Ok .... Bad news and Good news ... depending ...
found your site on CloudWays. It is a version 2.9.x and probably is vulnerable to the issue reported to you by your IT department. So if you to continue to host there (see the good news below), then upgrade the Moodle.
The Good news ... back in 2014 your school district began to use Schoology but they also embarked on Google for Education ... Google Drive etc. for all campuses/all students ... assuming that has continued, you and your students already have google accounts.
For you that really is good news ... but there are *IF's* ...
First, your IT department would have to install either a Ubuntu 16.04 or a CentOS 7 image on Google's Compute Engine giving that instance more memory and cores etc. than you probably have now where you are hosted. Just a minimal install of the OS's. Next they could install an open sourced cPanel called Webmin on that instance to help admin the instance.
It would have a public IP address and IT department could give your server a FQDN ... needed for Moodle or any hosting ... something like mrbixel.yourISDtopLevelGoogleDomain.org. Server will have ssh access via a Google authenticated control panel and it's through that moodle could be installed via git ... which means it's easily updateable and upgradeable.
The IT department is in control of that instance ... should you retire or take employment else where (don't see that happening anytime soon), the IT department simply deletes the CGE instance and removes DNS that pointed to it. Each GCE has it's own firewall ... here again, IT department would be involved.
Now the *really good news* ... versions 3.3+> of Moodle have Google Oauth2 as part of core for Authentications. If you set that up and restrict the domain in Moodle to just the EMail domains used by your school ... how much more secure can you get?
Install a fresh 3.3 or 3.4 and simply restore backups of your 3 courses onto the new host.
You get to keep your quizzes ... and gain ... unlimited Google Drive space ... for you and your students. The use of Google docs and any Google extensions.
It would take some time to set all that up and get your course backups installed on the new digs.
The beauty (depending) of such a thing ... IT is being pushed to use their Google Cloud ... in a way they may not have thought about before. And they can turn admin of that server over to you ... without any worry! (if you are willing to learn a little more about things like Webmin.
Now I wouldn't suggest such a thing without having some experience at it ... I do have a Google Compute Engine instance running CentOS 7 with version 3.3 of Moodle that is using Google Oauth2 (my personal, not a Google Domain for Education). All that does work. Even setup a demo of exactly the same same thing for a small district in South Texas that had 'gone google' some time ago. But, teachers opted to use Google Classroom exclusively.
You have my addie via PM on this system if you'd care to discuss/cuss this some more.
'spirit of sharing', Ken