FUILD GUIDE
5 Nov 2026
Key takeaways
The implementation pause does not remove safeguarding duties. The CMMC implementation pause does not eliminate companies’ information-protection requirement under DFARS clause 252.204-7012.
NIST SP 800-171 Revision 2 remains the interim enforcement baseline. The Department says it will enforce cybersecurity compliance during the pause with NIST SP 800-171 Revision 2 through self-assessments and select government-led assessments.
Assessment frequency and affirmation are different obligations. CMMC Level 2 requires a self-assessment every three years against the 110 security requirements in NIST SP 800-171 Revision 2 and an annual affirmation.
Conditional status has a remediation deadline. Level 2 POA&Ms are permitted as defined in 32 CFR § 170.21(a)(2) and must be closed out within 180 days.
Implementation support belongs within ongoing cybersecurity operations. O'Neil Security Group's cybersecurity services address NIST / CMMC / DFARS / ISO27001 requirements, including implementation of NIST 800-171 measures to protect Controlled Unclassified Information in non-federal systems.
CMMC and NIST SP 800-171 Compliance in 2026
Subject- A Government Contractor’s Guide to Requirements, Assessments, and Contract Eligibility
A solicitation arrives, or a customer sends a cybersecurity questionnaire, and your team needs to demonstrate readiness without interrupting contract work. Answering confidently takes more than a policy folder. You need to connect the contract’s requirements with the information you handle, the systems protecting it, and the assessment status your organization maintains.
Start with contract applicability and information handling. Protecting information, assessing compliance, and maintaining the status relevant to an applicable contract are related but distinct responsibilities. The CMMC implementation pause changes implementation planning, but it does not remove continuing safeguarding obligations.
O'Neil Security Group supports cybersecurity implementation and operations, helping organizations connect compliance requirements with the practical work of protecting sensitive information. This guide explains the assessment paths, preparation priorities, and continuing obligations contractors should organize around in 2026.
1- What are CMMC and NIST SP 800-171?
CMMC provides an assessment framework for evaluating cybersecurity implementation. NIST SP 800-171 supplies the safeguarding requirements evaluated through the applicable assessment process. The practical distinction is between implementing protection and demonstrating that the protection meets the required baseline.
For contractors handling Controlled Unclassified Information, or CUI, planning should connect that information to the non-federal systems used to process, store, or transmit it. Safeguarding measures should reflect the actual environment rather than exist only as written commitments.
Separate the work into distinct responsibilities:
Implementation: Put the applicable safeguards into operation.
Assessment: Evaluate those safeguards and establish the relevant result.
Continuing affirmation: Maintain the recurring accountability associated with status.
CMMC Level 1 and Level 2 can be met through contractor-run self-assessments. Level 2 certification is a pass/fail evaluation performed by an authorized C3PAO, and the government assesses Level 3.
CMMC Phase 1 has been live since November 10, 2025, with Level 1 and Level 2 self-assessment status required in applicable solicitations and contracts. Contract language therefore belongs at the beginning of planning, not at the end of an implementation project.
O'Neil Security Group's cybersecurity services include implementation of NIST 800-171 measures to protect Controlled Unclassified Information in non-federal systems.
2- What does the 2026 implementation pause mean for contract eligibility?
PHP2Shell illustrates a broader shift: AI does not invent new classes of bugs so much as it makes long-standing weaknesses more discoverable and more exploitable. Code paths that human reviewers had examined for years became practical attack surfaces once frontier models assisted with complex state analysis and exploit chaining. The same capabilities that helped responsible researchers surface the issues can accelerate weaponization once details are public.
Organizations running PHP-based sites, applications, or containers faced an immediate operational requirement: inventory every runtime (including containers, managed hosting, and legacy installs), apply the correct patched builds, and confirm that workers had restarted with the new code. Many discovered incomplete visibility into their own technology stack.
| Milestone | Date | Meaning for planning |
|---|---|---|
| First phase of CMMC implementation began | November 10, 2025 | Implementation began with the self-assessment phase. |
| Immediate suspension announced | July 13, 2026 | Implementation is paused in Phase 1. |
| Suspended Phase II milestone | November 10, 2026 | The next scheduled phase does not proceed during the pause. |
On July 13, 2026, the Department of Defense suspended CMMC Phase II, and during the interim, contracting officers may require only Level 1 (Self) or Level 2 (Self).
For eligibility planning, organize your work around the assessment status specified in the applicable solicitation or contract. Do not treat the suspended milestone as permission to stop readiness work.
