New York's State Education Department received 662 data incident reports from 366 educational agencies in 2025, up 72.4 percent from the year before, and its Chief Privacy Officer tied most of the 221 reports that cited an outside breach or hacking to one vendor incident, the PowerSchool breach (NYSED, 2025 annual report). Across the country, the FCC's Schools and Libraries Cybersecurity Pilot drew 2,734 applications asking for an estimated US$3.7 billion against a three-year, US$200 million budget (FCC Public Notice DA 25-53). Penetration testing is one of the services the Pilot pays for, yet USAC's own funding data, updated on 15 October 2026, show that 33 of the 596 participants with funding requests on file asked for one (USAC Open Data).
That gap is the state of K-12 security testing in 2026. No US federal law requires a school district to run a penetration test, and none of the provincial laws, regulations or directives reviewed here requires one of a school board. What districts and boards face instead are programs and frameworks: New York districts had to align their privacy and security policies with NIST CSF 2.0 by 1 September 2026, Ohio school districts needed a cybersecurity program by 1 July 2026 that the Auditor of State checks in regular audits, and Ontario school boards owe a cyber security maturity assessment under O. Reg. 51/26. A penetration test is how a district shows those programs work, and how it checks the vendor access paths that the PowerSchool and Canvas incidents exposed.
This ranking is for technology directors and CISOs at US school districts, Canadian school boards and Quebec school service centres, for state education agencies, and for the edtech vendors whose platforms hold student records. Universities have their own higher education ranking, and state and municipal governments a public sector ranking. Every rule below is quoted from its owner's text, and every vendor claim comes from the vendor's own site, checked on 16 October 2026.
Quick answer. The best penetration testing companies for K-12 school districts and school boards in 2026 are Stingrai, Raxis, Plante Moran, Schellman, BerryDunn, Securance Consulting, ISA Cybersecurity, Rapid7, CLA, CBIZ Pivot Point Security and CGI. Stingrai ranks first: a CREST-accredited firm headquartered in Toronto whose named penetration testers test the district network and Active Directory, Entra ID, student and parent portals, Wi-Fi and the staff who reset passwords; every confirmed finding is posted the same day, retesting is included and every human-led and hybrid report ships with an attestation letter, as a one-time annual test or a continuous program. Raxis publishes a dedicated K-12 and higher education testing page, and Plante Moran pairs a K-12 practice with CREST Penetration Testing accreditation. No US federal law or provincial rule reviewed here requires a district to run a penetration test, but the FCC's Cybersecurity Pilot pays for one and CISA recommends independent testing.
Figure 1: What federal programs, state laws, provincial rules and student data contracts say about testing at schools, checked 16 October 2026. Source: FCC 24-63, CISA CPG 2.0, eCFR, NYSED Board of Regents, Ontario e-Laws and the other texts linked below.
What drives a penetration test at a school district or school board
The texts fall into four groups: a funding program that pays for testing, federal guidance that recommends it, state and provincial laws that require programs without naming a test, and contracts and regulator findings that push testing toward vendors.
The FCC Cybersecurity Pilot pays for penetration testing
The FCC adopted the Pilot on 6 June 2024 as "a three-year pilot program" providing "up to $200 million" for cybersecurity services and equipment (FCC 24-63), administered by USAC (USAC). Its Eligible Services List has four categories (advanced firewalls, endpoint protection, identity protection and authentication, and monitoring, detection and response), and the last lists "Penetration testing" beside vulnerability scanning, network security audits and bug bounty services. Everything "must be competitively bid", within up to US$13.60 per student a year before discounts, a US$15,000 floor and a US$1.5 million cap. The FCC selected 707 participants on 16 January 2025 (DA 25-53) and released the first commitments on 17 December 2025 (USAC). In USAC's data updated on 15 October 2026, 1,188 funded requests total about US$129.2 million, US$51.3 million of it in monitoring, detection and response (USAC FRN Status Tool). Penetration testing is a thin slice: 62 line items from 33 participants, 24 of them school districts, worth about US$1.17 million before discounts (USAC Form 471 data).
