A framework for digital resilience in higher education IT

Sponsored by: Kaseya

This is a guest blog post by International Data Corporation (IDC), the global market intelligence leader, sharing independent insights on the state of IT in the Education industry.

Educational institutions depend on technology for nearly every function they perform. As that dependence has grown, so has the risk that a single disruption can cascade across the institution in unpredictable, slow-to-recover ways. IDC’s Education Digital Resilience Framework, published in July 2026, offers a structured approach for getting ahead of that risk.

Higher Education’s IT Complexity Paradox

Five or six years ago, the dominant concern in higher education IT was sprawl: too many systems, too many vendors, too little integration. That problem has not gone away, but it has been joined by an equal and opposite one.

Around the core mission-critical applications that institutions run on, including the ERP, student information system, and LMS, the market has consolidated. According to ListEdTech, three in four North American universities now rely on the same vendor for both their ERP and SIS. That concentration alone does not create systemic risk, since many institutions are still running on-premises legacy installations that operate independently. The risk materializes when large numbers of institutions migrate to the same vendor’s cloud-hosted platform or rely on the same underlying cloud infrastructure provider. A cyberattack or outage at a single point can then take thousands of institutions offline simultaneously, as recent incidents targeting large education technology providers have shown. 

At the same time, fragmentation around those same applications has increased. Departments keep investing in point solutions, IT spending stays siloed, and shadow IT persists, a trend AI adoption has accelerated. In IT operations alone, institutions may run separate tools for endpoint management, backup, monitoring, documentation, and security, often with overlapping capabilities and no integration between them. As a result, more than half of respondents to IDC’s Government and Education Buyer Intelligence Survey said their institutions rely on a broad, poorly integrated ecosystem of providers. 

The result is that institutions are now more consolidated at the center and more fragmented at the edges. The web of dependencies connecting systems, staff, and vendors is growing faster than most institutions’ ability to see and manage it. 

IDC’s Education Digital Resilience Framework 

IDC defines digital resilience as the ability to prepare for, adapt to, and recover from disruption while capitalizing on the changed conditions. Recovery alone returns an institution to where it started. True resilience uses disruption as an opening to redirect resources, retire what no longer serves students, and strengthen the institution’s long-term position.

The framework is designed for IT and non-IT leaders alike. It maps resilience across five interconnected dimensions:

• Organization: Leadership alignment, governance, key-person risk, and the institution’s readiness to execute change across departmental lines, including assessing where knowledge and decision-making authority are concentrated in a single person or small team.

• Finance: Resource decisions under constraint, including scenario planning against enrollment and funding exposures, near-real-time financial visibility, and treating the budget as a forward-looking tool for deciding where the institution goes next rather than a record of last year’s commitments.

• Operations: Continuity of instruction, enrollment, advising, and student services through disruption. Many of the processes that sustain these functions are manual, undocumented, and cross departmental boundaries. Financial aid is a common example: It is a lead dependency for admissions, enrollment, registration, and advising, but that chain is often invisible until something breaks.

• Technology: Cybersecurity, data governance, infrastructure reliability, and disaster recovery. The framework assumes a breach will eventually happen and emphasizes limiting how far it spreads and how fast the institution detects, contains, and recovers. This includes resilient application design: identity and access management, open data standards, zero-trust architectures, automated backups, and offline capabilities.

• Ecosystems: Vendor lock-in, third-party risk, contract terms, and the external partnerships that extend the institution’s capacity. This is where resilience and procurement intersect, and where institutions need to identify single-provider lock-in with no ready alternative.

These dimensions are interconnected. Progress in any one depends on coordination across the others.

Where to Start 

The foundational step is a comprehensive dependency audit: inventorying every system, data flow, integration, and vendor relationship; mapping how those dependencies connect across departments and third parties; modeling the ways they can fail; and ranking by criticality and concentration. Most institutions have never done this comprehensively, and it is what makes everything else in the framework actionable.

From there, institutions should consider five critical steps to build digital resilience maturity:

1. Map dependencies, vulnerabilities, and supply chain risks. Inventory every system, data flow, integration, and vendor relationship. Rank by criticality and concentration. Most institutions have never done this comprehensively, and it is what makes everything else actionable.

2. Invest in dedicated resilience and business continuity leadership. Assign a leader with cross-departmental authority who owns resilience strategy and execution end to end, not as a part-time add-on to an existing role.

3. Stand up resilience working groups that include frontline staff. Leaders consistently miss the dependencies and workarounds that the people doing the work see every day. These groups surface the ground-level knowledge that audits alone cannot capture.

4. Simplify the technology ecosystem. Retire redundant and end-of-life systems, consolidate overlapping vendors, and remove integrations that persist only out of habit. Every system removed is one less point of failure, one less attack path, and one less thing to patch, fund, and recover.

5. Close knowledge gaps before they walk out the door. Document mission-critical processes and cross-train staff so no function depends on a single individual. Treat the dependency map, the inventory, and the gap list as living practices rather than a one-time project.

The institutions that begin this work now will be better positioned to absorb the disruptions ahead and to use them as a catalyst for long-overdue change.

Message from the Sponsor (Kaseya)

Kaseya provides IT management and cybersecurity solutions designed specifically for the operational and budgetary constraints facing K-12 districts and higher education institutions. Its platform helps lean education IT teams automate routine management tasks, maintain visibility across endpoints and strengthen security and recovery capabilities without requiring significant increases in headcount or capital spending. Kaseya’s solutions scale with the needs of educational institutions, from small districts to large university systems, and integrate with the tools and infrastructure already in place.