At a minimum, universities should map their data and conduct risk assessments to determine which systems are most vulnerable and which would cause the most damage.