Implementation schedules and information-protection duties remain separate planning considerations. The CMMC implementation pause does not eliminate companies’ information-protection requirement under DFARS clause 252.204-7012. Continue operating safeguards while managing the assessment and status obligations relevant to your contract.
3- Which CMMC assessment path applies to your contract?
Begin with the current self-assessment paths, then distinguish voluntary certification from the enhanced government-led path. The appropriate preparation effort follows the assessment scope and status required by the applicable contract.
| Assessment path | Safeguarding baseline | Assessor | Assessment cadence | Affirmation duties | Remediation treatment |
|---|---|---|---|---|---|
| Level 1 self-assessment | 15 security requirements in FAR clause 52.204-21 | Contractor | Annual | Annual affirmation | POA&Ms are not permitted |
| Level 2 self-assessment | 110 security requirements in NIST SP 800-171 Revision 2 | Contractor | Every three years | Annual affirmation | Permitted as defined in 32 CFR § 170.21(a)(2); closeout within 180 days |
| Level 3 | Selected subset of 24 NIST SP 800-172 enhanced requirements | Authorized DIBCAC assessors | Every three years | Manage continuing status responsibilities separately from the assessment event | Any Level 2 POAM must be closed before initiating Level 3 |
Voluntary Level 2 certification assessments by C3PAOs remain available during the CMMC Phase II suspension. Keep that route distinct from the interim self-assessment requirements.
An assessment result is not the entire compliance program. Maintaining status also calls for attention to applicable affirmations, remediation, and the continued operation of the safeguards being assessed.
Level 1: Basic safeguarding and annual self-assessment
CMMC Level 1 requires an annual self-assessment and annual affirmation against the 15 security requirements in FAR clause 52.204-21.
Level 1 assessment results and affirmations are entered into the Supplier Performance Risk System, or SPRS, and Level 1 POA&Ms are not permitted. Plan to meet the full applicable baseline before affirmation rather than relying on a future remediation plan.
For preparation, assign responsibility for each applicable safeguard and assemble the records supporting its implementation. Review those records together so the assessment result and affirmation describe the same operating environment.
Level 3: Enhanced requirements and government-led assessment
Level 3 is a government-led DIBCAC assessment against a selected subset of 24 NIST SP 800-172 enhanced requirements. CMMC Level 3 assessments are conducted by authorized DIBCAC assessors and are required every three years.
A Level 3 certification requires a final Level 2 C3PAO status for the same assessment scope, and any Level 2 POAM must be closed before initiating the Level 3 assessment.
That prerequisite makes scope alignment important. Organize readiness so the Level 2 foundation and enhanced assessment address the same environment. Keep this path separate from the Level 1 (Self) and Level 2 (Self) requirements available to contracting officers during the interim.
Level 2: NIST SP 800-171 self-assessment and voluntary certification
CMMC Level 2 requires a self-assessment every three years against the 110 security requirements in NIST SP 800-171 Revision 2 and an annual affirmation. The assessment cycle does not replace the separate annual affirmation duty.
Level 2 self-assessment results are entered into SPRS, and CMMC Status is valid for three years from the CMMC Status Date as defined in § 170.4.
Voluntary Level 2 certification assessments by C3PAOs remain available during the CMMC Phase II suspension. Treat certification as a distinct assessment route, not as another name for contractor self-assessment.
Whichever route informs your planning, align the assessment scope, implementation records, and assigned responsibilities. Leadership should be able to connect the recorded status to the systems and safeguards actually supporting contract work.
4-How to prepare your systems and assessment documentation
Begin by mapping the information handled, the systems involved, and the people responsible for protecting them. A useful preparation workflow connects that scope to documentation, operational evidence, and accountable owners.
Define the operating boundary. Trace how CUI moves through the environment. Identify the assets, services, and organizational responsibilities involved, including work performed by outside providers. Resolve conflicting assumptions about responsibility before assembling the assessment package.
Review at the objective level. Level 2 covers 110 NIST SP 800-171 Rev 2 requirements, which break down into roughly 320 assessment objectives. Connect each requirement to operational records and an accountable owner. A policy statement alone should not be the end of your internal readiness review.
Build a coherent documentation set. Organize the system security plan, data-flow diagram, asset categorization, policies, and provider responsibilities so they describe the same environment. Documents should support each other rather than present disconnected versions of how safeguards work.
Turn gaps into managed work. Prioritize implementation gaps, assign responsibility, and track completion. Coordinate technical changes with governance, incident handling, and recovery planning so improvements remain workable after assessment preparation ends.
O'Neil Security Group's cybersecurity approach includes secure systems design, AI and machine learning for real-time threat detection and response, intrusion detection systems, vulnerability management platforms, encryption, cryptographic techniques, and incident response and forensic tools. Explore O'Neil Security Group's cybersecurity implementation and operational support to connect readiness work with your operating needs.
