Project Safeguard

Security challenge

Students are known to test boundaries, and the internet is prime territory for that. Because of this, schools need clear and consistent safeguards to protect students, staff, and district systems.

Staying ahead of this requires continuous review, proactive updates to systems and procedures, and a coordinated approach to managing devices, access, and network security.

phased solution

Over the next six months, we will implement a series of planned steps designed to create a more secure network/internet environment.

project safeguard

Measured changes to technology policies and procedures

August-September

February-April

March-June

?Feb-July

April-June

WHAT IS CERTIFICATE-BASED AUTHENTICATION?

project safeguard

Phased refinement of technology policies and procedures

Certificate-based authentication verifies that a device is a PRSD-manged device before being allowed onto the internal network. Instead of relying only on usernames and passwords (which can be shared, guessed, or stolen), each district-managed device is issued a unique digital certificate - like a secure, tamper-resistant ID installed on the device. When the device connects to Wi-Fi or another protected system, it automatically presents its certificate, which is securely stored in the device’s operating system. The network’s authentication server checks that certificate with a trusted authority before granting access. If the certificate is valid, access is allowed. If not, the device is blocked. This approach improves security because certificates cannot be casually shared like passwords. It enables the district to allow only approved, properly configured devices onto staff or student networks, while keeping network activity traceable for safety and accountability.

September

June

March

February

April-June

WHAT DOES CERTIFICATE-BASED AUTHENTICATION INVOLVE?

3. Test Testing ensures:

• Valid district device connects

• Personal or expired device is denied

• Correct network access is applied

4. Deploy & Monitor

• Pilot → district rollout

• ClearPass logs every connection

• Only district-managed, trusted devices enter secure networks

2. Configure

• ClearPass checks certificate+ device type

• Assigns access:

1. Setup

• District issues digital certificates to managed devices

• ClearPass trusts those certificates

• Wi-Fi, switches, and firewall point to ClearPass

Staff → Staff networkStudents → Student networkUnknown → Guest or blocked

RESULT: Network access is based on verified device identity, not passwords.

GUEST WIFI IS CHANGING

To keep students and staff safe, we are moving from open guest Wi-Fi to a sponsored access model during the school day. Visitors can still connect — but in a way that is monitored, temporary, and accountable.

During School Hours

Step 5 — Automatic Expiration

Step 4 — Safe, Limited Internet

Step 3 — Temporary Credentials

Step 2 — Sponsored by Staff Office staff confirms the visit and serves as the guest’s network sponsor.

Step 1 — Check In Visitors stop at the main office/front desk.

Guest Wi-Fi:

• Is separated from student and staff networks

• Provides general internet only

• Cannot access school systems or student/staff accounts

Visitors receive:

• A temporary login or QR code for Wi-Fi access
• Access valid only for the visit

Access ends automatically when the visit concludes.

After School Hours (Events & Community Use) To support evening activities the guest network will be open after school hours. Access will be available only in designated public areas such as Lobby, Auditorium, Cafeteria, Gym, and Stadium allowing event attendees to connect while keeping academic and administrative spaces protected.

project safeguard

Phased refinement of technology policies and procedures

updates to policy & procedure

September

June

March

February

April-June

Pentucket Regional School District (PRSD) provides technology and network access to support educational, administrative, and community functions. All users — including students, staff, and guests — must use district networks in ways that are respectful, private, safe, and aligned with educational objectives. The district also recognizes that community members who visit schools during events may require temporary internet access. This policy section defines the conditions under which guest network access will be provided to support visitor connectivity while maintaining the security and integrity of PRSD networks.

