Prepared for What? Putting the Model to Work in K–12

In our October 13 post, we asked a better version of “Are you prepared?”: Prepared for what, and how do you know? The K–12 cybersecurity readiness pilot hosted by Sourcewell from January through September 2026 gave us an opportunity to put that question into practice. Fractional Source designed and facilitated the pilot, while Sourcewell supported its hosting, focus groups, and marketing. For each participating district, we first performed a high-level preparedness analysis that considered the cyber risks most relevant to the district and the capabilities it could bring to bear if those risks became real. The results helped shape the scenarios and injects used in each tabletop exercise, grounding the discussion in the district’s own circumstances rather than a generic cyber event. The analysis helped identify where to look; the exercise helped participants see what could happen when the pressure was on.

One of the greatest benefits of the tabletop exercises was bringing district leadership and cross-functional participants into the same room. Cyber disruptions may begin as technical problems, but their consequences quickly become operational. Leaders must consider how essential services will continue, how people will communicate, who has authority to act, and which priorities should guide the response. Working through those questions together allowed participants to compare assumptions, recognize dependencies across functions, and better understand what each team would need from the others during an incident. The goal was not to give a district a passing or failing grade. It was to build a shared understanding of where the district was ready, where capabilities remained unclear or untested, and where limited time and resources could make the greatest difference. As part of the pilot, we captured several case studies to share with organizations looking to work with us. One such study follows below:

****

During the winter of 2025 to 2026, a midsize suburban public school district serving more than 11,000 students took part in a Sourcewell cybersecurity discovery pilot. The district works in a highly digital environment, so even brief disruptions would be visible to families, staff, and the wider community. Municipal partners are part of emergency response, which means a serious cyber incident would reach well beyond the district. The real exposure was less about restoring systems and more about whether leadership could align quickly under pressure. The scenarios drew on the district’s NIST aligned capability assessment, local risk conditions, and statewide K through 12 cyber risk data.

The district had an experienced superintendent and newer executive technology leadership from the education side of the organization. Leadership alignment on cyber decision making had never been tested in a live, cross functional setting under pressure. The district saw the value of testing its assumptions before a real incident forced public decisions.

Participants included the superintendent, executive technology leadership, communications, core technology staff, and municipal emergency management partners. The exercise showed where decision making was clear and where it depended on shared assumptions. With the superintendent fully engaged in the scenarios, the conversation moved from technical containment to leadership judgment. Communications discussions shifted from what would be said to when, how often, and to whom. Municipal participation made clear that escalation would not be linear and that district decisions would carry consequences beyond the organization. Because an external facilitator ran the flow of the exercise, district leaders could take part fully instead of splitting attention between running the session and engaging in it.

The district already completes audits, compliance reviews, and technical assessments. This exercise was different because it focused on judgment, sequencing, and tradeoffs. It surfaced who decides to shut systems down, when instruction is interrupted, how messaging is coordinated, and how outside partners get engaged. For leadership, it made visible the gap between having plans on paper and being aligned on how decisions would get made when time and tolerance are limited.

After the findings review, leadership named governance and communication as priority areas. Planned follow up includes cabinet level discussions, clearer decision authority and escalation paths, and stronger communication templates as part of incident readiness. The district also wants to make tabletop exercises an annual practice, rotating focus areas and stakeholders each year. Municipal partners are now viewed as part of the district’s broader preparedness ecosystem rather than as occasional participants.

For districts with strong systems and public visibility, cyber readiness is as much a leadership challenge as a technical one. The format let leaders work through decision authority, communication, and escalation before facing those choices in public. The value was not in finding new risks. It was in aligning leaders on how they would respond together, and that shared understanding can be relied on during future incidents, whatever the specific threat.

****

Fractional Source has partnered with Sourcewell Ventures to scale our K–12 cybersecurity pilot, providing assessments and exercises to schools and local governments. To learn more or express interest in participating, contact us at [email protected] or reach the Sourcewell Ventures team at [email protected].