5- How much should contractors budget for assessment and implementation?
Separate assessment expenses from the cost of implementing and operating safeguards. An assessment estimate is not an all-in cybersecurity budget.
The DoD Regulatory Impact Analysis estimates a Level 2 C3PAO assessment at roughly $105,000–$118,000 over three years and a Level 2 self-assessment at about $37,000–$49,000, excluding control implementation costs.
| Assessment route | Estimated assessment expense | Budget boundary |
|---|---|---|
| Level 2 C3PAO assessment | Roughly $105,000–$118,000 over three years | Excludes control implementation costs |
| Level 2 self-assessment | About $37,000–$49,000 | Excludes control implementation costs |
Build the broader budget around readiness work, assessment activity, remediation, and ongoing operations. Readiness includes understanding scope and organizing implementation records. Remediation addresses gaps. Operations sustain the safeguards after the assessment work is complete.
System scope and the chosen assessment route should guide planning. Ask prospective providers to distinguish implementation work from assessment work and define responsibilities, deliverables, and operational handoffs. This makes proposals easier to compare without mistaking a narrow assessment expense for a complete program.
O'Neil Security Group's Virtual Chief Information Security Officers (vCISOs) manage technology stacks, technology budgets, client questionnaires, governance, and compliance programs for manufacturing organizations. That governance role can help connect technical priorities with budget decisions and leadership accountability.
6- Best practices for maintaining assessment readiness
Treat readiness as an operating discipline rather than a project that ends when results are recorded. Build a recurring governance calendar around assessment validity, affirmation, remediation closeout, and artifact retention.
Prepare for affirmation before it is due. Assign responsibility for reviewing implementation records and reporting issues to leadership. A Level 2 assessment will lapse if the organization fails to affirm annually after the assessment.
Retain the assessment record deliberately. Companies must retain hashed artifacts used for assessments for at least six years from the date the CMMC status is obtained for each assessment. Make artifact handling part of the assessment workflow rather than an administrative task left until afterward.
Keep documentation connected to operations. Review the assessment package when systems, service providers, or responsibilities change. Update ownership and operating descriptions together so documentation continues to reflect how work is performed.
Connect safeguards to response and recovery. Vulnerability management, incident response, and recovery planning should inform the continuing operation of controls. Use operational findings to identify work that needs attention and assign responsibility for follow-through.
O'Neil Security Group's Managed Security Services provide a full cybersecurity tool stack with engineers to protect a business and develop recovery plans in case of a disaster. Match operational support to the responsibilities your internal team needs help sustaining.
7- How O'Neil Security Group supports compliance implementation
O'Neil Security Group's cybersecurity services address NIST / CMMC / DFARS / ISO27001 requirements, including implementation of NIST 800-171 measures to protect Controlled Unclassified Information in non-federal systems.
Choose support according to the work your organization needs to perform and the responsibilities it will retain internally. Engineering, security operations, and executive governance solve related but different problems.
Engineering and tools: O'Neil Security Group's IT Engineering & Tools services fully replace a client's IT department and IT tools with OSG engineers and tool stacks.
Managed security operations: O'Neil Security Group's Managed Security Services provide a full cybersecurity tool stack with engineers to protect a business and develop recovery plans in case of a disaster.
Manufacturing-focused governance: O'Neil Security Group's Virtual Chief Information Security Officers (vCISOs) manage technology stacks, technology budgets, client questionnaires, governance, and compliance programs for manufacturing organizations.
A useful service discussion starts with your contract requirements, current systems, internal staffing, and implementation priorities. Define who owns technical changes, who maintains documentation, and how operational findings reach leadership.
Explore O'Neil Security Group's services to discuss support aligned with your environment. The objective is to connect implementation work with the day-to-day operation of safeguards, not to treat assessment preparation as an isolated exercise.
-
-
Security Solutions » Find Your State Agency – AEPA Coop
AEPA is a cooperative of education purchasing professionals with 31 member states; member agencies competitively bid contracts tailored to each state’s legal requirements.
Awarded contracts are available statewide through a member agency acting as contract administrator, which can answer questions and provide purchasing documentation; non-member states may use piggyback contract options.
Bluebird is described as a nationwide low-voltage physical security integrator serving K–12, higher education, government, and commercial organizations, with design, procurement, installation, and support for video surveillance, access control, visitor management, and environmental sensing.
