Somewhere this month a technology director is doing the August thing: counting Chromebooks, resetting staff passwords, and staring at a board slide that has to explain, in one line, why the district needs money it has never been given for a risk nobody in the room has seen. On August 12 CISA published something that lands directly on that slide — the K-12 Cybersecurity Foundations Resource Package. Guides for leaders, guides for non-technical staff, guides for the IT professionals, a six-part video series, quick reference materials. No cost. Organized around eight named objectives. It is, genuinely, the most usable thing the federal government has ever handed a school district on this subject, and I would tell any district to download it today.
Now read the paragraph most of the coverage will cut for length. CISA writes that the package “directly advances Executive Order 14239, Achieving Efficiency through State and Local Preparedness.” That is a citation, not a flourish, and the order it points to is short enough to read in five minutes. Its first section says that federal policy “must rightly recognize that preparedness is most effectively owned and managed at the State, local, and even individual levels.” It lists cyber attacks by name among the risks it means. So the eight objectives are not only help. They are also the federal government writing down, in public and in order, what it now considers a district’s own job.
Federal policy must rightly recognize that preparedness is most effectively owned and managed at the State, local, and even individual levels, supported by a competent, accessible, and efficient Federal Government. Citizens are the immediate beneficiaries of sound local decisions and investments designed to address risks, including cyber attacks, wildfires, hurricanes, and space weather.
I want to be careful here, because there is a cynical version of this piece and it would be wrong. The package is not a trap and it is not a substitute for funding that got taken away — CISA has been building K-12 material since well before this order, and the eight objectives are the same eight things a competent assessment would find. Section 3 of the order is blunter about the intent than any press release would be: it directs a shift “from an all-hazards approach to a risk-informed approach” and to “move beyond information sharing to action.” The action it has in mind is local. That is the whole design.
Which is why the framing your clients hear this month decides how they budget next month. A superintendent who hears “CISA released free cybersecurity resources” files it as a nice-to-have and a summer project. A superintendent who hears “the federal government has published the eight things it now expects your district to own, and your board will be measured against them” puts a line in the budget. Same package. Same eight bullets. One of those districts has an answer in December when something goes wrong, and one has a download link.
Two moves, and the calendar is the reason — do both before the first board meeting of the year. Score the eight, one page. For each objective, mark green, amber or red with a single sentence of evidence — not an opinion, a fact you could show someone. Most districts will find two greens and are better off knowing. Then put the citation in the packet. Board members discount vendors and do not discount executive orders. The sentence that makes the eight objectives a standard rather than a suggestion is CISA’s own, it is in the announcement, and quoting it costs you nothing and changes the room.
Kept honest. Nothing here is a legal requirement: EO 14239 directs federal agencies, not school districts, and the package is explicitly voluntary and customizable — CISA calls it a roadmap, not a rule. No new funding is attached to it that I could find, and no deadline. The order predates the package by nearly seventeen months, so this is not a policy announced this week; what is new this week is the tool, and CISA’s own decision to tie the two together in writing. And the eight objectives are foundations, deliberately — a district that clears all eight is at a floor, not a finish line.
Sources, all primary, all fetched today, August 16, 2026. (1) Cybersecurity and Infrastructure Security Agency, CISA Unveils New Cybersecurity Resources for K-12 Schools and Districts, news release dated August 12, 2026, fetched and read today — cisa.gov/news-events/news/cisa-unveils-new-cybersecurity-resources-k-12-schools-and-districts. Source of the release date, the package name, the composition (guides, six-part video series, quick reference materials, audiences named), the eight key objectives quoted verbatim and in the agency's own order, the Scott Breor quotation, the alignment list (CISA's Protecting Our Future report, the Cross-Sector Cybersecurity Performance Goals, the NIST Cybersecurity Framework), and the Executive Order 14239 citation sentence quoted above. (2) Executive Order 14239 of March 18, 2025, Achieving Efficiency Through State and Local Preparedness, 90 Fed. Reg. 13267 (March 21, 2025), document number 2025-04973 — existence, EO number, signing date and publication date confirmed through the Federal Register JSON API; the full text read today from the GPO's authenticated PDF at govinfo.gov/content/pkg/FR-2025-03-21/pdf/2025-04973.pdf, extracted with pypdf. Source of the section 1 passage quoted verbatim, the section 2 policy language, and the section 3(b) directives on risk-informed approach and moving beyond information sharing. The Federal Register HTML and raw-text endpoints were WAF-blocked today; the JSON API and the GPO PDF were used instead, per standing practice.