Implementation

Guest Network Access

Policy

KEY UPDATES: District-issued devices required • Sponsored guest access during school hours

• General Expectations
• All users of PRSD network resources - including the guest network - are subject to applicable district policies, including IJNDB Digital Use Policy, IJNDB-R Digital Use Policy Rules & Regulations for All Users and IJNDBA Social Networking Policy.
• Use of PRSD network resources is a privilege, not a right. Access may be revoked for violation of this policy or misuse of the network.
• Student Device Use on District Networks
• To maintain network security, student safety, and consistent instructional access, students shall use district-issued devices when connecting to school instructional or internal networks, on school premises.
• Personal student devices shall not be used to access district instructional or administrative systems.
• Students who have not previously received a district device will be issued an available district device upon request.
• Use of any device on district networks remains subject to all applicable digital use policies and regulations.

• Sponsored Guest Access (During School Hours)

• During the instructional day, guest network access will be provided only through sponsored authorization.
• Visitors must check in at the main office or reception area and be verified by school staff. A staff member will act as a sponsor before access credentials are issued.
• Temporary credentials will be issued that:
• Are valid for a limited duration tied to the visit.
• Provide access only to the guest wireless network.
• Do not provide access to student or staff networks, school systems, internal resources, or restricted data.
• Guest network users must adhere to all applicable digital use expectations, including appropriate conduct and privacy protections.

• After-Hours Public Access

• To support community events and activities outside normal school hours, the guest network may be open in designated public spaces (e.g., lobby, auditorium, cafeteria, athletic areas.
• After-hours public access does not require sponsorship but remains limited to the guest wireless network and is not permitted to access student or staff systems or internal PRSD resources.
• Acceptable Use
• All guest network users must conduct themselves in a manner consistent with district expectations for responsible use, including refraining from:

• Illegal activities or content that is offensive, harassing, or discriminatory.
• Accessing or attempting to access restricted networks or secure resources.
• Sharing or disclosing personal or private information about others.
• Privacy and Monitoring
• PRSD may monitor and log network activity to protect network resources and ensure compliance with district standards.
• Users should have no expectation of privacy regarding network use or activity logs.
• Consequences
• Violation of this policy may result in:

• Immediate termination of network access.
• Revocation of future access privileges.
• Referral to appropriate district authorities for enforcement consistent with other technology and student/staff conduct policies.

COMMUNICATION & ROLLOUT

Goal: Ensure families, staff, and students understand new network access procedures and device expectations before school begins. District & School Leadership

• Principal communication to families and staff
• Consistent messaging across all schools

Student Device Expectations

• Students will use district-issued Chromebooks during the school day

• Personal devices will not be used for school network access

• Students who did not receive a Chromebook during the Grade 7 1:1 rollout will be issued an available district device

Student Awareness

• Principal communicates procedure/policy change during class meetings
• Reminders posted to class email distribution groups

Family Information

• Notice in Back-to-School newsletter
• Back to School Policies form (all parents must sign annually) will include guest Wi-Fi and device procedures

Policy Alignment

• Updated language in annual digital use acknowledgment
• Clear expectations for network and device use

Front Office Procedures

• Staff guidance for visitor check-in
• Consistent process for issuing temporary guest credentials

Device Rotation & Inventory Prep

GRADE 6 CHROMEBOOK REFRESH

• All current Grade 6 devices will be evaluated, repaired as needed, and prepared for continued use.
• The strongest working units will be added to the district’s inventory for MSHS students who do not already have a school-issued device.
• This ensures the district has sufficient managed devices as we move toward a district-only device model.
• This process also supports the scheduled refresh cycle for aging Grade 6 Chromebooks.

Device Rotation & Inventory Prep

GRADE 6 CHROMEBOOK REFRESH

• All current Grade 6 devices will be evaluated, repaired as needed, and prepared for continued use.
• The strongest working units will be added to the district’s inventory for MSHS students who do not already have a school-issued device.
• This ensures the district has sufficient managed devices as we move toward a district-only device model.
• This process also supports the scheduled refresh cycle for aging Grade 6 Chromebooks.

