Why your District’s First Cyber Crisis Shouldn’t Be During a Real Attack

October is Cybersecurity Awareness Month. Learn more about how the LTC can make your school’s team more cyber-aware with staff trainings, consultations, and resources →

When a cyber incident strikes, every school district has a plan. 

(Or at least, they should have a plan).

That incident response plan sits in a folder on a network drive or in a binder on a shelf. It lists escalation procedures, technical contact numbers, and data recovery steps. It may or may not be updated regularly.

On paper, the district is prepared.

In reality, an incident response plan is only a set of assumptions until it is tested. And when a real cyber incident occurs, the biggest surprise is rarely technical. Many school leadership teams are blindsided by the sheer volume of non-technical decisions they must immediately make, often under intense pressure.

• Who decides when to take critical systems offline? 
• Who notifies staff and parents?
• What do you say when you don’t yet have all the answers? 
• What happens if your communication systems themselves go down?

If your leadership team is answering those questions for the first time during an active breach, you aren’t responding to an incident. You are experimenting during an emergency.

When a cybersecurity incident hits a district, whether it’s ransomware, a compromised administrator account, or a system-wide outage, the immediate focus naturally falls on its technical roots. IT teams work to isolate infected systems, determine how the attacker got in, restore from backups, and engage forensic experts.

Think about it like this: while the IT team is analyzing logs, other key stakeholders will also be compelled to take actions commensurate with their role:

• Superintendents and communications teams must decide what to tell board members, staff, media, and parents, balancing transparency with legal and regulatory constraints.
• Business and HR directors must determine how payroll will run if financial software is inaccessible, or how substitute coverage will be managed if automated systems are down.
• Principals and operations staff need to know how to take attendance without digital rosters, coordinate student transportation, and run food services without point-of-sale systems.

These are all critical decisions, but none of them are strictly technical decisions. They are organizational decisions, requiring organizational leadership to coordinate and implement strategically. 

Yet, without prior preparation, district leaders often look to the technology department to tell them what to do next.

In the early moments of a critical incident, information is often incomplete, fluid, and even contradictory.

That’s a recipe for chaos.

Imagine this scenario: on an average Tuesday morning, a critical system begins exhibiting suspicious activity. The technology department needs to isolate the network segment to keep the threat from spreading to other systems. Doing so will immediately take down student record access, food service point-of-sale systems, and phone lines across three schools.

After the technology team leader determines a plan of action, they need to pause and ask:

• Does IT have the authority to pull that plug instantly? Or do they need clearance from the superintendent first?
• If the superintendent is in a meeting or off-site, who holds secondary approval?
• How long can the district afford to wait while that approval is sought?

Without pre-established protocols and clear authorization pathways, hesitation like this creates delays, and in cybersecurity, delays give threats room to spread. 

Conversely, taking systems offline without operational coordination can cause unnecessary panic and disrupt essential student services. Avoiding either type of chaos is imperative, especially in the early moments of an attack when there are still significant gaps in what’s already known and what’s still unknown.

How do you bridge that gap between a written policy and actual preparedness? And how do you preemptively coordinate incident response and business continuity priorities?

Three words: practice, practice, practice.

In the realm of physical safety, schools don’t rely solely on written emergency manuals; they conduct fire, severe weather, and safety drills so that response among staff and students becomes muscle memory. 

Example Scenario:

1. Start Small: “An administrative assistant notices strange outbound emails from a colleague’s account.”
2. Escalate: “By noon, several core network shares are inaccessible, and a ransom note is discovered on a server.”
3. Inject Complications: “A local reporter calls the district office asking about a reported network outage before internal messaging has been finalized.”

The goal of a tabletop exercise is not to test technical skills or assign blame. These practice runs are designed to reveal communication gaps, clarify roles, identify friction points in policy, and build trust among executive leadership before high-stakes decisions are required. 

When the exercise ends, a structured After Action Review turns what the team learned into a launchpad for meaningful policy and procedure updates (incident response plans included).

Cyber resilience isn’t defined by having a flawless network that can never be breached (bad news: that perfect network doesn’t exist). Resilience is measured by how effectively, calmly, and cohesively an organization reacts when something goes wrong, and it starts with practice.

When district leaders, technology directors, and other key stakeholders regularly walk through hypothetical worst-case scenarios, the dynamic changes:

• Unclear approval chains get simplified
• Communication templates get drafted in advance
• Backup communication methods, like phone trees or alternate messaging channels, get established and tested
• Most importantly, process and preparation replace fear and panic

Your first crisis shouldn’t be the first time you test your plan. Our Technology Services team can help your district refine its incident response and business continuity procedures in advance.

Reach out during Cybersecurity Awareness Month or any month to learn how we can facilitate a tabletop exercise with your leadership team →