The San Diego County Board of Education officially proclaimed October 2026 as Cybersecurity Awareness Month via Resolution No. 2026-37, declaring the protection of student and employee data a fundamental public education obligation.
Resolution No. 2026-37 and the Scope of Public Education Data
Public education infrastructure safeguards information far beyond basic administrative records. The San Diego County Office of Education (SDCOE) serves districts, charter schools, special education schools, the Cuyamaca Outdoor School, Juvenile Court and Community Schools, along with foster youth, homeless education, and early education programs. Within these systems, the agency maintains sensitive student education records protected under the Family Educational Rights and Privacy Act (FERPA), special education files, student health records, files concerning foster and justice-involved youth, as well as personnel and payroll records.
Protecting these databases remains a structural requirement under federal and state law. However, the Board emphasized that data security extends beyond mere regulatory compliance. It represents a core condition of public trust, warning that any security breach falls hardest on underserved students.
AI Threats Drive National Cybersecurity Focus
The local declaration aligns with a federal precedent established in 2004, when the President and Congress designated October as Cybersecurity Awareness Month. For 2026, the Cybersecurity and Infrastructure Security Agency (CISA) adopted “Securing the Next 250” as its national theme, marking the nation’s 250th anniversary and emphasizing the need to build a secure digital future for its next era.
The urgency behind this year’s focus stems from measurable technological shifts. Artificial intelligence has accelerated both the speed and scale at which malicious actors identify vulnerabilities, generate fraudulent communications, and impersonate trusted individuals. Systemic pressures compounded rapidly: by August 2026, the volume of vulnerabilities added to the national Common Vulnerabilities and Exposures (CVE) database had already surpassed the total recorded for all of 2025.
A cyber incident targeting a public school system threatens far more than server uptime. Disruptions cascade into active classroom instruction, payroll processing, student nutrition programs, daily transportation, and support services relied upon by a community’s most vulnerable students.
SDCOE Adopts Policies to Protect Student and Staff Data
To mitigate these risks, the Board has formally adopted Board Policy 0442 on Cybersecurity and Board Policy 0441 on Artificial Intelligence. These policies mandate that all technology procured or utilized by SDCOE must protect the privacy, security, and dignity of students and staff.
The Integrated Technology Services division executed several defensive upgrades across the county’s infrastructure:
- Deployed single sign-on and multifactor authentication protecting over 50,000 K-12 staff accounts.
- Provided the Red Herring phishing awareness and training platform at no cost to San Diego County districts while extending availability to county offices of education statewide.
- Established a structured safety evaluation protocol for artificial intelligence tools prior to organizational approval.
- Maintained active incident response, backup, and continuity capabilities.
Workforce Development and Student Pathways in Cybersecurity
Beyond network defenses, SDCOE integrated workforce training into its educational mission. Over 175 students have completed cybersecurity bootcamps coordinated through the office. Information technology and cybersecurity internships are actively offered to students within the Juvenile Court and Community Schools program.
These initiatives establish direct pathways toward industry certifications and long-term careers in a field with sustained workforce demand. Equipping students who have faced poverty, foster care, or juvenile justice involvement with technical skills directly advances the organization’s North Star goal of reducing poverty and increasing belonging through educational opportunity.
Implementation and Shared Responsibility Across Districts
The resolution explicitly defines cybersecurity as a shared responsibility extending to every employee, student, family, vendor, and partner within the public education network. The Board formally supports the County Superintendent and the Integrated Technology Services division to continue reducing vulnerabilities, phasing out end-of-support technology, and sustaining rapid recovery capabilities to ensure uninterrupted service delivery for students.
