The purpose of this document is to provide timely and useful best practice information to help education agencies proactively prepare for, appropriately mitigate, and responsibly recover from a cybersecurity incident. This resource reflects lessons learned by the education community and provides recommendations that will help agencies protect their systems and data before, during, and after a cybersecurity incident. This document focuses on cybersecurity, with a specific emphasis on data, from the perspective of the education data community. This resource is not intended as a comprehensive cybersecurity prevention and protection plan, and not all aspects of cybersecurity incident response are addressed. Rather, this document focuses on key activities intended to minimize the likelihood of a cybersecurity incident and help education organizations respond if an incident occurs. This resource provides best-practice information to help state education agencies (SEAs) and local education agencies (LEAs) before, during, and after a cybersecurity incident to: (1) build awareness about why cybersecurity is important to education agencies; (2) help education organizations identify, mitigate, and protect against potential security risks, vulnerabilities, and threats; (3) focus on how agencies can prepare for, mitigate, and recover from a cybersecurity incident; and (4) identify solutions that will help agencies protect their systems and data before, during, and after an incident.