Bluebird lists multiple security technology manufacturer partners and also offers fleet telematics for school bus and vehicle safety; AEPA members receive its lowest available hardware and license pricing, and it provides on-site assessments and rapid estimates nationwide.
CENTEGIX offers a cloud-based safety platform and wearable badges intended to initiate emergency responses across campuses and workplaces.
SAS HALO describes its work as comprehensive security solutions for educational institutions, using technology and strategic partnerships to support safer learning environments.
School Specialty’s security-solutions listing is tied to a 2025 bid; the page also describes its broader Education Essentials business, rather than detailing particular security products.
South Western Communications offers communication, physical security, and life-safety systems, including access control, cameras, door monitoring and locking, wireless duress, fire, vape, environmental, and weapon detection.
SWC’s neXus smart campus solution integrates safety and security systems into an interactive 3-D facility map, showing real-time alerts and supporting notifications to responders and room or campus lockdowns.
The page lists Bluebird, CENTEGIX, SAS HALO, School Specialty, and SWC under security solutions, with most entries linked to the 2025 bid and possible contract extensions through March 2029.
Purchasing Categories – AEPA Coop
AEPA says its state members secure multi-state volume purchasing contracts intended to provide measurable, cost-effective benefits for public agencies.
AEPA says its contract categories offer school and office products and services based on the needs of 25 million students nationwide.
The directory lists Security Solutions (5) and Cybersecurity & Training (7) as purchasing categories; the visible page includes vendor profiles in both categories.
Bluebird is described as a nationwide low-voltage physical security integrator serving K–12 schools, higher education, government facilities, and commercial organizations, with multi-site deployment capabilities.
Bluebird designs, procures, installs, and supports video surveillance, access control, visitor management, and environmental sensing solutions across all 50 states.
Bluebird lists partnerships with security technology manufacturers including Lumana, Rhombus, Axis Communications, Avigilon Alta, Coram AI, Hanwha Vision, ButterflyMX, Genea, and Triton Sensors; it also offers school bus and vehicle fleet telematics through named providers.
Bluebird says AEPA members receive its lowest available hardware and license pricing and that it provides nationwide on-site assessments and rapid estimates.
CENTEGIX offers wearable safety technology and a cloud-based Safety Platform for K–12, higher education, and workplaces; the page says the platform initiates emergency responses anywhere on campus.
Audio Enhancement offers classroom audio, cameras, safety alerts, and schoolwide communications; classroom microphones distribute teachers’ voices and include alert buttons that notify office staff of emergencies.
Audio Enhancement classroom cameras can record or livestream lessons for remote and blended learning, with videos uploaded to an LMS or downloaded for students; its intercom, paging, and bell systems are customizable.
The page provides bid approval recommendations and possible contract-extension end dates for listed vendors, giving purchasers procurement context alongside vendor descriptions.
Benefits of Hiring Private School Security: A Guide
Visible officers, regular patrols, and active observation can discourage unwanted visitors, theft, and vandalism while helping identify concerns in parking lots, fields, entrances, and walkways.
Officers can complement cameras and access controls by interpreting events in context, responding under school procedures, and recording observations for administrators.
Guards may monitor gathering areas, notice developing student conflicts, and communicate with administrators to support de-escalation; they do not replace teachers, counselors, or administrators.
The page cites NCES data that about 19% of students ages 12 to 18 reported being bullied at school during the 2021-22 school year, while noting that campus security cannot address all bullying, including online or off-campus conduct.
The page says an NIJ-published study associated security officer presence with higher student perceptions of safety, and cautions that perceptions can differ among student groups.
Visitor procedures can include identity and purpose checks, administrator notification, visitor credentials or escorts, departure records, and reports of access failures or unusual activity.
Access plans should specify authorized entrances, visitor waiting areas, secured doors, exception procedures, and how to handle deliveries, late arrivals, staff movement, and after-school activities.
During busy transitions and events, officers can observe pedestrian and vehicle activity and communicate delays, while school staff retain responsibility for student release.
For emergencies, officers can communicate conditions, direct people away from danger, help preserve responder access routes, assist with evacuation routes, and report checked zones within their training and the school's plan.
Providers and schools should coordinate campus maps, access points, reunification locations, alarms, emergency contacts, and communication channels, then use drills and post-event observations to improve plans.
A security contract should define posts, patrol routes, visitor procedures, response expectations, reporting duties, authority limits, schedule-change permissions, and incident-notification recipients.
The page recommends evaluating providers by measurable practices—including trained officers, documented patrols, dispatch, access procedures, incident reporting, and review processes—rather than guarantees that incidents will never occur.
Private-school coverage may be tailored to school hours, events, sports, and seasonal needs; public districts may favor consistent standards across campuses and may have district procurement and planning processes.