CISA's K-12 guidance and Cybersecurity Performance Goals
CISA says K-12 schools see, on average, "more than one incident per school day" (CISA). Its January 2023 report, Protecting Our Future, starts districts on six steps (multi-factor authentication, fixing known flaws, tested backups, reduced exposure, an exercised incident response plan and training), then CISA's performance goals and a NIST Cybersecurity Framework plan (CISA report). Goal 2.C of the voluntary CPG 2.0, published in December 2025, says: "Organizations regularly engage third-party cybersecurity experts to validate their defenses through various exercises, such as penetration tests, bug bounties, incident simulations, and table-top exercises" (CISA CPG 2.0). For purchasing, CISA's K-12 acquisition guidance says districts "should require all product vendors to establish a program to test software and detect and fix vulnerabilities prior to customer deployment" (CISA). K12 SIX calls its Essentials series "baseline cybersecurity standards for U.S. school districts"; the documents are distributed through a sign-up form, so we do not quote them (K12 SIX).
FERPA and student data privacy agreements
FERPA lets a district treat a contractor as a school official only if it "is under the direct control of the agency or institution with respect to the use and maintenance of education records", and requires districts to "use reasonable methods" to limit access to education records (34 CFR 99.31). It names no test. Version 2.2 of the Student Data Privacy Consortium's National Data Privacy Agreement says the vendor "will conduct a security audit or assessment no less than once per year, and upon a Data Breach", shares the report on request, and gives 72 hours' notice of a confirmed breach (SDPC NDPA v2.2); the consortium says it supports more than 222,000 signed agreements across 13,000+ districts (A4L).
New York: Education Law 2-d and Part 121
Education Law 2-d requires standards that include "data systems monitoring, data encryption, incident response plans, limitations on access to personally identifiable information", and a "data security and privacy plan" in every contract that shares student data. Its regulation, 8 NYCRR Part 121, adopts the NIST Cybersecurity Framework; an amendment effective 25 February 2026 says each agency's policy "shall align with the NIST CSF 2.0 no later than September 1, 2026" (Board of Regents, adopted on the February 2026 consent agenda). Part 121 also requires a Data Protection Officer, contractors aligned with the framework, and contractor breach notice "no more than seven calendar days after the discovery" (Part 121). Neither names a penetration test, but CSF 2.0's subcategory ID.IM-02 reads "Improvements are identified from security tests and exercises, including those done in coordination with suppliers and relevant third parties" (NIST CSF 2.0).
Texas and Ohio
Under Texas Education Code section 11.175, "Each school district shall adopt a cybersecurity policy to: (1) secure district cyberinfrastructure against cyber attacks and other cybersecurity incidents; and (2) determine cybersecurity risk and implement mitigation planning." The superintendent designates a cybersecurity coordinator, and breaches are reported "as soon as practicable after the discovery". Ohio's section 9.64, effective 30 September 2025, says a political subdivision "shall adopt a cybersecurity program" consistent with the NIST framework or CIS best practices, reports incidents within seven and 30 days, and pays a ransom only by resolution or ordinance. The Auditor of State says it covers "school districts", that their programs were due by 1 July 2026, and that it "will check compliance during regular audits" (Ohio Auditor of State). Neither statute names a penetration test.
Ontario: O. Reg. 51/26, O. Reg. 52/26 and MFIPPA
O. Reg. 51/26, in force since 1 July 2026 under the Enhancing Digital Security and Trust Act, 2024, names "A school board" among the bodies that "shall develop and implement a program for ensuring cyber security". Each board completes "an initial cyber security maturity assessment no later than one year after the day this Regulation first applies", then at least every two years, files a summary with the ministry within 30 business days, and reports critical incidents "no later than 72 hours" after confirming them. The province's guidance says assessments "should align with NIST CSF 2.0", sets 1 July 2027 for boards without a recent one, and allows "an external vendor or third-party to conduct a CMA" (Ontario guidance); neither mentions penetration testing. O. Reg. 52/26 adds a school-board duty: when student data will go to "a third party owner or operator of a software application", parents get written notice of the data elements, the purpose and "The name of the software application and the third party owner or operator". Boards are also MFIPPA institutions, whose regulation requires "reasonable measures to prevent unauthorized access to the records" (Reg. 823, s. 3), and since 1 July 2026 MFIPPA section 52(7) says the Act does not apply to cyber security assessments prepared under the 2024 Act or to records naming the third-party applications a board has acquired (MFIPPA).
British Columbia and Quebec
British Columbia's FIPPA treats a board of education as an educational body and a service provider as an "employee" (Schedule 1); section 30 requires "reasonable security arrangements" and section 36.2 a privacy management program (FIPPA, Part 3). On 29 November 2024, "In light of recent cyberattacks", the ministry pointed districts to its Being Cyber Secure in K-12 checklist, whose ten points include MFA, extended detection and response, air-gapped backups and "Strengthen your network to restrict attackers if they do get through" (Deputy Minister's Bulletin). None is a penetration test, but segmentation is what a test checks.
