Cybersecurity 101: Creating Higher Standards for Higher Education

(Updated September 2026)

The consequences stopped being hypothetical some time ago.

• In February 2026, a ransomware attack took down the IT systems and electronic health record at the University of Mississippi Medical Center. Clinics closed across the state. Roughly 650 surgeries were delayed. Staff worked from paper charts, without Wi-Fi or phones, for nine days before systems came back on March 2.
• The financial picture arrived a few weeks later. UMMC finished the period $34.2 million under an expected $194.1 million in revenue, roughly 20 percent below budget, with year-to-date net income $8.6 million behind plan.
• Community colleges were hit in the same window, with less cushion to absorb it. Lehigh Carbon Community College in Pennsylvania lost more than a week of classes to an attack in March 2026. Days later, on March 9, the Community College of Beaver County had its data encrypted.

None of these institutions lacked a security team. What they lacked was the margin to absorb a systems outage in the middle of a term.

Institutions of higher education, and specifically community colleges, are excellent targets for hackers. The amount, variety, and sensitivity of data stored in their databases makes hacker mouths water. The usually decentralized aspect of the organization means there are more vulnerabilities to exploit. And the sheer number and variety of users on the system creates innumerable avenues for attack.

When EDUCAUSE published its 2026 Top 10, the number one issue was not a technology. It was Collaborative Cybersecurity: the recognition that security cannot live inside the IT department alone, and that it has to be built into how an institution already works rather than layered on top of it.

That framing is worth sitting with, because it changes what good looks like. A security program that depends on faculty remembering a training module degrades the moment attention moves elsewhere, and on a campus, attention always moves elsewhere. A security program built on hardened baselines does not. Once a system is configured to a CIS Benchmarks and held there, the protection lives in the configuration itself. Nobody has to remember anything.

That is the quiet argument for automated baseline enforcement in a collaborative security model. It is the part of the program that asks the least of everyone outside IT, and it is the part that holds up when the semester gets busy.

The endpoint estate grew and nobody logged it

Five of the ten issues on the 2026 EDUCAUSE Top 10 concern AI. Most of that conversation is about pedagogy and governance. There is an infrastructure version of it that gets far less attention.

Every AI tool a department adopts runs somewhere. A workstation, a server, a VM, a cloud instance. That system has a configuration, and the configuration is either hardened or it is not. On most campuses, departmental AI adoption has moved faster than the asset inventory, which means IT is now accountable for the security posture of an endpoint estate it did not choose and cannot fully enumerate.

The attack side is industrializing in parallel. IBM’s 2026 Cost of a Data Breach report found that more than a quarter of breaches now involve AI-driven attacks, a 56 percent increase year over year, and that AI involvement adds roughly $1 million to the average breach.

A training module is not an answer to that. Hardened baselines are, because they do not require knowing in advance which tool a department will adopt next. They require only that whatever it runs on is configured correctly and stays that way.

What changed for research institutions

On November 10, 2025, the 48 CFR final rule took effect, putting the CMMC clause into Department of Defense contracts. EDUCAUSE flagged the change directly for its membership. In July 2026 the Department suspended the move to CMMC Phase 2 and opened a reform review, which paused third-party assessments and left new solicitations able to require only self-assessment. It would be easy to read that pause as a reprieve. It is not. DFARS 252.204-7012 remains fully enforceable. NIST SP 800-171 is still the control set, still enforced through self-assessment and selective government-led assessment. Phase 1 self-assessments remain required, and the annual affirmation goes to SPRS signed by a named senior executive at the institution. What paused was the audit apparatus. What did not pause is the obligation, or the personal accountability attached to attesting to it.

A substantial share of those controls are configuration controls: what is installed, what is disabled, how systems are baselined, and whether they stay that way. On the defense side, STIGs are the mandated baseline standard. CIS Benchmarks are the framework most higher-education environments can realistically start from, and they map cleanly to the same control families.

The practical consequence is that a research university has two populations of systems. There are the ones inside a federal research perimeter, where someone is signing an annual attestation about their configuration. And there is everything else, where hardening is merely the most cost-effective control available.

Most institutions have not drawn that line yet. Drawing it is the first useful thing a research CIO can do this year, because it turns an abstract obligation into a scoped inventory, and because the person whose name goes on the attestation would probably like to know what they are attesting to.

Figuring out why higher ed is such an appealing target.

While still shaped by societal trends, so many aspects of higher education make it unique among regulated industries.