CERTIFICATE-BASED AUTHENTICATION

ONLY AUTHENTICATED DISTRICT DEVICES CAN ACCESS THE NETWORK

Server verifies

Device sends certificate

Access granted

Device Rotation & Inventory Prep

GRADE 6 CHROMEBOOK REFRESH

• All current Grade 6 devices will be evaluated, repaired as needed, and prepared for continued use.
• The strongest working units will be added to the district’s inventory for MSHS students who do not already have a school-issued device.
• This ensures the district has sufficient managed devices as we move toward a district-only device model.
• This process also supports the scheduled refresh cycle for aging Grade 6 Chromebooks.

IMPLEMENTATION

In coordination with building administration, Technology will implement procedures to support this policy, including:

• Processes for check-in and authorization,
• Credential issuance and expiration controls,
• Network segmentation and security measures,
• Communication materials for staff and visitors.

In a Nutshell

What This Means

For Students

• Students use school-issued devices for classroom and school network access.
• Personal devices will not connect to school instructional or internal systems.
• Students who do not have a district device will be issued one.

For Visitors

• During school hours, guests receive temporary sponsored access through the main office.
• After school hours, public Wi-Fi may be available in designated event spaces.
• Guest access provides internet only, not school systems.

For the School Community

• These changes improve student safety, network security, and instructional consistency.
• Use of the network remains subject to district digital use expectations.

What Stays the Same

• Learning continues with district technology.
• Community events can still offer guest Wi-Fi access.
• Digital use expectations and monitoring remain in place.

guest network access definitions

Guest Network: A wireless access network distinct from student and staff instructional and administrative networks, intended for short-term visitor access.Sponsored Access: A model in which a district staff member verifies a visitor’s presence and purpose, and authorizes temporary access credentials. After-Hours Public Access: Open Wi-Fi access available in designated public areas during school events outside of normal instructional hours.

• All current Grade 6 devices will be evaluated, repaired as needed, and prepared for continued use.
• The strongest working units will be added to the district’s inventory for MSHS students who do not already have a school-issued device.
• This ensures the district has sufficient managed devices as we move toward a district-only device model.
• This process also supports the scheduled refresh cycle for aging Grade 6 Chromebooks.

GRADE 6 CHROMEBOOK REFRESH

Device Rotation & Inventory Prep

CERTIFICATE-BASED AUTHENTICATION

ONLY AUTHENTICATED DISTRICT DEVICES CAN ACCESS THE NETWORK

Server verifies

Device sends certificate

Access granted

OCERTIFICATE-BASED AUTHENTICATION

ONLY AUTHENTICATED DISTRICT DEVICES CAN ACCESS THE NETWORK

Server verifies

Device sends certificate

Access granted

Aruba Networks ClearPass Config

OCERTIFICATE-BASED AUTHENTICATION

ONLY AUTHENTICATED DISTRICT DEVICES CAN ACCESS THE NETWORK

Server verifies

Device sends certificate

Access granted

Aruba Networks ClearPass Config

OCERTIFICATE-BASED AUTHENTICATION

ONLY AUTHENTICATED DISTRICT DEVICES CAN ACCESS THE NETWORK

Server verifies

Device sends certificate

Access granted

Aruba Networks ClearPass Config

guest network access definitions

Guest Network: A wireless access network distinct from student and staff instructional and administrative networks, intended for short-term visitor access.Sponsored Access: A model in which a district staff member verifies a visitor’s presence and purpose, and authorizes temporary access credentials. After-Hours Public Access: Open Wi-Fi access available in designated public areas during school events outside of normal instructional hours.

In a Nutshell

What This Means for Our School Community

For Students

• Students use school-issued devices for classroom and school network access.
• Personal devices will not connect to school instructional or internal systems.
• Students who do not have a district device will be issued one.

For Visitors

• During school hours, guests receive temporary sponsored access through the main office.
• After school hours, public Wi-Fi may be available in designated event spaces.
• Guest access provides internet only, not school systems.

For the School Community

• These changes improve student safety, network security, and instructional consistency.
• Use of the network remains subject to district digital use expectations.

What Stays the Same

• Learning continues with district technology.
• Community events can still offer guest Wi-Fi access.
• Digital use expectations and monitoring remain in place.