Quebec's school service centres are public bodies under the Act respecting access to documents: section 63.1, added in 2006, requires security measures "reasonable given the sensitivity of the information", and Law 25 (S.Q. 2021, c. 25) added section 63.8 on confidentiality incidents. They are also bound by the government's information security directive (G-1.03, s. 2). Its January 2014 version required intrusion and vulnerability tests "annuellement ou à la suite d'un changement majeur", according to the government's testing guide; the directive in force since 8 December 2021 has no such clause and requires a security policy, training, a register of security events and compliance with the government security chief's instructions.
What PowerSchool and Canvas changed about third-party testing
On 28 December 2024, PowerSchool "became aware of a cybersecurity incident involving unauthorized exfiltration of personal information from certain PowerSchool Student Information System (SIS) environments through one of our community-focused customer support portals, PowerSource", and its summary of CrowdStrike's report cites "a single compromised credential" (PowerSchool). Alberta's privacy commissioner found the credentials belonged to a contractor with administrative privileges, that PowerSource lets a support technician reach customer SIS databases "for maintenance purposes", and that the access used no multi-factor authentication, below "reasonable security arrangements" (OIPC Alberta, Investigation Report F2025-IR-02, 17 November 2025). PowerSchool had given that office a SOC 2 Type 2 report for July 2023 to June 2024 and a June 2024 summary of a crowd-sourced penetration test. On 18 November 2025 the Ontario and Alberta commissioners reported that some or all of the educational bodies they examined "lacked policies and procedures to effectively monitor and oversee PowerSchool's technical and security safeguards", including remote support access and multi-factor authentication, and "failed to limit remote access to their student information systems" (joint release).
On 29 April 2026, Instructure detected unauthorized activity in Canvas; on 7 May the same actor "gained additional access through a second Canvas vulnerability", both times through "one of our Free-For-Teacher accounts", and Instructure says it "remediated the vulnerabilities and privilege escalation paths used" (Instructure). The lesson for districts is that a vendor's SOC 2 report and test summary describe the vendor's controls, not the district's access paths: a district test should cover vendor support and maintenance accounts, rostering and export integrations, and the multi-factor authentication on each, with the vendor's written agreement. For edtech vendors, Canvas is a reason to test tenant isolation, free and trial account paths and privilege escalation (multi-tenant SaaS scope).
What school districts and school boards need from a vendor
Figure 2: Where to point a district penetration test, Stingrai scoping guidance (editorial) built on the rules and incidents above. Source: CISA, OIPC Alberta, BC Ministry checklist.
The student information system and its vendors. Student, parent and staff portals tested role by role for broken authorization and IDOR on student records, plus vendor support and remote maintenance accounts, export tools and rostering integrations, scoped with the vendor.
Identity. Active Directory attack paths to domain admin, Entra ID or Google identity, multi-factor authentication coverage, and the help desk process that resets passwords.
Microsoft 365 or Google Workspace. Third-party app grants, sharing defaults and mailbox takeover paths. K12 SIX publishes separate guidance on mitigating compromised K-12 Google Workspace and Microsoft 365 for Education accounts.
Campus networks. The wide area network across schools, student, staff and guest Wi-Fi, and the segmentation that keeps a student device away from finance, HR and student records.
Buildings and buses. Building automation, cameras, door access and transportation systems, tested without disrupting them and only with the facilities team present.
People. Phishing and vishing aimed at finance, payroll and the help desk.
Calendar and data handling. Testing outside exam weeks and enrollment peaks, synthetic student records, agreed evidence storage, named testers, and any background checks the district requires for on-site work.
Independence. Several firms below are also CPA firms that audit school districts; confirm independence if the firm audits your financial statements.
How this ranking was built
Every claim about a firm traces to its own website, or to its CREST Marketplace profile, checked on 16 October 2026. Two gates decided inclusion:
A named penetration testing service, with its scope described on the firm's own site.
A school or public sector page on the firm's own site: K-12, education, or state, local or provincial government.
Firms that passed both were ordered by six weighed criteria, in this priority, with ties broken by how directly the firm's own pages address schools:
School specificity: a K-12 page that describes testing school environments scores highest, then a K-12, education or state, local and education (SLED) page, then a public sector page without education.
Checkable accreditation: CREST Penetration Testing for the entity named on marketplace.crest.org.
Procurement access: cooperative or public contracts named on the firm's own pages.
Coverage of the district surface: networks and identity, applications, wireless, people, and building or OT systems.
Retesting stated on the firm's own pages.
