Cyber Insurance Training Requirements for Schools: What Applications Ask and What to Keep

The Training Questions Cyber Insurance Applications Ask

Indiana's Office of Technology publishes sample underwriting questions in its cyber insurance toolkit. Three of them cover training:

• "Does the Applicant conduct regular cybersecurity awareness training?"
• "Does the Applicant train its employees on social engineering?"
• "Does the Applicant conduct email phishing simulations?"

Training isn't the only thing insurers look for. Ongoing staff training is one of five safeguards insurers might require of K-12 schools, in EdTech Magazine's October 2026 report. The others are multi-factor authentication (MFA), endpoint detection and response (EDR), verified backups kept separate from the main network, and a documented incident response plan.

How Often Insurers Expect Security Awareness Training

Insurers differ in how hard they push.

• A growing number of insurers make training mandatory when they issue cyber policies, EdTech Magazine reported in July 2026.
• Homer CCSD's insurer asked the district to offer training. "They weren't saying we had to mandate it. They just wanted us to offer it," the district told the magazine.

In Tartan's calls with schools in 2026, the schedules insurers asked for ranged from phishing simulations every quarter to monthly simulations and training. One insurer asked for once a year but said it preferred every six months. Several schools must repeat training every year, including for staff hired mid-year.

So pick a schedule you'd be happy to defend to any insurer. Ours: train every staff member at least once a year, and run phishing simulations on a fixed cycle all year. Then "regular" on the form just describes what your school already does.

If union rules limit training time, short videos with a quiz, plus training at the moment someone clicks, meet the requirement without a long session.

Tartan App runs simulations on an automatic 15, 30, 60, or 90-day cycle. Each person gets one email per cycle, at a random time, from 110+ templates. Training videos are short and end in a quick quiz. For setup steps, see how to run phishing simulations in a school.

If Your Insurer Already Provides Training

Some schools get phishing simulations or training from their insurer or risk pool. In Tartan's 2026 calls with schools, more than 20 districts said they do. The common complaints were that simulations come once a quarter at most, use a handful of templates, and send the same email to everyone, with no follow-up training for people who click.

Before you rely on it, check three things: how often it runs, whether people who click get training, and whether it gives you a report you can file. Some districts lost their insurer's tool when they changed insurers.

What to Keep in Your Renewal File

Build the file before the renewal questionnaire arrives.

In Tartan, the file fills in as you go. Completion tracking shows who has finished each video and their quiz results, and you can resend to everyone who hasn't finished in one click. Reporting tracks a phish risk score by school, department, or difficulty, and shows who reports simulations as well as who clicks. Results export to CSV, and regular summary emails are ready to share with leadership.

See which simulated emails school staff click most.

Who Answers the Application

In most districts that told us, the superintendent, CFO or business manager signs the application. Send them the report before renewal so the answers match your records.

How Cyber Insurance Is Changing for Schools

Schools rarely lose coverage. In CoSN's 2026 State of EdTech survey, fewer than 0.5% of districts were denied coverage or renewal. More than a fifth (23%) are part of a statewide pool. The change most districts feel is the bill.

Insurers can also tie coverage to other controls. In 2022, as premiums rose for districts across Illinois, Bloomington District 87 saw its premium rise 334%, and its coverage limits were reduced until it fully implemented MFA.

The policy earns its cost when something goes wrong. In the same survey, 56% of districts that had an attack got help from their insurer or used its incident response service. Among schools hit by ransomware in Sophos's 2026 survey, malicious email was the most common technical root cause, at 31%.

A Low-Cost Way to Meet Cyber Insurance Training Requirements

Tartan App covers all three training questions in one program: short training videos on phishing, impersonation, and phone and text scams, phishing simulations on an automatic cycle, and the completion and click reports for your renewal file.

For public schools and school boards, it's priced per school with unlimited staff, so adding staff never raises your cost. For a district with one school, Employee Phishing Simulation Training is $116 a year and Employee Video Training is $30.

See Tartan's pricing or what security awareness training costs across vendors.

Cyber Insurance Training FAQ