• The number and distribution of students, staff, faculty, and service providers.
• The online and hybrid aspect of course delivery.
• The amount and sensitivity of research.
• The hierarchy needed to create change.
• The number of legacy apps and systems.
• And the existing overall state of cybersecurity readiness.

Exacerbating this situation are a lack of information sharing and significant underreporting of incidents, though that is changing in some states. Add it all up, and each of these unique aspects translates to multiple vulnerabilities bad actors can exploit.

Creating cyber resilience by meeting CIS Benchmarks or STIG standards.

The two most prevalent cybersecurity standards in regulated industries are STIG and CIS Benchmarks. Both provide detailed lists of areas that need to be addressed (known as “controls”) to fortify your servers and workstations. Security Technical Implementation Guides (STIGs) were created by the Defense Information Systems Agency (DISA).

CIS Benchmarks are consensus configuration standards, developed and maintained by the Center for Internet Security with input from practitioners worldwide, covering more than 25 vendor product families. The related CIS Critical Security Controls reached v8.1 in June 2024, which added a Governance function and mapped the framework’s 153 safeguards to NIST CSF 2.0. Here is the part that matters operationally, and that most institutions discover the hard way. The Benchmarks are not static. CIS publishes updates monthly. A system hardened by hand in June is being measured against a different standard by September, and nobody sent an email about it. Add ordinary patch cycles, image refreshes, and a few well-meaning local admin changes, and configuration drift does the rest. This is why hardening is not a project with a finish line. It is a sustainment problem. Manual programs do not fail at the initial hardening pass, which is merely tedious. They fail in month four, when the baseline has quietly moved and nobody has the hours to chase it.

Meeting either one of these standards will put your systems on par with the system hardening used to protect our nation’s most sensitive data. But just because you’re aligning with standards doesn’t mean it’s easy. When done traditionally/manually, it can take months of hair-pulling effort to achieve a secure baseline. And then monthly or quarterly updates are released and you have to do it again. Meanwhile, you’ll need reports to document your compliance for auditors. It becomes an all-encompassing job where you are constantly struggling to keep up. Which is why everyone from government agencies to higher ed is looking at automation.

Seeing how all this works in an actual implementation.

In one community college system, more than 20 colleges sit under a single system office, and the IT reality behind that number varies enormously. Some campuses field substantial IT teams. Others rely on a single professional handling user support, networking, server administration and security. The system had been running ISO 27000 as its security framework, using Tenable for vulnerability scanning, and remediating more than 900 endpoints, mostly Windows servers and workstations, by hand. Then they scanned that environment against CIS Benchmarks. The result came back at 40 percent alignment. In practical terms, too many default settings were still enabled, and every default left on is one more way in. The system office needed a stricter baseline across all 20-plus campuses without handing more manual work to teams that had none to spare, and it needed centralized visibility into colleges that each carried their own requirements, exceptions and policy variations.

The system moved to CIS Benchmarks as its framework. The appeal was practical: a consensus-based standard, widely used across higher education, that spells out which services and settings to turn off and how to do it. More to the point, it can be enforced automatically. That matters when the alternative is asking a one-person IT shop to work through hundreds of settings on hundreds of machines, then do it again after the next round of benchmark updates. To automate it, they chose SteelCloud’s ConfigOS MPO, which scans, remediates, verifies and reports from a single dashboard. That gave the system office something it had not had before: one place to see baseline posture across every campus, with room for the local exceptions each college legitimately needed.

Making sure you’re ready when hackers come knocking.

Like many other highly regulated industries, the higher education sector is looking to increase their cybersecurity posture amidst constant threats. Many are doing that by adopting proven compliance standards like CIS Benchmarks or STIGs, whether mandated or not. The staffing math does not work either and it is not going to start working. The roles a mid-size institution would need to fill to harden and sustain thousands of endpoints by hand are the same roles it is bidding against federal agencies, defense integrators, and every hospital system in the state to fill. Salaries in that market are not set by what a community college can pay. They are set by what a defense contractor will pay.

So the question is not how to staff the manual work. A higher-ed IT department is not going to out-hire a defense integrator, and it should not have to. The question is how to stop the work from being manual.

The solution of choice is automation, automating the processes of scanning, remediation and reporting, while enabling hardening at scale. SteelCloud’s ConfigOS platform makes it possible. Schedule a demo and see how to strengthen your security posture.