Published pricing.
Stingrai, which publishes this guide, ranks first. NetSPI, Coalfire, Sprocket Security, TrustedSec, Praetorian and Cobalt failed the second gate, as explained under Also considered.
At a glance: penetration testing companies for K-12 school districts and school boards
Rank | Firm | Head office | School or public sector page | CREST Penetration Testing | Best for |
|---|---|---|---|---|---|
1 | Stingrai | Toronto, Canada | Public sector guide; services across network, identity, apps, Wi-Fi, people | Yes (Stingrai Inc) | Named testers, published prices, annual or continuous |
2 | Raxis | Atlanta, Georgia | K-12 and higher education testing page | No | Testing written around school networks |
3 | Plante Moran | Southfield, Michigan | K-12 practice, 200+ educational institutions | Yes | Microsoft 365 and network testing from a K-12 adviser |
4 | Schellman | Tampa, Florida | Education page (higher education) | Yes (Schellman Compliance LLC) | Segmentation and Active Directory testing |
5 | BerryDunn | Portland, Maine | K-12 page, IT assessments for districts | No | Cooperative contracts, no technology resale |
6 | Securance Consulting | Tampa, Florida | State, local and education page | No | Cameras, door access and building controls |
7 | ISA Cybersecurity | Toronto, Canada | Government page naming educational institutions | No | Canadian school boards, Canadian data residency |
8 | Rapid7 | Boston, Massachusetts | State, local and education page | No | Districts already on Rapid7's platform |
9 | CLA | Minnesota LLP, 120+ US locations | School district practice | No | Districts already working with CLA |
10 | CBIZ Pivot Point Security | Hamilton, New Jersey | Government page | Yes | State education agencies |
11 | CGI | Montréal, Canada | Municipal cybersecurity page | UK entity only | Continuous validation for large boards |
1. Stingrai (top rated for K-12 school districts and school boards)
Stingrai is a global CREST-accredited penetration testing services company founded in Toronto, Canada in 2021, trusted by companies from startups to enterprises to meet audit requirements for SOC 2, ISO 27001, CMMC, PCI DSS and HIPAA. OSCE³, OSWE, OSEP, CREST CRT certified pentesters, who are also world-class security researchers and bug bounty hunters. Choose from fully human-led or hybrid (AI agents plus human penetration testers) engagements across web, API, mobile, AI and LLM, cloud, network, Active Directory and social engineering penetration tests and red team engagements.
For a district or school board, the case is named, certified testers on the whole estate rather than one website. Stingrai Inc, which signs the contract, holds the CREST Penetration Testing accreditation (Marketplace profile) and is one of four suppliers with a Canadian head office on the CREST Marketplace as of 16 October 2026. Each human-led engagement is run by two named penetration testers from a team holding OSCE³, OSWE, OSEP, CREST CRT and CISSP certifications, reviewed by the team lead and an engagement partner, and the team has 18 published CVEs.
Scope for a district or school board
Network and identity: internal and external network testing across campuses, segmentation between student and administrative networks, Active Directory attack paths to domain admin, and Entra ID app registrations, consent grants and Conditional Access gaps (cloud testing).
Applications: student, parent and staff portals and district-built applications tested across every role for broken authorization, IDOR and business logic (web application testing), and mobile apps where a district publishes one.
Wi-Fi and people: Wi-Fi assessments on site or remotely, phishing and vishing of finance, payroll and help desk staff, and physical security assessments where the district authorizes them.
Delivery and evidence
Whether the engagement is a one-time annual test or a continuous program, every confirmed finding, at every severity, is posted to the PTaaS platform the same day it is confirmed, with a working proof of concept and prioritized remediation guidance. Retesting of remediated findings is included, and every human-led and hybrid report ships with an attestation letter: pentest evidence for a district's NIST CSF 2.0 alignment under Part 121, a board's O. Reg. 51/26 maturity assessment, and the questions trustees and auditors ask. On-site access and any background checks are agreed at scoping.
Where Snipe fits
Snipe is Stingrai's autonomous AI agent for web applications and associated APIs only, such as a parent portal or a district-built application. Trained on more than 6,000 HackerOne Hacktivity reports, it hunts IDOR, broken authorization and business logic flaws and opens AutoFix pull requests. The Autonomous Pentest is Snipe alone, with no penetration testers; in the Hybrid Pentest, Snipe and penetration testers test together throughout. The network, identity, Wi-Fi and people work is human-led.