The appropriate comparison is how coverage fits each system's risks and resources, rather than which model is inherently safer.
Boards should compare coverage options such as a standing post, mobile patrols, and event coverage against campus layout, operating hours, and higher-risk locations and times.
The article describes GPS-tracked Daily Activity Reports and photo-documented incident reports as ways to give leadership information about patrols and incidents, and advises asking how reports are delivered, reviewed, retained, and escalated.
Security officers support, rather than replace, educators, administrators, school policies, or law enforcement; school leaders retain responsibility for policy and student decisions.
School Security Systems: What K-12 Districts Actually Paid in 2026 — Civic IQ
Civic IQ records show 82 K-12 security awards across 28 states from January 1 to September 5, 2026; the median was $54,498, with the middle half between $15,947 and $181,332.
Award size is driven more by the number of buildings and project scope than district size. Many purchases are refreshes, replacements, expansions, or renewals rather than first-time installations.
NCES data cited by the article puts public-school camera use at 93% and controlled building access at 97% in 2021-22, leading the article to characterize the market as largely non-greenfield.
System-type medians range from $14,664 for visitor management to $128,100 for emergency notification and panic alert; categories with fewer than 15 awards are described as indicative only.
Access-control pricing depends on door count and whether work is a retrofit or new build; the article gives a benchmark of about $6,500 per door and notes retrofit cabling adds cost.
Camera awards imply installed pricing of about $1,675 to $2,062 per camera in cited examples, but the packages often bundle multi-year cloud licenses, so license terms matter when comparing quotes.
Weapon-detection purchases include software priced per existing camera stream and hardware screening priced per lane; software overlays can avoid replacing cameras.
Visitor management is commonly purchased as a yearly subscription with kiosk licenses. A cited high-value renewal also bundled wearable staff alert badges, gateways, and beacons.
Emergency notification projects tend to be district-wide and have the highest category median; state requirements can make panic-alert purchases mandate-driven.
Published cost guides are criticized for broad ranges or figures without cited records. The article says Avigilon's guide gives a $5,000-to-over-$500,000-per-campus range, while Volt.ai's 14 dollar figures lack sources or footnotes.
For 2025-2026 records, ZeroEyes has the most vendor awards among the listed companies. Platform counts differ from contracting-party counts because integrators often appear as the named contractor.
Avigilon represents a large legacy installed footprint by value, while Verkada appears in more platform records; the article says districts may buy Verkada through local integrators.
The article describes displacement as occurring at the software layer: districts can retain existing cameras while adding detection software from another provider.
Funding routes include state safety grants, state mandates, bonds and capital funds, and cooperative contracts. The source predicts that grants move quickly, mandates follow state deadlines, bond work follows construction schedules, and co-ops can remove the solicitation step.
Quote checks should account for installed camera cost, controlled-door cost, AI detection per stream, screening-lane cost, and panic-alert cost per school; the worked example totals roughly $434,000 for 160 cameras and 20 controlled doors.
The article cautions that recorded contracts measure purchasing and renewals, not AI detection accuracy; it says it found no vendor in the category publishing independent accuracy testing.
The 2026 dataset excludes unselected quotes and alternates, repairs and monitoring invoices, purchases below $1,000, and mixed packages containing unrelated work. It does not contain enrollment or building counts.
A broader 2025-2026 dataset contains 260 awards across 40 states and has a $57,966 median, which the article says is close to the 2026 median.
10 Best Network Security Providers for Education Sectors - 2026
Education networks hold student personal information, academic records, staff data, research, and intellectual property; security is presented as protection against breaches, identity theft, ransomware, service disruption, and reputational harm.
Content filtering and monitoring can help restrict inappropriate or harmful material and support a safer online learning environment.
Recommended practices include regular risk assessments, encryption at rest and in transit, MFA, timely patching, least-privilege access, cybersecurity training, secure Wi-Fi, endpoint protection, network segmentation, incident-response planning, and tested backups.
The article advises checking compatibility with existing infrastructure, breadth of security features, provider reputation, total cost, scalability, ease of management, and customer-support SLAs.
The ranked providers are Perimeter81, Cisco Systems, Palo Alto Networks, Sophos, Aruba Networks, McAfee, Symantec (Broadcom), Trend Micro, Barracuda Networks, and IBM Security.
Perimeter81 is described as a hardware-free network security solution for education and government that supports 3G, LAN, and Wi-Fi, centralized management, activity audits, user-level access controls, encrypted remote access, automatic protection on public Wi-Fi, segmentation, and two-factor authentication.
