Ransomware tabletop checklist for a school day

Why set the tabletop on a school day

A ransomware tabletop for a school day is a facilitated discussion in which district leaders walk through an attack that starts during instruction, with buses running, lunch lines open and students signed in. It tests decisions, not technology: who isolates systems, who notifies GEMA/HS and federal law enforcement, what families hear, and how teaching continues on paper.

You do not need to write a scenario from scratch. CISA publishes free Tabletop Exercise Packages (CTEPs) that include planning guidance, facilitator and participant roles, a feedback form and an after-action report template. [8] Its scenario library includes a K-12 situation manual and a ransomware situation manual, both dated September 2023. [9]

This week: download the K-12 and ransomware situation manuals and pick a 90-minute slot with your cabinet in the next six weeks.

Set the scene: who is in the room and what happens when

Invite the superintendent, technology director, business official, communications lead, transportation, school nutrition, student information and assessment coordinators, two principals, school safety, HR, and your board attorney. Assign one note-taker to keep the decision log. Release these prompts one at a time:

If your exercise date falls near a state testing window, add an inject about online testing so your assessment coordinator can walk through how the district would reach the state assessment office.

This week: send the invitation list to the superintendent for approval.

Before: what to have ready

• A printed contact sheet stored off the network: incident lead, superintendent, board attorney, insurer or risk pool claims line, local emergency management agency, GEMA/HS, FBI field office.
• Written authority for who may disconnect the network or shut down systems during the school day.
• Paper bus routes, student rosters with emergency contacts, and medical and allergy lists, refreshed each term.
• Paper attendance and meal-count forms at every school, and a plan to enter them later.
• Backups that are offline or immutable, with a restore tested this year.
• An out-of-band way to talk, such as phones or a messaging channel that does not depend on district email.
• Draft holding statements for families, staff and media, approved in advance.
• Your cyber insurance policy or pool coverage document, with its notice requirements and approved-vendor rules highlighted.

This week: print the contact sheet and put copies in the superintendent's and technology director's offices.

The first hour

• Start the decision log: time, decision, who made it, and why.
• Isolate affected systems, ideally by disconnecting them from the network. CISA advises powering devices down only if you cannot disconnect them, because shutting down can destroy evidence. [5]
• Move coordination to out-of-band channels; CISA warns attackers may be watching district communications. [5]
• Notify the state. Georgia's HB 156 created O.C.G.A. 38-3-22.2, which requires every agency, expressly including school districts, to report qualifying cyber attacks, data breaches and malware to the director of GEMA/HS. [1] [2] GTA's guidance asks school districts to contact their local emergency management agency within an hour of recognizing the issue. [3] Reports go through the GEMA/HS Cybersecurity Incident Reporting Portal. [4]
• Watch the two-hour clock. If you report to a federal agency, the statute says you meet the state duty by giving GEMA/HS substantially the same information within two hours of that federal report. [1]
• Report to federal law enforcement. CISA says every ransomware incident should be reported to the U.S. government, and one report to the FBI, CISA or the Secret Service reaches the others. [6]
• Call your insurer or risk pool using the number in your policy, and ask before hiring outside responders.
• Confirm buses, attendance and student supervision are running on paper.

This week: add the GEMA/HS portal, the GEMA/HS phone number and your local EMA contact to the printed contact sheet.

The first school day

• Send families a short message: what happened, what students should do tomorrow, and when the next update will come.
• Give teachers a paper plan for attendance, lessons and grades while the student information and learning systems are down.
• Have school nutrition serve meals and record counts on paper for later entry.
• If online state testing is affected, have the assessment coordinator contact the state assessment office before rescheduling.
• Preserve evidence: capture system images and memory where possible before rebuilding. [5]
• Give the FBI the details it requests: variant name, encrypted file extension, wallet address, attacker email addresses and websites, and the ransom amount. [7]
• Record how any ransom question is handled. The FBI does not support paying ransoms, and Treasury's sanctions office warns that payments can carry sanctions risk; it treats prompt reporting to law enforcement as a significant mitigating factor. [7] [10]
• Have the business official confirm how payroll and urgent payments will run.

This week: draft the first family message for this scenario and keep it with your holding statements.

Recovery

• Restore from clean, offline backups in an agreed order of critical services, taking care not to reinfect restored systems. [5]
• Agree that order in advance: identity and email, student information, nutrition, transportation, finance and payroll, then everything else.
• Reset passwords only once the environment is clean, and close the entry point first. [5]
• Check notification duties. HB 156 states it does not replace any existing duty to notify affected people under Georgia's breach notification provisions (Article 34 of Chapter 1 of Title 10), and it keeps reports made under it out of public records requests. [1]
• Keep a steady update rhythm for staff, families and the board until normal operations return.

This week: ask principals, nutrition, transportation and finance to agree the restoration order in writing.

After-action

• Complete an after-action report within two weeks, using the CTEP template. [8]
• Turn each gap into an action with an owner and a due date.
• Update the incident response plan, contact sheet and decision authority.
• Revisit your Respond and Recover ratings in the Cybersecurity Rubric 2.0.
• Schedule the next exercise, with new injects.

In the K12 Cyber Forward portal, tabletop scenarios capture after-action notes and feed the district improvement plan, so the lessons do not stay in a binder. For the framework behind Respond and Recover, see NIST CSF 2.0 for school districts in plain language.

This week: put the after-action review date on the calendar before the exercise begins.