19. Phased Implementation Roadmap
LiveSequence improvement work by risk reduction, readiness, dependencies, capacity, and instructional timing.
Learning objectives
- Produce a credible 30/60/90-day sequence with owners, measures, leadership decisions, and no-fly windows.
- Use framework evidence and district context to explain a defensible priority or tradeoff.
- Integrate the 30/60/90-day sequence, dependencies, month-one checklist, governance checkpoints, and measures.
Instructional cycle
Frame the decision → assess current practice → learn from the framework → practice → update the 90-day plan → brief leadership → reassess.
Applied practice: The 30/60/90-Day Sort
Complete a credible implementation sequence.
Topics in this Lesson
What you will be able to do
- Produce a credible 30/60/90-day sequence with owners, measures, leadership decisions, and no-fly windows.
- Use framework evidence and district context to explain a defensible priority or tradeoff.
- Integrate the 30/60/90-day sequence, dependencies, month-one checklist, governance checkpoints, and measures.
Opening dilemma
A grant can fund only part of a long gap list, and the academic calendar limits change windows. Which actions belong in the next 90 days?
Commit to a response before reading. Record the assumptions behind your choice.
Pre-assessment
Before reading, rate the district’s current practice for this criterion: Implementation is sequenced, owned, measured, capacity-aware, and aligned to the academic calendar.
- Emerging — informal, reactive, or dependent on one person
- Developing — partly documented or inconsistently applied
- Operational — assigned, repeatable, implemented, and evidenced
- Leading — measured, rehearsed, integrated, and continuously improved
Superintendents and school boards need clear, actionable steps to
transform cybersecurity from concept to reality. This roadmap provides a
practical progression that balances immediate risk reduction with
long-term security maturity.
“The biggest hindrance is often the sheer amount of work involved for
a small team,” notes Caroline Lightfoot, Director of Technology at
Dickinson ISD. “We constantly have to make sure our security measures
don’t get in the way of what teachers need to do, while still keeping
student data safe.”
This phased approach respects those constraints while building
meaningful capability.
Figure: 0–90d / 3–9m / 9–18m / 18–24m phases with milestone
chips; ready for board approvals.
Rubric Checkpoint
NIST CSF Function: ALL
Rubric Domain: Improvement (across all functions)
NIST CSF 2.0 Categories:
| Category | Code | Outcome |
|---|---|---|
| Improvement | ID.IM | Security program matures through planned phases |
| Risk Management Strategy | GV.RM | Implementation priorities aligned with risk assessment |
| Oversight | GV.OV | Progress monitored and reported to leadership |
Implementation is the bridge between assessment and maturity. The
Rubric measures current state; this chapter shows the path from your
current level to your target level.
Key Maturity Indicators:
- Level 2: Security improvements happen opportunistically
- Level 3: Documented improvement plan with milestones
- Level 4: Phased implementation with board-approved timeline
- Level 5: Continuous improvement cycle; maturity tracking
Assessment Tip: Use your Rubric scores to identify
which NIST CSF functions need the most attention, then follow the phased
approach in this chapter to build toward your target maturity level.
Phase 0: Assessment
and Planning (0-3 months)
Goal: Establish baseline understanding and secure
leadership buy-in
Key Deliverables:
- Conduct initial security assessment
- Inventory sensitive data and critical systems
- Document current security practices
- Establish governance structure
- Secure board approval and initial funding
Estimated Costs: 10, 000−25,000 (primarily for assessment
services)
Phase 1: Critical
Protections (3-6 months)
Goal: Address highest-risk areas to prevent common
attacks
Key Deliverables:
- MFA for all administrative accounts
- Endpoint protection across staff devices
- Automated backup systems for critical data
- Email security and basic web filtering
- Initial incident response procedures
- Basic security awareness training
Estimated Costs: 25−40 per user annually
Expected Outcomes:
- 80% reduction in successful phishing attacks
- Prevention of common malware infections
- Ability to recover from basic ransomware attempts
Phase 2: Defense Maturity
(6-12 months)
Goal: Develop sustainable security operations
Key Deliverables:
- Role-based access control for major systems
- Network segmentation between critical environments
- Security log monitoring and alerting
- Data classification and handling procedures
- Vendor security assessment process
- Tabletop exercise for incident response
Estimated Costs: 50−75 per user annually
Expected Outcomes:
- Limited scope of potential breaches
- Earlier detection of incidents
- Compliance with state privacy requirements
Phase 3: Security
Optimization (12-24 months)
Goal: Full integration of security into
operations
Key Deliverables:
- Advanced endpoint detection and response
- Identity and access governance
- Comprehensive vendor risk management
- Vulnerability management system
- Disaster recovery capabilities
- Security metrics dashboard
Estimated Costs: 75−125 per user annually
Phase 4: Continuous
Improvement (Ongoing)
Goal: Evolve capabilities with changing threats
Key Deliverables:
- Annual security assessment program
- Technology refresh with security-by-design
- Regular penetration testing
- Threat intelligence program
- Information sharing participation
Estimated Costs: 8-12% of total IT budget
The Path Forward
Implementation is the bridge between knowing what to do and actually
doing it. This phased roadmap transforms the comprehensive guidance in
this framework into achievable milestones that build security capability
while respecting the constraints of K-12 environments.
The key to success is starting where you are and building
incrementally. Phase 0 assessment creates the foundation of
understanding. Each subsequent phase builds on previous gains, creating
momentum that sustains the effort. Districts that follow this approach
emerge with mature security capabilities that protect students and
support educational mission—not through heroic effort, but through
consistent, strategic progress.
What Your Boss Should Know
The Bottom Line: Phased implementation over 24
months requires meaningful additional IT budget but prevents costly
incidents.
Board Decisions Required:
- Approve 24-month implementation roadmap with phased milestones
- Allocate funding across multiple fiscal years
- Dedicate staff resources to implementation coordination
What Success Looks Like:
- Phase completion within planned timelines
- Rubric score improvements at each phase milestone
- Reduced security incidents as protections mature
Why It’s Worth It: One major incident costs more
than the entire 24-month implementation budget.
Interactive Activity
Reflect
Which current initiative lacks a prerequisite, owner, or safe implementation window?
Apply the lesson
Integrate the 30/60/90-day sequence, dependencies, month-one checklist, governance checkpoints, and measures.
Protect sensitive information. Use role titles and system categories. Do not enter student or staff records, credentials, network addresses, exploitable configurations, active incident details, or confidential vendor terms.
Interactive Activity
Build the boss brief
Present the three moves that make the next 90 days credible.
Use five parts: risk; learning impact; proposed action; decision or support needed; evidence of success.
Post-lesson rubric reassessment
Implementation is sequenced, owned, measured, capacity-aware, and aligned to the academic calendar.
- Emerging — informal, reactive, or dependent on one person
- Developing — partly documented or inconsistently applied
- Operational — assigned, repeatable, implemented, and evidenced
- Leading — measured, rehearsed, integrated, and continuously improved
Use the same scale as the pre-assessment. Cite evidence of movement, or identify the next action if the rating did not change.