Cisco’s education security portfolio is described as spanning network, cloud, email, endpoint, and API security; the page also highlights campus CCTV monitoring, Meraki Wi-Fi 6 support, and Cisco Umbrella web filtering and 30-minute deployment.
Palo Alto Networks’ firewall approach is explained through App-ID, User-ID, and Content-ID: identifying applications regardless of port, protocol, or encryption; integrating user identity with Active Directory; and scanning content for suspicious material.
Sophos is presented as combining automated detection with human threat hunting and coordinated visibility; its named offerings include Intercept X, ZTNA, Cloud Optix, MDR, XDR, and Firewall.
Aruba Networks is described as serving smaller and mid-sized institutions with Aruba ESP, networking hardware, Aruba Central management, AI analytics, SD-WAN, and K-12 security capabilities.
McAfee’s education offering includes Secure School Suites and MVISION Mobile Advanced; the page says its cloud-delivered unified endpoint suite can correlate tool data through Trellix XDR and includes ransomware recovery procedures.
Symantec (Broadcom) offers public-sector consulting, security-posture advisory and audit services, and data-centric security offerings including web isolation, sandboxing, secure web gateway, deep file inspection, and zero-trust network access.
Trend Micro is described as offering agentless network security, DLP and encryption, and protection across physical, virtual, private-cloud, public-cloud, and hybrid-cloud environments, including mobile endpoints.
Barracuda is presented as protecting against DDoS, credential stuffing, and automated attacks with CloudGen Firewall, IDS/IPS, cloud threat intelligence, WAF-as-a-Service, optional machine-learning-based Advanced Bot Protection, and staff anti-phishing training.
IBM Security is described as offering EDR, XDR, SIEM, SOAR, data security, endpoint protection, unified endpoint management, and IAM tools; the article notes that it has no defined education-specific solution but its products can be used by institutions.
The conclusion recommends balancing affordability, scalability, ease of use, and strong education-relevant protection, and names Palo Alto Networks, Sophos, and Cisco as providers with specialized defenses, remote access, and AI-based threat detection.
School Security Systems: What K-12 Districts Actually Paid in 2026 — Civic IQ
Across 82 K-12 security awards in 28 states from January 1 to September 5, 2026, the median award was $54,498; the 25th-to-75th percentile range was $15,947 to $181,332.
The smallest counted award was $1,000, while the largest was $1,826,553 for Troy School District’s paging and intercom system; records below $1,000 were excluded.
Building count and project scope explain price differences better than district size: a full access-control retrofit at one school cost Edison Township Public Schools $345,822, while Mount Gilead replaced 61 district-wide cameras for $102,193.
Most recorded awards were refreshes, replacements, expansions, or renewals rather than first-time installations; NCES data cited in the article puts public-school camera use at 93% and controlled building access at 97% in 2021-22.
Median awards by category ranged from $14,664 for visitor management to $128,100 for emergency notification and panic alert; the article cautions that categories with fewer than 15 awards are indicative only.
Access-control awards had a $46,278 median across 16 awards. Southern Lehigh Valley Middle School was quoted $71,500 for 11 doors, about $6,500 per door, including controllers, readers, electrified locks, exit sensors, cabling, and programming.
Camera and video-management awards had a $63,457 median across 28 awards. Cited installed prices were about $1,675 to $2,062 per camera, and comparisons should account for bundled multi-year cloud licensing.
Weapon-detection awards had a $67,500 median across 18 awards. Camera-based software is priced per stream, while hardware screening is priced per lane; the article cites software examples of $320 to $485 per stream per year.
Visitor-management awards had a $14,664 median across six awards and were usually yearly subscriptions with kiosk licenses; Berkeley County’s $189,000 renewal also included wearable staff-alert badges, gateways, and beacons.
Emergency-notification awards had a $128,100 median across 12 awards. The article says these projects are often district-wide and that state requirements such as Utah’s HB24 and HB40 are driving panic-alert purchases.
The article criticizes Avigilon’s $5,000-to-over-$500,000-per-campus guide range as too broad to judge a quote, and says Volt.ai’s 14 cost figures have no cited sources; it reports Volt.ai’s standalone comparison totals as $98,000 to $290,000 and its integrated comparison as $3,000 to $31,000.
Across 2025 and 2026 records, ZeroEyes had the most vendor-attributed K-12 awards, with 19; the article says Avigilon had the largest platform footprint by value, while Verkada appeared in the most platform records.
The article says software overlays can be added to existing cameras without replacing hardware, and describes displacement occurring at the software layer while incumbent cameras remain in place.
