Are You Prepared? Prepared for What?

Are you prepared?

Well, that is a loaded question.

To answer it honestly, you need to know two things: What risks are you likely to face, and what are you actually capable of doing if one of those risks becomes real?

Risk and capability must be considered together. That is what preparedness is really about.

Think about planning a hike. You could face bad weather, an injury, wildlife, getting lost, or running out of water. Simply listing those possibilities does not tell you whether you are ready.

First, understand the risk. What is the threat, and how likely is it? How vulnerable are you? What would the consequences be? A mosquito bite and a rattlesnake bite are both possible, but they are not the same risk. A temperature drop may be manageable if you have the right clothing and much more serious if you do not.

Then, understand your capabilities: the things that allow you to prevent a problem, reduce its impact, respond, and recover.

On a hike, those might include navigation, shelter, first aid, and communications. But owning a tent does not mean you have a shelter capability. Do you have all the parts? Do you know how to put it up? Have you practiced? Could you do it in bad weather?

Cybersecurity works the same way.

An incident response plan that no one has read is not much of a response capability. A backup that has never been restored is not yet a reliable recovery capability. A contact list stored only on the network may be useless when the network is unavailable.

A real capability depends on plans, people, equipment, training, and exercises working together.

Preparedness comes from comparing those capabilities with the risks that matter most. For a school district, a cyber incident could disrupt communications, transportation, payroll, building systems, or classroom technology. No district has unlimited time, staff, or funding, so it cannot be equally strong in every possible capability.

The better question is: Which risks could most seriously disrupt our mission, and are the capabilities tied to those risks strong enough?

That comparison reveals preparedness gaps. A high-risk scenario backed by strong, tested capabilities is an area of readiness. A high-risk scenario that depends on weak or untested capabilities is the sweet spot for improvement, where limited resources can make the greatest difference.

This is why tabletop exercises are so valuable. In our K–12 cybersecurity work, the goal is not simply to see whether the technology team can solve a technical problem. It is to determine whether the district as a whole can keep making decisions and serving students when normal systems are disrupted.

Exercises replace assumptions with evidence. They test authority, alternate communications, vendor relationships, and the ability to continue essential services.

Preparedness is not a binder on a shelf or a checklist completed once a year. It is understanding what you may face, knowing what you can actually do about it, and focusing limited resources on the gaps that matter most.

So, are you prepared?

The better question may be: Prepared for what, and how do you know?

Fractional Source has partnered with Sourcewell Ventures to scale our K–12 cybersecurity pilot, providing assessments and exercises to schools and local governments. To learn more, contact us at [email protected] or Sourcewell Ventures at [email protected].