How the district's multi-function printer fleet is procured and serviced. Leased managed-print service is the dominant TX K-12 pattern (Konica Minolta, Ricoh, Canon, Sharp, Xerox), but owned fleets and hybrid postures are defensible. No hard finding — "ad-hoc" is operational immaturity, not a security failure, and very small districts can defensibly skip district MFPs entirely.
Whether print management software (PaperCut, Equitrac, Pharos, similar) is deployed, and whether secure release is enforced at the MFP. Secure release has a real FERPA angle in K-12 — student records, IEPs, gradebooks, and parent communications all get printed, and open queues leave those documents in unattended printer trays. Open queues are a hard finding for that reason; many districts deploy PaperCut for accounting/quota and skip secure release due to user-friction trade-offs (below max but workable).
Three sub-disciplines packed into one ladder: firmware update cadence on MFPs, default admin credentials changed, and MFPs on a dedicated VLAN. CISA-flagged pattern for K-12 — networked MFPs are embedded Linux devices that nobody patches, and defaulted-credential MFPs on the general LAN have been documented initial-access vectors. Cross-ref NET-ARC / NET-WI for the segmentation-side capture; F3 here is operational posture only and doesn't cross into detection/response tooling (legacy-cyber Endpoint Defense territory).
Smaller printers outside the MFP fleet — desktop printers in offices, classroom printers, specialty department printers. The discipline question is whether they're tracked and procured through a documented process or accumulate organically as departments request them. Refresh and disposal of these printers belong to EUC-LCY, not here. No hard finding — operational gap, not security failure.
Non-printer specialty equipment that lives across the district: 3D printers in CTE / STEM, label printers in athletics or nutrition, thermal printers in libraries or badge issuance, podcasting / streaming gear in journalism or media programs, specialty CTE equipment. The inventory discipline matters because the equipment is often expensive and replacement cycles need to be tracked; districts with active CTE programs typically maintain a real inventory for asset-management and grant-reporting purposes. No hard finding — operational variance is wide and there's no clear security threshold.
How peripheral break/fix gets handled. Distinct from EUC-STF F8 and EUC-STU F10 (general staff/student helpdesk) — this field captures specifically whether peripherals (printers, headsets, webcams, specialty equipment) have a documented support model or whether everything funnels through general IT. Ad-hoc handling is a hard finding: specialty peripherals that students depend on for instructional use (3D printers in a CTE class, podcasting gear in journalism) lose value the longer issues sit in inboxes.