Skip to main content

School & district leaders

The first hoursets thewhole response.

Safety, containment, evidence, one voice. Decide who does what before you need to.

  • 2-minute lesson
  • Free · no sign-in

  1. 1Why it matters

    Who is in the room

    Gather a small core team within the first 15 minutes, in person or by phone. Assume district email and chat may be down or watched; the CISA ransomware guide recommends out-of-band communication, such as phone calls, while responders work.

    • Incident lead and decision maker: the superintendent or a named designee
    • Technical lead: the technology director or IT lead, plus any security partner already under contract
    • Communications lead: the district communications director, who becomes the one voice for families, staff and media
    • Legal counsel: the district's attorney, for privilege, notification duties and any contact with criminals
    • Finance and insurance: the chief financial officer or business manager, who has the cyber insurance policy and hotline number
    • Affected principals: for what is happening in buildings right now
    • Operations and safety: transportation, school nutrition, facilities and school safety, who know which safety systems depend on the network: door access, cameras, intercoms, phones
    • Student services and HR: for student records, health information and staff questions
    • Scribe: one person who keeps a timeline of decisions, calls and times from the first minute

    Keep the core team small. Everyone else gets clear tasks and a time for the next update. Keep a printed contact sheet with cell numbers for all of these roles, because the address book may be on a system that is down.

  2. 2Do this

    • Assemble the core team

      Superintendent or designee, technology lead, communications, legal counsel and the cyber insurance hotline.

    • Give IT containment authority

      Isolate, don't wipe. Preserve evidence; do not pay or negotiate without counsel and the insurer.

    • One calm voice

      A short holding statement, set update times, no speculation and an out-of-band channel if email is down.

    First-hour calls
    • Insurance hotline
    • Legal counsel
    • FBI field office / IC3
    • CISA
    • State reporting

    Not sure it's real? Treat it as real until IT says otherwise. Starting the checklist early costs little; starting late costs a lot.

  3. 3Quick check

    In the first hour of a ransomware incident, what is the leader's most important decision about the technology team?
    Scenario: At 7:12 AM a helpful teacher says, "Let's shut down every computer in the building and run the cleanup tool." What do you tell staff?

    Choose an answer for each question.

Want credit for this?

Sign in to Cyber Academy to take the full course, record your progress and earn a completion certificate.

Full course: Leading the first hour of a cyber incident · 18 min

Sign in for credit
Sources

We count visits to this page in aggregate only. No cookies, no accounts, no personal data.