Pricing and fit: The Autonomous Pentest is US$3,000 per assessment or US$650 per month on a 12-month plan, and the Hybrid Pentest is US$6,800 per assessment or US$1,275 per month; both cover one web application and associated APIs (pricing). District-wide scopes are quoted through get a quote. Best for: districts and boards that want named, certified testers from a CREST-accredited firm across the network, identity, portals and people, with a Canadian contracting entity for school boards, as a one-time annual test or a continuous program.
2. Raxis
Raxis was founded in Atlanta in 2011 by Mark Puckett (company, contact). Its education testing page, titled for "K-12 & Higher Ed", starts testing "on the student Wi-Fi", uses lateral movement to confirm that "a compromised student device can't reach FERPA-protected records", covers learning management systems, student portals and "EdTech integrations", and schedules work around "academic calendars, enrollment periods, and class schedules". Reports map to FERPA, and its continuous service adds "unlimited retesting through the Raxis One portal". The page lists OSCP, CEH, GPEN and GFACT among its testers' certifications. Raxis has no entry on the CREST Marketplace.
Best for: districts that want a testing team whose own pages are written around school networks, with continuous retesting.
3. Plante Moran
Plante Moran moved its corporate headquarters to the Southfield Town Center in Michigan in June 2021 (announcement) and says it serves "more than 200 educational institutions, including K-12 districts" (K-12 practice). Its penetration testing practice covers internal and external networks, web, mobile and API reviews, cloud, a "Microsoft 365 security configuration assessment", wireless, ransomware simulation, and social engineering that includes "phone and text scams". It announced CREST accreditation in February 2025, and its Marketplace entry lists Penetration Testing. The firm also performs "more than 600 single audits annually, serving school districts", so a district it audits should check independence first.
Best for: districts that want CREST-accredited testing, including Microsoft 365, from a firm with a K-12 practice.
4. Schellman
Schellman lists its address on West Boy Scout Boulevard in Tampa (about). Its education page is aimed at higher education and research ("securing your student's and institution's data") and introduces its penetration test team, whose testing services cover web applications and APIs, internal, external and wireless networks with "network segmentation testing", mobile apps, Active Directory, and red and purple teaming. Its CREST Penetration Testing accreditation is held by Schellman Compliance, LLC (Marketplace), which provides "nonattest" services, while Schellman & Company, LLC is the licensed CPA firm that provides attest services.
Best for: large districts and education service agencies that want CREST-accredited segmentation and Active Directory testing.
5. BerryDunn
BerryDunn, founded in 1974, has its national headquarters at 2211 Congress Street in Portland, Maine (announcement, locations). Its K-12 page says its team has performed IT assessments for multiple K-12 districts and that "we refrain from partnerships with technology providers". Its cybersecurity services include internal and external penetration testing in white, gray and black box modes, application testing for "authentication, data handling, and access controls", phishing simulations and advanced persistent threat simulation. Its contract vehicles page lists OMNIA Partners, TIPS and NASPO ValuePoint cooperative contracts. BerryDunn has no entry on the CREST Marketplace.
Best for: districts that want testing from a K-12 consultant with no technology resale ties, bought through a cooperative contract.
6. Securance Consulting
Securance has served clients since 2002 (about) and lists its office in Tampa (contact). Its state, local and education page cites "22+ years serving government agencies" and staff "each with more than 15 years of public sector experience", and links City of Tucson contract 240160-10 through its partnership with Axia. Its penetration testing covers external, internal, application, API, mobile and wireless testing, IoT devices including IP cameras, badge readers and "building automation controllers", and ICS and OT environments. Securance has no entry on the CREST Marketplace.
Best for: districts that want cameras, door access and building controls in scope, bought through a cooperative contract.
7. ISA Cybersecurity
ISA Cybersecurity was founded in Toronto in 1992 and keeps its head office there (about, contact). Its government page lists "Public Health and Educational Institutions" among the bodies it serves, cites "200+ public sector clients" and "Canadian data residency and data centres", and names Ontario's Tender-17543 for IT security products and services. Its penetration testing covers internal testing that simulates "a rogue employee or a compromised account", external, wireless, mobile and web testing, and red and purple teams. ISA has no entry on the CREST Marketplace.
Best for: Canadian school boards that want a Canadian firm with Canadian data residency.
8. Rapid7
Rapid7 dates its releases from Boston (release). Its state, local and education page says it "helps state, local, and educational (SLED) entities", and in June 2026 it announced GovRAMP Authorization covering its vulnerability management, cloud security and security automation products for state, local and educational organizations. Its separate penetration testing services cover external and internal networks, web applications, social engineering and wireless networks; its published public school district story describes managed detection and response rather than a test. Rapid7 has no entry on the CREST Marketplace.
