Building Your Campus Cybersecurity Program from Scratch: Small and Midsized Institutions (Separate registration required.)

Not every institution has a CISO. Not every institution has a dedicated security budget. But every institution has cyber risk, and the regulatory environment (GLBA, FERPA, state privacy laws, potential CMMC requirements for research institutions) is only getting more demanding. This hands-on, half-day workshop is designed specifically for small and midsized colleges and universities that are building or rebuilding a cybersecurity program with limited resources. Led by a practitioner who has helped institutions of all sizes stand up security operations from vulnerability management and patching programs to incident response plans, this workshop guides participants through a structured, phased approach to building a cybersecurity program that is achievable, sustainable, and aligned with institutional risk tolerance. Participants will work through four modules: (1) Assess your current state using a lightweight cybersecurity domains framework; (2) Prioritize investments using an ERM-informed risk matrix; (3) Build a 12-month implementation roadmap with realistic milestones; and (4) Make the business case to leadership using language that resonates with presidents and boards. Each module includes hands-on exercises, peer discussion, and templates that participants take home. Outcomes of this workshop: complete a baseline cybersecurity maturity assessment and prioritize investments by mapping technical vulnerabilities to institutional risk appetite; design a 12-month phased cybersecurity program roadmap with realistic milestones for resource-constrained institutions; and construct a leadership-ready business case that translates technical risk into the financial and reputational language that presidents and boards need to approve funding. Upon successful completion of this preconference workshop, participants will be eligible to receive an EDUCAUSE microcredential. To earn this digital badge, participants must complete a brief workshop evaluation and share two key learning outcomes from their experience. On October 5, all registered participants will receive an email with instructions for completing these steps. Completion of both is required. To learn how to accept and make the most of the microcredential, visit the EDUCAUSE Microcredential website.