Ask a district of three technicians where their incident response plan lives and the answer is usually nowhere, or a document written for a compliance checkbox and never opened since. Districts that do have real tooling generally bought it inside an expensive security suite priced for someone much larger.
So the plan gets written during the incident, by people with minimal security training, at the worst possible moment, and afterwards there is no record that survives to inform the next one.
Log an incident, track it through its lifecycle, and keep what happened, so the second incident starts with what you learned in the first.
Step-by-step response guidance for a compromised account, so a lean team has structure to follow rather than improvising under pressure.
Living documents in the product, built on established K12 runbook material, exportable to PDF for a board packet or an audit.
The roster of who to call (internal, vendor, law enforcement, insurance) and who owns which decision, filled in before you need it.
Incidents tracked over time become the record a cyber-insurance questionnaire or an auditor actually asks for.
The teams this is built for are small and rarely have dedicated security staff. The point is not to make them a security operations centre; it is to give them scaffolding, so that responding to an incident, and building the plan for the next one, is something a lean team can genuinely do.
The incident log, plans and contact roster are complete and platform-agnostic. The step-by-step runbook is currently written for Microsoft 365. Google Workspace runbook steps are on the roadmap. If you are a Google district, you get the log, the plans and the structure today, but the account-compromise walkthrough will name Microsoft tooling.
The four-phase plan structure, the Emergency Contacts & Key Resources worksheet, the RACI responsibility matrix, and the student-involved incident guidance are adapted, with thanks and with permission, from the K12 SIX Essential Cyber Incident Response Runbook (v1.1) by the K12 Security Information eXchange, the non-profit cyber-threat information-sharing community for K-12 schools. We did not invent incident response for education; we built the tooling that makes their guidance usable by a team of three. The attribution travels with the exported PDFs, so it stays with printed copies in a board packet.
Every feature is in every plan, including this one. Set it up yourself in an afternoon, or have us walk you through it.