A school can have a cyber incident response plan and still be unprepared for the first 30 minutes of an incident.
The plan may be technically sound. The contact list may be current. Backups may exist. Yet when a staff member reports a suspicious screen, student systems become unavailable and phones begin ringing, uncertainty quickly moves from the server room to the leadership office.
The fastest way to find those gaps is not another policy review. It is a short conversation built around a realistic scenario.
The Australian Cyber Security Centre says incident response plans should be regularly tested and reviewed. Its free Exercise in a Box materials include discussion-based exercises and 15-to-30-minute micro-exercises. Schools can use the same tabletop principle to run a focused rehearsal with no interruption to live systems.
Who should be in the room?
For a small exercise, invite the people who would make or communicate the first decisions:
- a principal or delegated incident lead
- the school’s IT lead or managed service contact
- a business, operations or administration representative
- the person responsible for staff and family communications
- a teaching and learning representative who understands classroom impact.
The aim is not to test technical expertise. It is to test whether the group knows who does what, what information is needed and how the school keeps operating while facts are incomplete.
The scenario
Read this aloud:
At 9.05 am, three staff members report that they cannot open shared files. One computer displays a demand for payment. The student management system is responding slowly, and a teacher says they opened an unexpected attachment shortly before the problem began. It is not yet clear which systems or data are affected.
Then start the clock. Do not add technical detail unless the group asks for information it would realistically seek.
Minutes 0–5: recognise and contain
Ask the group:
- Who is leading the response?
- Who contacts internal or external IT support?
- What should staff do with affected devices?
- How will the school prevent well-meaning people from deleting useful evidence or spreading the problem?
- Where is the incident recorded?
A useful answer identifies authority and communication paths. It should not depend on one person being available or on contact details stored only inside a system that may be inaccessible.
Minutes 5–15: decide with incomplete information
Introduce a second prompt:
By 9.15 am, access to email is intermittent. The school cannot yet confirm whether personal information has been accessed. Classes are continuing, but attendance and parent contact systems may be unavailable.
Ask:
- Which services are critical for the rest of the day?
- What manual alternatives are available?
- Who decides whether a system should be disconnected?
- What legal, contractual or regulatory advice may be required?
- Who has authority to contact external agencies?
Keep the conversation at decision level. A tabletop exercise should reveal dependencies and unclear responsibilities, not invite participants to improvise technical remediation.
Minutes 15–25: communicate without speculating
Now tell the group that staff are asking for updates and a parent has posted about “a hack” on social media.
Ask the communications lead to draft three sentences:
- what is known
- what people should do now
- when the next update will be provided.
Good incident communication is timely, factual and appropriately limited. Saying too little creates a vacuum. Saying more than the evidence supports can create a second problem.
The group should also decide which audiences require different messages: staff, students, families, the governing body, service providers and, where appropriate, authorities.
Minutes 25–30: capture the gaps
Finish with four questions:
- What decision took too long?
- Which contact, document or system was hard to locate?
- Which role was unclear?
- What is one improvement the school will complete, by whom and by what date?
Do not leave with a long list of ambitions. Choose no more than three actions, assign an owner and set a review date. Examples might include printing an offline contact sheet, clarifying who can authorise an external notification, or testing access to backups.
What this exercise does—and does not—prove
A 30-minute discussion does not validate every technical control. It does reveal whether the school can coordinate its early response, continue essential work and communicate responsibly.
The ACSC’s incident response planning guidance provides a fuller starting point for a plan and readiness checklist. Schools should adapt it to their own systems, obligations and external support arrangements.
The most valuable outcome of the exercise is not confidence. It is a short, honest list of gaps discovered while the incident is imaginary—and time still exists to close them.
Latest posts by John Bigelow (see all)
- Using the 2026 NAP ICT Literacy Option as a School Improvement Tool - October 9, 2026
- Will a New Digital Tool Reduce Teacher Workload—or Move It? - October 8, 2026
- Before Approving an AI Tool: Five Student-Data Questions for Schools - October 7, 2026
You must be logged in to post a comment.
There are no comments
Add yours