Tabletop exercises
Eight school-day scenarios with injects, roles and facilitator tips, plus after-action notes that become actions.
For technology directors and district IT teams
From rubric baseline to reviewed evidence, in one workspace.
K12 Cyber Forward turns the Cybersecurity Rubric 2.0 into a working system: guided ratings with crosswalks, an improvement plan with real owners, evidence that is reviewed by people and a record you can show your superintendent, board or insurer.
The workflow
Baseline, plan, evidence, review.
Built for small teams that wear many hats: each step produces something useful on its own.
- 01
Rate with context
Each of the 22 categories includes control intent, K-12 implementation guidance, evidence examples, quick wins, level-up tips and crosswalks to NIST CSF 2.0 subcategories and CIS Controls v8.1 with Implementation Group flags. Record method and confidence alongside every rating.
- 02
Plan what you can finish
Generate a 90-day plan from the lowest or least-supported categories, assign owners outside IT where they belong and connect actions to the school-year calendar: rollover, access reviews, backups and vendor renewals.
- 03
Collect evidence without the busywork
Use scoped, locally run collection kits for Active Directory, Entra ID and Google Workspace to gather configuration evidence, preview imports and keep artifacts next to the actions they support.
- 04
Get the right review
Evidence is accepted, sent back or expired by a human reviewer. When you need more assurance, request a guided or independent review for a stated scope.
Practical. Every rating comes with a next step someone can take this week.
Your district's first 90 days
From kickoff to a first leadership brief.
A suggested rhythm for the first quarter in the program, built around the people and tools you already have.
Days 1–30
Get grounded
- Name the district contact and the assessment team, including people outside IT.
- Agree the scope and start rating the 22 categories, recording the reasons.
Days 31–60
Pick and plan
- Finish the baseline and choose three to six priorities.
- Give every action a lead and a date, and decide what good evidence looks like.
Days 61–90
Deliver and show
- Close one or two quick wins and attach supporting evidence for review.
- Share a one-page brief with your superintendent and choose a review pathway.
A suggested rhythm, not a deadline. Each district sets its own pace with the program team.
Tools in the portal
Practical tools for the work between assessments.
Vendor registry
Track data privacy agreement status and expiry for the services your schools rely on. DPA guide.
Policy builder
Start policy discussion drafts by category and target level, with citations to the frameworks they support.
Insurance readiness
Carrier-style questions organized by topic with rubric context, to prepare evidence before renewal. Renewal guide.
Learning and campaigns
Original lessons with knowledge checks, awareness campaigns and co-branded newsletters for staff and families.
Named, scoped access
Named accounts, role-based access, authenticator-app MFA and an accountability log of important actions.
Start this month
Three moves that pay off in any framework.
Useful whether or not you join the program.
- Close the MFA gaps. Start with administrator, remote access and staff email accounts. Practical rollout guide.
- Test a restore. Restore one critical system from backup and time it. The number belongs in your next leadership update.
- Run a 60-minute tabletop. Use a school-day ransomware scenario with your cabinet. Checklist.
How long does a baseline assessment take?
It depends on the scope and who takes part. Plan for a series of short working sessions over several weeks rather than one long meeting. A clear scope and the right people in the room matter more than speed.
Who should be on the assessment team?
Include the technology lead plus people who own the processes being rated: someone from the superintendent's cabinet, finance or business operations, human resources, student information and, where possible, a school-level leader. Each person brings knowledge the rubric asks about.
Does a low score mean we failed?
No. A baseline shows where to start. The program is supportive, not punitive: low ratings point to help and practical next steps, and individual district results are never ranked publicly.
How do the three review pathways differ?
Level 1 is self-assessed by the district team. Level 2 adds a named facilitator who helps the team examine the baseline. Level 3 is independently reviewed by a named third-party verifier who issues a time-bounded review record for a stated scope. Compare the pathways.
Does an independent review certify our district?
No. A Level 3 review records what a verifier examined, for a stated scope and period. It is not a certification that any control works, and it does not predict or prevent incidents.
What information goes into the portal?
Professional work information: rubric ratings and rationale, improvement plans, policies, vendor and training records and redacted supporting evidence. Districts should keep student records, staff personal details and passwords out of the portal.
Who can see our district's results?
Each person has a named account and sees only what their role needs. District staff see their own district. GLET staff see what their program role requires to coordinate support. Comparisons between districts are switched off until participating districts agree to rules for sharing. Read the privacy notice.
Where is the data hosted?
On a dedicated server in Atlanta, Georgia. Connections are encrypted and uploaded files are encrypted at rest with keys stored separately from the data.
Built with Georgia technology leaders
Bring your district's baseline into one place.
Request participation and GLET will follow up after reviewing your request.