Funding routes include state safety grants, mandates, bonds and capital funds, and cooperative contracts. The article says grant funds can create short timelines, mandates create deadline-driven demand, bonds follow construction schedules, and co-ops can remove the solicitation step.
Quote benchmarks include $1,675 to $2,062 per installed camera, about $6,500 per access-controlled door, $320 to $485 per year per AI-detection stream, about $21,437 per weapon-screening lane, and about $56,000 per school for panic alerts.
A worked example estimates that refreshing 160 cameras at $1,900 each and adding access control to 20 doors at $6,500 each would total roughly $434,000; a quote of $54,498 for that scope would suggest missing scope.
The article cautions that retrofit work costs more than new construction because cabling is expensive, and that per-camera totals can include multi-year licensing.
Deployment examples range from single-building work completed within one budget cycle to multi-school projects carried out over a school year or summer; cooperative purchasing speeds procurement but not construction.
The 2025-2026 expanded dataset covered 260 awards across 40 states and had a $57,966 median, which the article says is close to the 2026-only median.
The page lists an article about GuideLites at Bits & Pretzels and How to Web 2026, previewed with an estimate of attendees and founder-investor meetings.
An article dated April 8, 2026, concerns integrating access control with visitor management and begins with a scenario of a visitor arriving at a modern office.
An article dated April 6, 2026, addresses visitor management in schools, where parents, visitors, contractors, and staff enter and leave throughout the day.
An article dated March 31, 2026, covers visitor-management trends across settings including offices, factories, hospitals, and campuses.
An article dated March 19, 2026, argues that low-traffic sites also need visitor-management systems, countering the perception that such systems are only for busy facilities.
An article dated February 25, 2026, frames office visitor management as affecting security, compliance, employee productivity, and workplace experience, not just front-desk courtesy.
An article dated February 24, 2026, says paper logbooks and manual front-desk processes no longer meet modern security and operational requirements, and offers a kiosk guide.
An article dated February 19, 2026, discusses visitor-management-system benefits across offices, business buildings, schools, healthcare facilities, and other organizations.
An article dated February 10, 2026, defines a visitor-management system as a digital solution for registering, tracking, and managing people entering a building.
An article dated October 15, 2025, says NIS-2 makes digital visitor registration relevant to compliance and that traditional logbooks fail physical-security requirements; modern systems can provide audit trails, access control, and real-time monitoring.
Independent and Private Schools Address Unique Cybersecurity Threats | EdTech Magazine
Private and independent schools are appealing targets because tuition, financial aid and fundraising generate valuable financial records alongside sensitive student and employee information; quick incident response is important.
Schools face different resource constraints: some rely on one IT employee, while others can fund larger teams and advanced technology, and the more than 30,000 U.S. private and independent K–12 schools vary widely in size and budget.
Independent schools must account for reputational damage that can affect enrollment and for long-lived records involving students, alumni, community-building and donor relations; schools with international students may also need to follow other countries’ privacy laws, including the EU GDPR.
A comprehensive security program combines technology, policies and people, but some schools lack IT training and fail to keep hardware firmware and software patches current.
At Westminster Christian School, CIO and CTO Omar Valerio cross-trains four IT technicians to cover one another’s roles, runs monthly tabletop incident-response exercises and trains faculty and staff to identify phishing.
Westminster responds rapidly to alerts: when a student downloads suspected malicious code, the teacher is asked to send the laptop to IT within five minutes for inspection and remediation.
Westminster has 210 faculty and staff and 1,280 students in pre-K through grade 12; it issues each student a Microsoft Surface Pro and operates its own data center with a mix of on-premises and cloud software.
Westminster installs hardware firmware upgrades monthly and uses Microsoft Intune to manage devices and automatically install software updates and patches.
Valerio conducts monthly penetration tests and hires a third party for an independent penetration test annually.
Westminster uses Cisco Umbrella for cloud-based monitoring of internet traffic and application use and for securing users, endpoints and data; Cisco Prime Infrastructure monitors the network, Microsoft Authenticator provides multifactor authentication, Sophos provides endpoint security, and SonicWall firewalls and virtual LANs segment user traffic.
Montclair Kimberley Academy has three campuses, 1,050 pre-K–12 students and an IT staff of five; over seven years it migrated most core applications to the cloud to simplify management and strengthen security.
Montclair Kimberley Academy requires school approval before teachers or staff sign up for applications; its technology leaders review requests for security concerns such as exposure of linked documents or address books.
The school regularly hires an outside security firm to audit its network and uses CDW Amplified IT every two years to audit its Google Workspace for Education implementation and provide security recommendations.
