Incident Response and Recovery Must Be Well-Drilled
"If something happens to you out of the blue that's causing some form of stress reaction, you're going to fall back to your training," said Tom Ashley, senior national K–12 cybersecurity strategist at CDW. "If you created a playbook and a checklist but never practiced it, you're more likely to revert back to even more of a basic reaction: freeze or run, typically."
Ashley emphasized that comprehensive incident response plans aren't what teams reach for during active incidents. Instead, districts need actionable playbooks: concise, step-by-step guides for specific scenarios.
"The playbooks are those actionable steps that you would go to and say, 'OK, I'm hit with ransomware. Let me go to my ransomware playbook,’” Ashley said. "Every second counts."
His framework centers on five incident types most likely to impact K–12: ransomware attacks, social engineering, data breaches, insider threats and distributed denial-of-service attacks. Each playbook should include severity classifications, communication protocols and designated response team members crossing functional areas.
Ashley shared a free Cybersecurity Incident Response Plan template that districts can download and customize.
Recovery is also crucial for K–12 environments.
"If you don't have a lot of resources, you have to invest in the solutions that make the biggest bang for your buck," he said. "Recovery is one of those areas that I highly recommend you utilize your valuable, limited resources. Look at your backup and recovery infrastructure."
Districts must plan for clean restoration of their backups. Bad actors often attempt to compromise backups and will wait months or years before triggering attacks, ensuring that multiple backup generations are corrupted. The solution, Ashley said, is to systematically monitor, scrub and evaluate backups during restoration to catch corrupted data before it spreads.
Ashley also stressed the importance of user awareness, and how simply picking up the phone to ask a question or talking to the person next to you can save a lot of strife. He provided an example of a situation in which an issue could have been solved with just a single question: Did you send this email?
"The fix did not cost tens of thousands of dollars," he said. "It was a people, person and procedure fix."
WATCH: Experts discuss four key security trends for 2026.
Physical Security Is Still Priority No. 1
In August 2006, when Bryan Krause was the principal of Platte Canyon High School in Bailey, Colo., his school conducted an active shooter drill. Less than a month later, a 53-year-old gunman took an honors English class hostage before killing 16-year-old student Emily Keyes. More lives could have been lost were it not for the drill. When SWAT arrived, Krause immediately directed them to room 206, and they knew exactly where that was without having to be told.
Now senior national school safety strategist at CDW Education, Krause advocates breaking down silos between cybersecurity, physical security, prevention programs and social-emotional learning.
"IT doesn’t just own cybersecurity, and the safety and security department doesn’t just own physical security," he said. "It should all work together."
He outlined three critical technology categories that districts should prioritize: video surveillance systems, access control and environmental sensors. Environmental sensors represent a particularly innovative advancement, allowing districts to monitor spaces that were previously difficult to supervise, such as bathrooms, locker rooms and special education classrooms, without invasive cameras. These sensors can detect unusual sounds, temperature changes or other environmental anomalies that might indicate an incident.
