What is Foundational School Security And Why Does it Matter
What every student deserves, and every parent and educator should expect.
By ZeroNow Advisory Council Members
The guidance on effective practice for school security is a bit all over the place. Most often, lacking clear direction on what should be the first considerations. With each new incident, the available recommendations become more chaotic. In an effort to calm the chaos and offer policy and decision makers effective direction, the ZeroNow Advisory Board began the development of a series of foundational school security position statements.
The ZeroNow Advisory Board is a multidisciplinary group of practitioners, manufacturers, vendors, educators, and non-profit school safety advocates. Their goal was to clearly identify the foundational requirements for school security that students deserve and that parents and educators should expect. And to do this from an equipment, vendor, and manufacturer agnostic perspective. The four elements identified by this group were physical security, operational security, cyber security, and cultural security.
Each of the position statements was the result of a consensus process at the board level and then shared widely across the spectrum of groups and organizations working in school safety and security for their input. The last step was to reach out to those same organizations for public endorsement of the position statements.
As you review the four position statements, it is important to understand that the recommendations they contain are not all that should be done to develop a safe and secure school environment; they are simply the first things to be done. They represent the foundation that a school will build its safety and security program on, based on their individually assessed vulnerabilities, exposures, threats, physical plant, location, student population, community, and other unique factors.
The position papers are simply the foundational school elements that every student deserves, and every parent and educator should expect.
ZeroNow Position Paper: No.1
Foundational School Physical Security
There are generally accepted, highly effective foundational physical security tools that should be available to school staff and students and required as part of every school’s basic security profile. First, securable space at two levels: the building envelope and at the classroom door. And second, effective communication, the ability to hear and be heard from all occupied spaces in a school. These basic capabilities need to be incorporated into, and available, in every K-12 school.
Overwhelming acts of school violence perpetrated by threat actors from outside the school community are made through building openings that are not secure. At a minimum, all openings in a school facility’s envelope should be equipped with appropriate commercial-grade door hardware and a lock set. Additionally, each opening should have a local door alarm with sufficient volume to be easily heard by staff in adjacent areas. This creates a secure portal and a self-correcting mechanism, with staff addressing the unsecure condition by securing the door and silencing the alarm, much like the seat belt alarm in your car.
A locked classroom door has consistently proven to be a highly effective protective measure in school shootings. All classroom doors in a K-12 school should be solid-core types installed in welded metal frames with appropriate hardware and a lockset that can be secured from the interior of the classroom without a key. Door hardware should be ASTM and UL listed and meet IFC, NFPA, and ADA requirements. Classroom doors and sidelights should meet the ASIS school security standards and the P.A.S.S. K-12 guidelines. Secondary locking, barricade, and blockade-type devices should not be used.
Communication is a commonly noted failure point in most after-action reports following incidents with acts of violence in schools. Minimal baseline communication capability in all K-12 schools should include a robust public address system that is clearly audible and easily accessible with appropriate visual notification capabilities in all occupied spaces in a school This deployment must consist of hallways, restrooms, a cafeteria, and any other public or mass congregation space. Additionally, an intercom system capable of station-to-station and general announcement should be deployed in all student-occupied instructional spaces. Both systems require power back-up and should be designed with non- interdependent redundancies that ensure continued functionality in a power loss or other failure.
These recommendations are not intended to endorse any manufacturer, vendor, or any specific equipment, but rather to set base expectations for physical security capabilities in any K-12 school environment. They should be considered “foundational systems” and are the basic physical security capabilities that should be the primary requirement for a safe and secure school environment that all students deserve, and all families and educators should expect.
ZeroNow Position Paper: No.2
Foundational School Security ProcessesWhat every student deserves,and every parent and educator should expect
Physical security tools available to a school are only as successful as the processes to effectively implement them. There are basic operational processes that are indispensable to a worthwhile school security posture.
Utilizing a multi-disciplinary safety team based in a continual improvement model, is a critical need for an effective planning process.The team should include a designated leader with both responsibility and authority for the school security effort and representation from across your school community, including from school governance, administration, teachers, parents, students and educational support staff. The planning process is more than foundational. It is the bedrock that your foundational security planning rests on.
A functional visitor management process commonly applied with a high level of fidelity is a necessity. The basic physical security elements of securable space are only meaningful when coupled with a process to identify and control the management of all visitors to your school. Without this, even well-designed security measures lose their ability to protect students and staff.
An evidence based, clinically vetted, and effective Behavioral Threat Assessment and Management (BTAM) is required. The BTAM process is a generally recognized best practice using, a multidisciplinary, fact-based, systematic process to identify, assess, and manage potentially dangerous or violent situations in both the school and digital environment. The process will help your schools distinguish between incidents where a student exhibits concerning behavior or made a threat that is not legitimate (with no intent to harm) and other incidents in which the student does pose an actual threat. In all cases, the goal is to pair the student with proper school and community-based intervention and support.
An immediate response protocol is a necessary component. The protocol should have a limited number of responses to address the widest possible number of potential threats and be designed to quickly move a school community from normal educational operations to a safer and more secure condition. Such a program must be options based, easily deployable, trainable and sustainable. Additionally, a documented, trained process to effectively return the students to an authorized adult post incident should be included and be the first elements in a school’s emergency operations plan.