ATLIS reported that 18.5% of independent schools have a cybersecurity team that meets regularly and includes all relevant constituents.
For schools with smaller IT budgets, ATLIS recommends a multiyear security roadmap that starts with multifactor authentication, endpoint security, firewalls, encryption, data backup and cyber liability insurance.
Over time, smaller-budget schools can add network segmentation, network-event log monitoring, annual reviews of cloud agreements and third-party security audits.
ATLIS advises small IT teams to involve faculty and staff across departments, provide ongoing training and review school practices; one model is to retain an IT leader for strategy and outsource operational IT or cybersecurity to a managed service provider.
C2k, formerly Classroom 2000, is a Northern Ireland-wide information and communications network operated on behalf of the Education Authority.
The Education Authority Northern Ireland has overseen the project following the separation of the education and library boards; the current contract is fulfilled by Capita Technology and Software Solutions.
C2k provides schools across Northern Ireland with internet access and other services supporting the Northern Irish Curriculum.
Some schools use their own systems, described as School or Legacy systems.
The article says C2k is expected to be replaced over the next few years by EdIS (Education Information Solutions), without specifying a date.
In early April 2026, a cyberattack left students using the network unable to log into their accounts.
The PSNI received a report of an intrusion involving the Education Authority on 2 April 2026.
On 10 April 2026, forensic experts informed the Education Authority that confidential personal information had been specifically and targetedly accessed.
On 15 April 2026, the PSNI arrested a 16-year-old boy on suspicion of offences under sections 1, 2, and 3A of the Computer Misuse Act 1990; he was later released on bail pending further enquiries.
The Education Authority said on 15 April 2026 that it believed personal data had been compromised.
On 25 June 2026, the Education Authority warned parents that more schools were affected than previously thought; letters went to 23 schools, 16 of which had not received prior notifications.
By 25 September 2026, the Department of Education said the Education Authority's investigation had concluded and that the Authority was liaising with the PSNI and ICO.
The ICO Technical Investigation Team met the Education Authority's Information Governance Team in June; the meeting was described as positive, and the Authority continued to provide requested information.
The managed service provider shared a draft lessons-learned report on 18 September 2026; it identified areas for improvement and reflected on positive practices.
An administrative law judge ruled that the Palm Beach County School Board must assign safe-school officers to Renaissance Charter’s six schools under Florida’s post-Parkland law.
The judge concluded that school boards and district superintendents—not charter-school operators—must establish or assign safe-school officers to every public school in their jurisdictions, including charter schools.
The dispute was described as a first-impression question of statewide interest, with potential implications beyond Palm Beach County.
Florida’s 2018 law required safe-school officers at all public schools; permitted options include law-enforcement officers and trained school personnel called guardians who may carry guns.
Palm Beach County did not use guardians, according to the ruling.
Renaissance Charter asked the board in March 2018 to provide a full-time officer at each of its schools; the board refused and later declined mediation.
The judge did not decide who must pay for the officers, saying that financial disputes could be addressed in a future case.
In Flagler County, the district contracted with the Sheriff’s Office for deputies at traditional public schools, while Imagine School at Town Center contracted separately for security.
The County Commission provided half the
By Josiah O’Neil
Founder and CEO, O’Neil Security Group
Josiah O’Neil is a seasoned security professional with experience as a private contractor, Special Agent with the Diplomatic Security Service, California law enforcement officer, and military service member. He leads OSG, an all-source security solutions provider focused on proactive protection and intelligence-driven operations.
FAQ’s
-
NIST SP 800-171 Revision 2 is the applicable interim enforcement baseline. The Department says it will enforce cybersecurity compliance during the pause with NIST SP 800-171 Revision 2 through self-assessments and select government-led assessments.
Organize current compliance preparation around that baseline, the applicable assessment scope, and the responsibilities established for your contract.
-
An authorized C3PAO performs Level 2 certification as a pass/fail evaluation, and the government assesses Level 3. CMMC Level 1 and Level 2 can be met through contractor-run self-assessments.
Implementation and operational support teams have a different role: helping put safeguards into practice, organize documentation, and sustain operations. Keep that work distinct from the role of the authorized certification assessor.
-
Yes. O'Neil Security Group's Managed Security Services provide a full cybersecurity tool stack with engineers to protect a business and develop recovery plans in case of a disaster.
O'Neil Security Group's Virtual Chief Information Security Officers (vCISOs) manage technology stacks, technology budgets, client questionnaires, governance, and compliance programs for manufacturing organizations.
Define the division of responsibilities between internal leadership and outsourced support before work begins. Contact O'Neil Security Group to discuss your contract requirements, operating environment, and implementation priorities.