Best for: districts already on Rapid7's platform that want testing from the same vendor.
9. CLA
CLA (CliftonLarsonAllen) is "a Minnesota LLP, with more than 120 locations across the United States", and its school district practice lists "Protecting against threats to data, privacy, and system security" among district challenges. Its penetration testing looks for ways "to chain multiple vulnerabilities together to identify high risks" and invites the client's team to follow along during planned attacks. The same page lists audits of financial statements among its district services, so check independence if CLA audits yours. CLA has no entry on the CREST Marketplace.
Best for: districts that already work with CLA and want testing from a firm that knows their operations.
10. CBIZ Pivot Point Security
Pivot Point Security, part of CBIZ, has its headquarters in Hamilton, New Jersey (locations) and has provided security testing services "since 2001" (penetration testing). Its government page offers "Vulnerability Assessments and Penetration Tests" for agencies, and its Marketplace entry lists Penetration Testing and ISO 27001. It publishes no K-12 page.
Best for: state education agencies that want a CREST-accredited firm with government experience.
11. CGI
CGI, founded in 1976, dates its Canadian releases from Montréal (release) and calls itself "the full-lifecycle cybersecurity partner for municipalities across Canada" (municipal page). Its continuous offensive security validation "combines autonomous pentesting, offensive security expertise and practical remediation support", covers Entra ID and Active Directory password security and hybrid identity, retests fixes, and draws on "hundreds of security experts across 30 offices in Canada"; the autonomous part runs on Horizon3.ai's NodeZero (CGI). Its CREST listing belongs to CGI IT UK Ltd, and it publishes no school board page.
Best for: large school boards that want continuous validation from a Canadian integrator.
Also considered
NetSPI, Coalfire, Sprocket Security, TrustedSec and Praetorian sell penetration testing, but we found no K-12, education or state and local page on their sites when we checked, so they failed the second gate. Cobalt publishes a customer story on testing PowerSchool's AI learning assistant, which is useful for edtech vendors, but no education page.
How districts and school boards buy a penetration test
FCC Pilot participants run the Pilot's own competitive bidding, which USAC describes as a minimum 28-day window after the Pilot FCC Form 470 is certified (USAC).
Cooperative contracts. BerryDunn lists OMNIA Partners, TIPS and NASPO ValuePoint, and Securance links City of Tucson contract 240160-10. Confirm that the line covers penetration testing and that your state lets districts use it.
Ontario school boards can buy through the OECM vulnerability assessment and penetration testing agreement, which lists school boards among eligible sectors and seven supplier partners: 3Tenets Consulting, BDO Canada, Bell Canada, CDW Canada, Computacenter Canada, IBM Canada and iVedha. It expires on 30 January 2027 with "no further extension periods remaining", so boards planning tests for 2027 should expect a new route.
Records. In Ohio, records related to the cybersecurity program are not public records under 9.64(E); in Ontario, MFIPPA section 52(7) puts assessments prepared under the Enhancing Digital Security and Trust Act outside the Act. Ask counsel whether a test report that feeds those programs is covered before it is filed.
Statement of work. A precise statement of work and RFP question bank keep a competitive process technical.
What a K-12 penetration test costs
No rule sets a price; cost follows the campuses, network segments, identity systems, applications and people in scope, plus the retest. Two public reference points exist. The Pilot budgets up to US$13.60 per student a year before discounts, between a US$15,000 floor and a US$1.5 million cap, and in USAC's data the funded line items labelled penetration testing had a median of US$10,915 per line item before discounts, with the largest at US$85,845 (USAC Form 471 data); those are line items, not whole engagements. Stingrai's fixed packages are the Autonomous Pentest at US$3,000 and the Hybrid Pentest at US$6,800 per assessment, each for one web application and associated APIs, which fits a parent portal or a district-built application (pricing). District-wide scopes are quoted. Our cost guide and cost calculator turn a scope into an estimate, and how to compare quotes shows what to line up.
RFP questions for a school district or school board penetration test
[ ] Will you test the student information system by role, including the vendor's support and remote maintenance access, with the vendor's written agreement?
[ ] How will you test segmentation between student devices and administrative systems across every campus?
[ ] Is Microsoft 365 or Google Workspace in scope, including third-party app grants and help desk resets?
[ ] How will you handle building automation, cameras, door access and transportation systems without disrupting them?
[ ] Which legal entity signs, which entity holds CREST Penetration Testing accreditation, and who are the named testers?