These recommendations are not hierarchical, nor are they intended to be all encompassing, but rather to set the base expectations for operational security capabilities in any K-12 school environment. They should be considered “foundational processes” and are the basic capabilities that should be the expectation for a safe and secure school environment that all students deserve, and all families and educators should expect.
ZeroNow Position Paper: No.3
Foundational Cybersecurity Practices for the Education Sector
Strengthening Security, Safety, Trust, and Continuity in the Modern Education Environment
Schools are increasingly reliant on digital systems to deliver instruction, manage operations, and safeguard sensitive student information. Because of this, it comes as no surprise that cyber threats such as ransomware, data breaches, account compromise, and social engineering continue to escalate across the education sector. Establishing a foundational cybersecurity posture is essential to ensuring operational continuity, protecting students and staff, and maintaining public trust. This foundational posture is not an aspirational maturity level; it is the minimum standard required to responsibly operate a modern school system.
To ensure structure, accountability, and measurable improvement, districts should align their practices with a recognized cybersecurity framework, such as the NIST Cybersecurity Framework (NIST CSF) or the Center for Internet Security (CIS). Adopting a framework provides a common language for leadership, clarifies priorities, supports compliance obligations, and enables institutions to plan and mature in a strategic and consistent manner. The district’s unique environment, access to resources (both human and technical), and overall mission should be considered when selecting a framework to align with.
Human behavior remains one of the most targeted vulnerabilities, underscoring the importance of security awareness as an indispensable component of cybersecurity readiness in all frameworks. Staff, teachers, and administrators must be able to recognize the different types of cyber threats, such as phishing attacks, suspicious links, and social engineering efforts, a form of manipulation with the intention to extract sensitive information from someone, which often present as fictitious emails, phone calls, or other forms of communication.District staff must understand the importance of safeguarding student data in compliance with privacy expectations, use strong authentication practices, and know when and how to report suspicious incidents.
Training should not be limited to staff, teachers, and administrators., Students and their caregivers need guidance in safe online conduct, protecting personal information, recognizing cyberbullying and malicious impersonation, and understanding their responsibilities when using school-issued devices and digital accounts. When training is recurring, role-based, age-appropriate, and measurable, it reinforces a culture in which cybersecurity is viewed not as an IT function but as a shared responsibility throughout the school community.
Alongside education and awareness, technology controls form the operational backbone of foundational cybersecurity. Districts should consider implementing technology controls that include secure authentication, device management, network segmentation, and centralized monitoring, along with other industry-standard leading practices.
These measures are practical, scalable, and achievable for districts regardless of size or resources, and they significantly reduce exposure to preventable incidents.
By implementing foundational cybersecurity practices grounded in training, technology safeguards, and a widely accepted framework, K–12 schools strengthen protection for students, families, and educators, maintain uninterrupted learning, reduce financial and reputational risk, and reinforce confidence in digital education. Every school district should consider adopting this baseline to ensure safe learning environments and preserve the integrity and resilience of public education in an increasingly digital age.
ZeroNow Position Paper: No.4
Foundational Cultural School Security
What every student deserves, and every parent and educator should expect:
Culture is a shared group ethos, the expected and accepted actions and common practices of that group. With that understanding a school’s security culture is then, by extension, the acceptance of and adherence with fidelity to the school’s security processes and the intentional and effective use of the security tools available to them.
While school security relies on physical, operational, and cybersecurity foundations, these technical measures are only half the battle. Acknowledging that most security failures are human failures, these recommendations only become effective when integrated into the cultural fabric of the school community. This means that cultural acceptance of both your security processes and effective use of your security tools is the bedrock that the other foundational elements must rest on
A safer and more secure school is not a purchase schools can make; it is a process of continual improvement that the entire school community must both commit to and intentionally engage in. Acceptance and enculturation are not and cannot be achieved by edict. Rather, both acceptance and enculturation are the product of deliberate, purposeful, and focused engagement with all the stakeholders in your school community. This is required to develop consensus for necessary change. To be accepted and become a part of a school’s cultural imperative, use of the tools, processes, and practices must be perceived by the school community as necessary, effective, and implementable in an educational environment.
The process of enculturation of a school’s security processes is, in fact, a process of behavioral modification, identifying and changing unwanted behaviors, and encouraging the acknowledged desirable behaviors. The principles of behavioral modification can and should be applied to develop a security-friendly school culture.
The critical initial step is to identify unwanted behaviors for extinction. This is the gradual weakening and eventual disappearance of a learned, enculturated behavior.Follow this with a root cause analysis; understanding why something happens is critical in the change effort. A building perimeter door propped open because the interior of the school is excessively warm will require a different solution than one propped open for convenient access to and from a parking lot.Next will be the identification of and consensus for its replacement with a wanted behavior. This is encouraged by intentional reinforcement activities. Reinforcement is anything that increases the likelihood of a behavior occurring.
A school committed to a safe, secure, and effective educational environment by the enculturation of both the school’s security processes and the effective use of the physical tools available should be the common expectation that all students deserve, and all families and educators should expect.
