Every school district should be able to answer three very simple questions about their IT and student data security practices.