Incident response plan

What's included

A complete incident response plan designed for K-12 schools. Customize with your specific contacts, procedures, and policies.

1. Incident response team

Defines who does what during an incident:

• Incident Commander: Overall decision-making authority (typically Head of School or designee)
• IT Lead: Technical investigation and containment
• Communications Lead: Parent, media, and stakeholder communications
• Legal/Compliance: Regulatory notification requirements
• Operations: Business continuity during incident

2. Incident classification

Framework for categorizing incidents by severity:

• Level 1 (Low): Single device malware, phishing attempt blocked
• Level 2 (Medium): Multiple systems affected, potential data exposure
• Level 3 (High): Ransomware, confirmed data breach, regulatory notification required

3. Response phases

Step-by-step procedures for each phase:

• Detection: How incidents are identified and reported
• Containment: Immediate actions to limit damage
• Eradication: Removing the threat
• Recovery: Restoring systems and operations
• Post-incident: Analysis and improvement

4. Communication templates

Pre-written templates for:

• Initial parent notification
• Staff communication
• Board notification
• Media statement
• Regulatory notification (if required)

5. Contact lists

Fillable sections for:

• Internal response team contacts
• Cyber insurance carrier
• Legal counsel
• IT vendors and support
• Law enforcement contacts
• Regulatory agencies

6. Technical procedures

Checklists for common scenarios:

• Ransomware response
• Email compromise
• Data exfiltration
• Network intrusion