Follow the changes in the school calendar
School access changes as students move, staff change roles, and suppliers support individual applications. Shared devices and application-local accounts can leave gaps that a central sign-on list will not reveal.
Choose a service with the school owner and map the people, devices, information, and suppliers involved. Test an approved access-removal or recovery scenario without disrupting teaching or exposing student information. Keep uncertain dependencies visible in the improvement plan.
Put it into practice
Walk enrollment, attendance, learning platforms, and emergency communications from the user’s perspective. Identify who can reset privileged access and how staff operate if the identity provider is unavailable. Rehearse one school day without the primary platform.
Implementation steps
- Map the school dayList attendance, learning platforms, identity, communications, safety systems, and administrative records. Identify sensitive student and staff data and the services needed when a primary platform fails.
- Protect the critical pathsVerify privileged access, supported devices, backup ownership, supplier dependencies, and reporting routes. Apply role-appropriate permissions and minimize personal information in shared dashboards or exercises.
- Rehearse a disruptionUse an agreed controlled exercise to test alternate communications, approved manual procedures, emergency access, and a representative restore. Include the people who would operate the process during a real school day.
- Review with leadershipRecord user impact, privacy constraints, unresolved dependencies, and corrective actions. Have the appropriate school authority accept remaining risk and schedule a repeat check after material service changes.
Track critical service ownership and recovery acceptance
| Measure | Calculation or definition | How to use it |
|---|---|---|
| Critical service ownership | School services with verified owners / critical school services | Include external platform and emergency communication dependencies. |
| Recovery acceptance | Critical services accepted after restore / services exercised | Have school staff validate the recovered workflow. |
| Access review coverage | High-impact accounts reviewed / accounts in review scope | Record contractor, substitute, and shared-account exceptions. |
School continuity exercise example
Worked example. Figures are illustrative.
| Observation | Services |
|---|---|
| Critical services | 10 |
| Fallback written | 8 |
| Fallback rehearsed | 6 |
Rehearse written fallback procedures with the staff responsible for using them.
The record to keep
The deliverable: A school-service dependency map and a tested offline attendance and communication procedure.
Use a roster change to check the full access-removal route. Verify the application outcome with its owner before extending the process to more campus services.
References
- NIST Cybersecurity Framework — Use outcomes and organizational context to organize the risk discussion; a framework mapping is not a control test.
- NIST SP 800-34 Rev. 1: Contingency Planning — Use impact analysis, recovery priorities, exercises, and plan maintenance to structure continuity work.
Keep reading.
Your Access List Is a Museum. Time to Clean It Out.
An access review needs more than a list of active employees. Supplier accounts, service identities, inherited permissions, and active sessions can preserve access after the original reason has ended.
3 min read →
October 30 market close: Intel plunges, Nasdaq falls 2.86%
Intel falls 28.58% as its outlook weighs on technology. Nasdaq loses 2.86%, energy leads sector gains, and labor-cost data and weekly returns frame the Friday close.
4 min read →
October 29 market close: Alphabet sinks, small caps advance
Alphabet falls 12.64% and the Nasdaq loses 1.38%, while small caps and nine sector ETFs gain. GDP, inflation and Amazon earnings frame a sharply divided session.
4 min read →