CISA gave every school district in the country a free cybersecurity program on Tuesday. I think districts should download it today. I also think almost everyone is about to read it wrong. The thing itself: the K-12 Cybersecurity Foundations Resource Package. Guides for superintendents, guides for the front office, guides for whoever actually holds the admin passwords, plus a six-part video series. It's organized around eight objectives — credentials, devices, testing backups, incident response, training, data policy, aligning investments to a real framework, and building a long-term plan. No cost. It is the most usable thing the federal government has handed K-12 on this subject. Now the sentence near the bottom of the announcement, the one that gets cut for length. CISA writes that the package "directly advances Executive Order 14239, Achieving Efficiency through State and Local Preparedness." Go read that order. Section 1: federal policy "must rightly recognize that preparedness is most effectively owned and managed at the State, local, and even individual levels." It names cyber attacks specifically. Section 3 tells agencies to move "beyond information sharing to action" — and the action it means is yours. So the eight objectives aren't only help. They're the federal government writing down, in public and in order, what it now considers a district's own job. That changes what the package is for. A superintendent who hears "CISA released some free resources" files it as a summer project. A superintendent who hears "here are the eight things we're now expected to own, and the board will be measured against them" puts a line in the budget. Same eight bullets. Two completely different districts in December. If you advise schools, the move before the first board meeting is small: score the eight on one page, green/amber/red, one sentence of evidence each — a fact you could show someone, not an opinion. Then put CISA's own citation sentence in the board packet. Boards discount vendors. They do not discount executive orders. Honest limits: none of this is legally binding on a district, no money is attached, there's no deadline, and the order is seventeen months old. What's new is the tool — and CISA's decision to tie the two together in writing. The package is the gift. The citation is the job description.
Use the MRP Personal Design System (Signature). Create a 1080x1350 animated piece titled "The Sentence at the Bottom." Bone field (#F4F1EC), Ink type (#141414), Coral Deep (#D9401F) for the kicker, rules and small labels; Coral Bright (#FF6A4D) spent EXACTLY TWICE — once when the citation sentence resolves in beat 3, once on the final line of the end card. Cormorant for the objective list numerals and the end card; Manrope Light for body lines, the objective names and the footer; Italiana for the SignatureMark. Tall, airy, left-aligned. Max 3 type moves. The piece is A PAGE BEING READ FURTHER DOWN THAN USUAL: typography only — no shields, no schoolhouses, no lock icons. Sequence (about 50 seconds): 1. (0-4s) Kicker top-left, letter-spaced uppercase Manrope in Coral Deep, types on: "CISA K-12 CYBERSECURITY FOUNDATIONS · RELEASED AUG 12, 2026". Beneath it one Manrope Light Ink line fades up: "free. complete. eight objectives." Hold. 2. (4-22s) The eight objectives arrive as a numbered list, Cormorant numerals in Coral Deep at left, Manrope Light Ink names beside them, settling one at a time, evenly, unhurried — 01 protecting login credentials / 02 safeguarding devices and assets / 03 testing backups / 04 strengthening incident response / 05 improving cybersecurity training / 06 policies for sensitive data / 07 aligning investments with frameworks / 08 long-term, customized plans. The evenness matters: it should read as a generous, complete offer. HOLD on the full list. 3. (22-34s) The list does NOT clear — it dims to 30% and stays visible behind everything that follows, because the point is that both things are on the same page. A thin Coral Deep rule draws left to right beneath it. Below the rule, in Manrope Light, a single line types on slowly, as if being read late: "directly advances Executive Order 14239 —". A designed pause, unvoiced. Then, in large Cormorant, the order's own title lands and warms to Coral Bright (moment 1 of 2): "Achieving Efficiency Through State and Local Preparedness". 4. (34-42s) The title holds. Beneath it, one Manrope Light Ink pull-quote fades up in two short lines, small and quiet: "preparedness is most effectively owned and managed / at the State, local, and even individual levels." Then a Coral Deep source label, tiny: "EO 14239, SEC. 1". Long hold, part of it unvoiced. 5. (42-50s) Clear everything. End card in Cormorant, three lines, the third warming to Coral Bright (moment 2 of 2): "The package is the gift." / "The citation is the job description." / "Read to the bottom." Footer in Manrope Light Ink: "CISA K-12 CYBERSECURITY FOUNDATIONS RESOURCE PACKAGE · AUG 12, 2026 · EO 14239 · 90 FR 13267". SignatureMark bottom-left: Italiana "Meschelle Peterson" + code63labs. Motion language: reading-pace — settles and fades, nothing bounces, nothing counts up. The eight should feel like an open hand; the citation should feel like a footnote that turns out to be the thesis.
FIRST SOURCE · one verified original-source finding, composed for one reader · this edition: cybersecurity — written for the people whose clients run school districts, and who would rather be early to the framing than early to the download