Why we need MFA
Use at board or cabinet when you need money and time for staff MFA — not a SOC, and not a backups ask. Build the deck from these notes. Fill it with your systems, your carrier, and your screenshots.
Six slides. No seventh. This is a checklist for what each slide has to do, not language to read aloud.
Why we need MFA — slide guide Six slides. Replace nothing by reciting this. Write the deck in the district’s voice. Before you start • Know staff count, which systems hold student or staff records, and what MFA you will actually turn on. • Have two screenshots of that prompt from a real staff account. • Ask the broker, in writing, what the cyber policy requires for MFA. Put their answer on slide 2 — do not guess. • Pick two school-incident headlines you can show without turning the meeting into a news recap. Slide 1 — What MFA is Job: make MFA ordinary, not a science project. Must cover: • A password is one factor (something you know). MFA adds a second — something you have (phone prompt, authenticator app, hardware key) or something you are (fingerprint, face). • Two or three examples people already use: bank, IRS / Social Security / state tax, Apple or Google account. • How long the extra step takes in real life (seconds, not a new workflow). Leave off: vendor logos, “zero trust,” threat-actor names. Slide 2 — Why MFA Job: why this board, this year — insurance, a real incident, and what MFA actually stops. Must cover: • The common school failure: a staff password is phished, reused, or leaked; without a second factor the attacker is in email, SIS, or admin tools. • Say plainly that MFA is not unhackable. It blocks that common case. • Insurance: cyber liability carriers generally require MFA on email, remote access, and systems with sensitive records. Quote your broker, not a blog. If they have not answered yet, the slide says “we are confirming with [broker] by [date].” • Visualization: two headlines (one sentence + source under each), not a collage. Prefer incidents where missing MFA or a stolen password mattered, plus one that shows school actually stopped (closed days, SIS down, parent portal dark). Starter sources (verify before you project them): – PowerSchool, Dec 2024 — support portal without MFA, student/staff records across many schools. security.org/identity-theft/breach/powerschool – Rainbow District School Board, Feb 2025 — ransomware; Ontario privacy commissioner found MFA was not on the compromised account. ipc.on.ca, “Rainbow District School Board Cyberattack” – Evanston Township High School, June 2026 — two-day closure after ransomware. Chicago Tribune, June 8, 2026 Leave off: scare statistics you cannot source in the room. Slide 3 — Where MFA goes Job: the list of systems, not “all the things.” Must cover: • Every staff account that can reach student or staff personal information — not only the technology director. • Walk the list you actually run: staff email; SIS and parent-portal admin; finance / payroll / HR; Google or Microsoft admin; VPN or other remote access; special education, health, counseling; then any other vendor with PII. • Named accounts. No shared office password. Leave off: student MFA (that is a later ask unless you are already doing it). Slide 4 — What MFA will look like Job: show the thing, don’t describe a future purchase. Must cover: • You have already chosen the method that fits systems you run. Name it. Do not shop vendors in the meeting. • Two screenshots from a real staff sign-in: (1) after the password, (2) the phone prompt, number-match, or key tap. • Enrollment in one sentence: first time vs every day after. • Lost phone, substitutes, and shared machines — one line each, or the board will invent the policy for you. Leave off: a demo environment, a vendor pitch deck, student-facing screens. Slide 5 — The ask Job: year-1 cost, ongoing cost, time, and what this does not buy. Must cover: • Year 1 dollars and what they buy (licenses, keys, help turning it on). • Ongoing dollars per year. • Staff time: days, over how many weeks, for how many staff, including turning off password-only access. • What you will stop doing to make room. • What this request does not fund (backups, EDR, another technician). Say it so MFA is not mistaken for the whole cyber program. Slide 6 — Questions Job: empty slide, full answers. On the slide: the word “Questions.” Have answers ready for: • Staff with no district phone • Lost or replaced phone • Substitutes and lab / shared machines • Why not wait until next budget (tie to insurance renewal if that is the real date) • “Isn’t this just a stronger password?” • Student accounts (not in this request unless they are)