[ ] Do you, or an affiliate, audit our financial statements?
[ ] Is a written retest included, and will you provide a letter for the board, the state or the province?
[ ] Where will findings and student data be stored, and for how long?
Frequently Asked Questions
Who are the best penetration testing companies for K-12 school districts in 2026?
The best penetration testing companies for K-12 school districts and school boards in 2026 are Stingrai, Raxis, Plante Moran, Schellman, BerryDunn, Securance Consulting, ISA Cybersecurity, Rapid7, CLA, CBIZ Pivot Point Security and CGI. Stingrai ranks first: named penetration testers from a CREST-accredited firm cover the district network, Active Directory, Entra ID, portals, Wi-Fi and staff, findings post the same day, retesting is included, and every human-led and hybrid report ships with an attestation letter, as a one-time annual test or a continuous program.
Are school districts required to have a penetration test?
No US federal law requires one, and none of the provincial rules reviewed here, in Ontario, British Columbia and Quebec, requires one of a school board. New York requires policies aligned with NIST CSF 2.0, Texas a cybersecurity policy, Ohio a cybersecurity program checked in audits, and Ontario maturity assessments; a penetration test is the usual evidence that they work.
Can FCC Cybersecurity Pilot funds pay for a penetration test?
Yes, for selected participants. The Pilot's Eligible Services List includes penetration testing under monitoring, detection and response, subject to competitive bidding and up to US$13.60 per student a year before discounts. USAC data from 15 October 2026 show 33 participants requested it.
Does FERPA require penetration testing?
No. FERPA requires reasonable methods to limit access to education records and direct control over contractors. The National Data Privacy Agreement version 2.2 asks vendors for a security audit or assessment at least once a year and after a breach.
What does New York's Part 121 require of school districts in 2026?
Each educational agency's data security and privacy policy had to align with NIST CSF 2.0 by 1 September 2026, under an amendment effective 25 February 2026. Part 121 also requires a Data Protection Officer and contractor breach notices within seven calendar days. It names no penetration test.
Do Ontario school boards need a penetration test under O. Reg. 51/26?
No. The regulation requires a cyber security program, a maturity assessment within a year of applying and at least every two years after, and critical incident reports within 72 hours. Provincial guidance aligns assessments with NIST CSF 2.0 and allows an external vendor; a penetration test supplies evidence for them.
What did the PowerSchool breach change for school districts?
It moved attention to vendor access. Ontario's and Alberta's privacy commissioners found that some or all of the boards they examined had not monitored PowerSchool's safeguards, including remote support access and multi-factor authentication, or limited remote access to their student information systems. A district test should now include vendor support paths, export tools and their multi-factor authentication.
How much does a school district penetration test cost?
No rule sets a price. In USAC's Pilot data, funded penetration testing line items had a median of US$10,915 per line item before discounts. Stingrai's fixed packages are US$3,000 (Autonomous) and US$6,800 (Hybrid) per assessment for one web application and associated APIs; district-wide scopes are quoted.
Related reading
Best Penetration Testing Companies for Government and the Public Sector (2026)
CREST-Accredited Penetration Testing Companies in the USA and Canada (2026)
References
Federal Communications Commission. Schools and Libraries Cybersecurity Pilot Program, Report and Order (FCC 24-63). 11 June 2024. https://docs.fcc.gov/public/attachments/FCC-24-63A1.pdf. Pilot duration, US$200 million cap, per-student budgets and the Eligible Services List (Appendix B).
Federal Communications Commission. Public Notice DA 25-53. 16 January 2025. https://docs.fcc.gov/public/attachments/DA-25-53A1.pdf. Selection of 707 participants from 2,734 applications seeking an estimated US$3.7 billion.
Universal Service Administrative Company. Cybersecurity Pilot Program page, newsletters and Open Data (FRN Status Tool and Pilot FCC Form 471), data updated 15 October 2026. https://www.usac.org/e-rate/cybersecurity-pilot-program/. Commitments, categories and penetration testing line items totalled from USAC's own datasets.
Cybersecurity and Infrastructure Security Agency. Protecting Our Future: Partnering to Safeguard K-12 Organizations from Cybersecurity Threats. January 2023. https://www.cisa.gov/sites/default/files/2023-01/K-12report_FINAL_V2_508c.pdf. Six priority steps and stakeholder findings.
Cybersecurity and Infrastructure Security Agency. Cross-Sector Cybersecurity Performance Goals 2.0. December 2025. https://www.cisa.gov/sites/default/files/2025-12/CPG_Report_2.0_508c.pdf. Goal 2.C on independent validation.
