A District Runs Its Incident in Public. Your Playbook Assumes You Don't.

The most instructive district incident I have watched had a technically clean response. The team isolated fast, the backups were good, and instruction resumed inside a week. By any measure a security professional would use, they handled it well.

They lost the community anyway. The first message to parents went out on Saturday morning, before anyone knew what had actually been taken. The second message, nine days later, contradicted the first. At the next school board meeting, which was public and on video, a parent read both statements aloud one after the other. Nothing the district said after that landed.

The technical response was not the problem. The playbook they were following was written for a company, and a district is not one.

What is structurally different

The usual framing is that districts are underfunded, understaffed and heavily targeted. All true. The CIS MS-ISAC K-12 report, analysing more than 5,000 K-12 organisations between July 2023 and December 2024, recorded 14,000 security events producing 9,300 confirmed incidents, with 82 percent of reporting schools experiencing cyber threat impacts. Nobody needs convincing on volume.

The interesting difference is not resources. It is that a district cannot deliberate in private.

A corporate incident response playbook, including every one you can buy, assumes three things. That deliberation is privileged and internal. That the decision group is small and chosen by you. And that you control the disclosure timeline, subject to regulation but not to anyone else's calendar.

A school district has none of those. Open meetings laws mean the governing body meets on a published schedule, in public, whether or not the incident is resolved. Public records laws mean the emails written during the response are potentially discoverable. The board is elected, which means its members answer to parents directly and often before the superintendent has briefed them. And the parent community learns things from students on district devices long before any official channel opens.

Which produces the thing that makes district incident response its own discipline. Containment and communication are not two workstreams that meet at the end. They are a single decision, and every playbook on the market assumes they are separate.

The weekend, run properly

Encryption lands late Friday. Follow the corporate sequence and it reads well on paper. Contain over the weekend. Assess through the early part of the week. Engage counsel and the insurer. Prepare a considered statement once the facts are established, which is usually seven to fourteen days out.

Now overlay the district calendar on top of it.

By Saturday mid-morning, three parent Facebook groups have screenshots of a login failure. By Sunday, a local reporter has called two board members directly, because their phone numbers are published. The regular board meeting is Tuesday, it was noticed ten days ago, the agenda is posted, and it will be recorded. Two board members will ask about the incident during public comment whether or not it is on the agenda.

Whatever the superintendent says on Tuesday becomes the district's position permanently. It is on video and in the minutes. It was said roughly 72 hours into an incident where forensics will take three weeks.

The corporate sequence assumes a fortnight of quiet to establish facts before speaking. A district gets about 36 hours, and the speaking is done under oath-adjacent conditions in front of the people most affected. That is not a failure of discipline. It is the legal and civic structure the district operates inside, and no amount of tightening the technical response changes it.

The other thing that is different

There is a second structural difference and it changes what containment even means.

In a corporate breach, the affected party is an adult. They can freeze credit, rotate a password, monitor an account, and act on a notification the day they receive it. Notification is a genuine remedy because the recipient has agency.

A student record exposed in third grade concerns a person who is eight years old, cannot consent, cannot freeze anything, and will not encounter the consequences until they apply for their first loan at nineteen. The harm is real and deferred by more than a decade, and the only party who can act on it now is the district itself.

That should change how a district thinks about what it owes. Notification discharges an obligation in the corporate world. In a district it barely begins one, because the people notified are parents acting on behalf of someone whose exposure runs for twenty years.

The objection from the field

Anyone working in K-12 technology will push back here, and the pushback is legitimate.

Every district has an incident response plan now. Many states require one, cyber insurance carriers demand one at renewal, and the plans have been reviewed. Suggesting districts lack a plan is out of date and slightly insulting.

The plans exist. That is not in dispute. Take one out and count pages instead.

Count the pages covering detection, isolation, forensics, restoration and vendor escalation. Then count the pages covering what the superintendent says at Tuesday's meeting when forensics is 20 percent complete, who has authority to speak to a reporter, and what does and does not go in an email during an active incident. In nearly every district plan I have read, that second count is under two pages and frequently zero.

The reason is not negligence. It is that these plans were written to satisfy a state checklist or an underwriter, and neither of those audiences is a parent at a microphone. The plan answers the question it was built to answer and is silent on the one that actually determines whether the district keeps its community.

Pre-writing is the whole answer

The constraint here is time, and the only thing that ever helps under time pressure is having decided already.

Write three statements now, while nothing is happening, and have counsel and the board chair approve all three. The first covers the state where you know something occurred and do not yet know its scope, which is the message that goes out inside 24 hours and is the one districts get most wrong. The second covers the state where scope is known and remediation is underway. The third covers resolution. Approving them in advance is the entire exercise, because approval is what takes nine days when the building is on fire.

Then decide, also in advance, three things that are always contested during an incident. Who speaks. What form of internal communication is used while an incident is active, agreed with counsel with the public records posture understood by everyone. And what the superintendent's answer is to the specific question that will be asked on Tuesday, which is whether student data was taken. The correct answer at 72 hours is that you do not know yet and here is the date you expect to know, and it is very hard to say that calmly unless you agreed to say it in February.

Run one tabletop this year where every inject is a communications inject and none is technical. A parent posts a screenshot. A reporter calls a board member. A teacher tells a class. A board member emails the superintendent at 11pm asking what is going on. Most districts have never run this exercise, and it is the one their actual incident will resemble.

Three questions for Monday. Who in your district is authorised to make a public statement during an active incident, and does that person know it. What is the next scheduled public meeting of your board, and what would you say at it if the incident started tonight. And has anyone written down, with counsel, what goes in email during a response.

What this changes

The technical response probably does not need to improve. In most districts it is more capable than the funding would suggest, and the CIS MS-ISAC finding that schools with established partnerships recover faster points at relationships built in advance rather than tools bought in a hurry.

What changes is that the district stops making its most consequential decisions in the worst possible conditions. Every statement that has to be composed and approved during the first 72 hours is a statement composed by exhausted people with partial information in front of an audience that will remember it for years.

Leadership and the board should be asked one question about this, and it takes a minute. Show me the three statements, already approved. If they do not exist, the district's communications plan is currently a hope that the incident happens during summer break.

Every other organisation gets to be wrong in private first. A district does not, and its plan should say so on page one.