically means access is well governed. The institution still needs to know who receives which permissions and why.

Make device health part of the access decision

A valid password should not be enough when the device itself is unmanaged, outdated or compromised. Schools need an accurate inventory of laptops, desktops, tablets, network devices and servers, including ownership, operating system, support status and assigned user.

Minimum controls typically include supported operating systems, security updates, endpoint protection, encryption where appropriate, screen-lock standards and the ability to remove institutional access when a device is lost. Personal devices require a deliberate policy rather than informal tolerance.

Segment networks around learning and risk

A flat network allows one compromised device to reach too much. Classroom devices, guest access, administration, finance, security systems, servers and management interfaces should not automatically share the same trust zone.

Network segmentation can reduce the effect of an incident while preserving normal teaching. It should be designed around actual campus activity: where people learn, which systems they need and which areas hold sensitive information. A well-planned education IT infrastructure audit makes these dependencies visible before controls are introduced.

Treat cloud applications as part of the campus

Cloud does not remove institutional responsibility. Leadership should maintain an approved application register that records the service owner, data handled, sign-in method, contractual position, retention expectations and exit plan.

Unapproved apps often enter through convenience: a free classroom tool, a file-sharing link or a trial started with a personal email address. The answer is not blanket prohibition. It is a fast, understandable approval process that gives teachers safe options before shadow technology becomes normal practice.

Protect the data itself

Not all information needs the same controls. Public event material differs from student records, health information, safeguarding notes, financial data and examination content. Classifying data helps institutions decide where it may be stored, who may access it, how it is shared and when it should be deleted.

Backups should be protected from the same event that affects production systems. Recovery should also be tested. A backup that has never been restored is a hope, not a continuity plan.

Use a framework leaders can understand

The NIST Cybersecurity Framework 2.0 organises security work into six functions: Govern, Identify, Protect, Detect, Respond and Recover. Its value is that it places governance before technology and gives leadership a common language for prioritising risk.

For an educational institution, that can translate into six practical questions:

  • Govern: Who owns cyber risk, approves priorities and reviews progress?
  • Identify: Do we know our systems, devices, vendors, data and critical services?
  • Protect: Are identity, endpoint, network and data controls proportionate?
  • Detect: Would we notice unusual access or system behaviour quickly?
  • Respond: Do staff know whom to contact and what to preserve during an incident?
  • Recover: Can essential teaching and administration resume from tested backups?

A 30–60–90 day zero-trust roadmap

First 30 days: establish visibility. Inventory identities, devices, critical applications, networks, vendors and sensitive-data locations. Fix obvious high-risk gaps such as dormant accounts, shared administrator access and unsupported systems.

Days 31–60: strengthen control. Expand multi-factor authentication, formalise joiner/mover/leaver processes, define device standards, review privileged access and plan network segmentation. Confirm backup isolation and restoration responsibility.

Days 61-90: build operational resilience. Introduce monitoring priorities, incident playbooks, leadership reporting and a scheduled review cycle. Test a realistic scenario, such as a compromised staff account or unavailable student-information system.

Progress should be reported in language governing bodies can use. Instead of listing products installed, show practical outcomes: fewer dormant privileged accounts, faster removal of leavers, a higher proportion of protected devices, tested recovery times and reduced exposure of sensitive records. This turns cybersecurity from an opaque technical expense into visible institutional risk management and supports better investment decisions.

A short quarterly dashboard can keep those outcomes visible without overwhelming academic leaders. It should identify the most important unresolved risks, who owns each action and when the control will be tested again.

Security should protect learning continuity

The purpose of cybersecurity in education is not to create more friction. It is to keep teaching, communication and administration dependable while protecting the people whose information the institution holds.

KaizenEd’s managed IT and cybersecurity services for educational institutions connect infrastructure audits, identity, endpoints, network architecture, cloud security and monitoring to the realities of a working campus. When the technology roadmap also needs to support curriculum or institutional growth, our education consulting practice helps keep security aligned with the institution’s wider academic direction.