Cybersecurity and Infrastructure Security Agency. Cybersecurity Guidance for K-12 Technology Acquisitions. August 2023. https://www.cisa.gov/sites/default/files/2023-08/K-12_Acquisition_Guidance.pdf. Vendor testing, MFA and RBAC requirements for district purchasing.
eCFR. 34 CFR 99.31 (FERPA). Current to 14 October 2026. https://www.ecfr.gov/current/title-34/section-99.31. School official exception and reasonable methods.
Student Data Privacy Consortium (Access 4 Learning). National Data Privacy Agreement, version 2.2 (file dated 19 November 2025). https://files.A4L.org/privacy/NDPA/NDPA_v2-2_STANDARD_WEB.pdf. Vendor security audit, breach notice and framework terms.
New York State. Education Law 2-d. https://www.nysenate.gov/legislation/laws/EDN/2-D. Data security standards, contractor plans and breach notice.
New York State Board of Regents. Amendment of 8 NYCRR 121.1, 121.4 and 121.5 (NIST CSF 2.0), adopted February 2026; Part 121 as adopted in 2020. https://www.regents.nysed.gov/sites/regents/files/226brca2.pdf. CSF 2.0 alignment by 1 September 2026; contractor and breach rules.
New York State Education Department. Chief Privacy Officer's 2025 Annual Report on Data Privacy & Security. March 2026. https://www.nysed.gov/sites/default/files/programs/data-privacy-security/2025-data-privacy-and-security-annual-report.pdf. Incident reports by cause, including PowerSchool.
Texas Legislature. Education Code 11.175, School Cybersecurity. https://statutes.capitol.texas.gov/Docs/ED/htm/ED.11.htm. Policy, coordinator and breach reporting.
Ohio Legislative Service Commission and Ohio Auditor of State. Revised Code 9.64 and Cybersecurity Program FAQ. https://ohioauditor.gov/fraud/cybersecurity-policy.html. Program duty, reporting windows and audit checks for school districts.
Government of Ontario. O. Reg. 51/26 (Cyber Security) and O. Reg. 52/26 under the Enhancing Digital Security and Trust Act, 2024, with implementation guidance. https://www.ontario.ca/laws/regulation/r26051. Programs, maturity assessments, 72-hour reports and third-party software notices.
Government of British Columbia. Freedom of Information and Protection of Privacy Act and the Being Cyber Secure in K-12 checklist. https://www.bclaws.gov.bc.ca/civix/document/id/complete/statreg/96165_03. Security arrangements and the ministry's ten points.
Government of Quebec. Act respecting access to documents held by public bodies (A-2.1) and Directive gouvernementale sur la sécurité de l'information (2021). https://www.legisquebec.gouv.qc.ca/en/document/cs/A-2.1. Security measures, confidentiality incidents and the directive in force.
NIST. The NIST Cybersecurity Framework (CSF) 2.0. 26 February 2024. https://nvlpubs.nist.gov/nistpubs/CSWP/NIST.CSWP.29.pdf. Subcategories ID.IM-02 and ID.RA-01.
PowerSchool. Cybersecurity Incident notices. https://www.powerschool.com/security/sis-incident/. Incident timeline and CrowdStrike findings summary.
Office of the Information and Privacy Commissioner of Alberta. Investigation Report F2025-IR-02 (17 November 2025) and joint release with Ontario's commissioner (18 November 2025). https://oipc.ab.ca/ontario-and-alberta-privacy-commissioners-release-investigation-findings-into-powerschool-breach-affecting-school-boards-and-other-educational-bodies/. Findings on contracts, vendor oversight, remote access and MFA.
Instructure. Security Incident Update & FAQs. 2026. https://www.instructure.com/incident_update. Canvas incident timeline and remediation.
OECM. Vulnerability Assessment and Penetration Testing Services agreement. https://oecm.ca/marketplace/vulnerability-assessment-and-penetration-testing-services/. Supplier partners, eligible sectors and expiry.
CREST Marketplace profiles and vendor pages linked in each entry, read 16 October 2026. https://marketplace.crest.org/suppliers/.
Talk to Stingrai
Bring your network map, identity setup, student information system vendor list and last report. Stingrai will scope the campuses, Active Directory, Entra ID, portals, Wi-Fi and your people, name the penetration testers, post every confirmed finding the same day, retest the fixes and close human-led and hybrid engagements with an attestation letter, as a one-time annual test or a continuous program. Get a quote or book a free discovery call.
