Cyber Academy course

Leading the first hour of a cyber incident

A 18-minute Cyber Academy course for school & district leaders. When ransomware locks screens or an extortion email arrives, the first hour sets the tone for everything after. Learn who belongs in the room, the decisions only leaders can make, how to keep school running on paper and how to speak to families, staff and media with one calm voice. 6 sections, 8-question knowledge check, a branching practice scenario and a completion certificate. The companion guide gives managers the outline, a huddle plan and the answer key.

Time to use: 18-minute course
Audience: Leaders
Language: English
Formats: PDF

Take the course (sign in)Try the free 2-minute lesson

First page preview of Leading the first hour of a cyber incident

What's inside

Section: 7:10 AM: every screen says the same thing
Section: Who is in the room
Section: The first-hour checklist
Section: Running the school day on paper
Section: Communicating with families, staff and media
Section: Practice: a 15-minute cabinet tabletop
8-question knowledge check with explanations
Branching scenario: The reporter calls at minute 40
Completion certificate (named accounts)
Printable companion guide with facilitator notes and answer key

Learners will be able to

Assemble the right first-hour team and give the technology team clear authority to contain the incident.
Make the leader-level first decisions: safety, instruction continuity, evidence, and no payment or negotiation without counsel and the insurance carrier.
Start the key notifications: cyber insurance hotline, legal counsel, the FBI and IC3, CISA and Georgia's state reporting channel.
Run the school day on paper so students stay safe and learning when systems are down.
Communicate with families, staff and media using a holding statement, one voice and a steady update rhythm.