Eight o’clock on a Monday, and nothing works.

Oct 26

2 min read

Most incident response plans are written for a document review. Very few are written for the morning they will actually be read.

The test is not whether a plan exists. Almost every trust has one. The test is whether it survives the conditions it will be opened in.

The conditions

The systems are down, so the plan on the shared drive is unreachable. The person named in it is on annual leave, because incidents do not check the rota. The phones are IP phones, so they are down too. It is a quarter past eight, and the office is filling with parents who want to know whether the school is open.

A plan that only works when the network works is not a plan. It is a description of one.

Four properties that survive it

It is available offline

Printed, in a folder, in a named place that people can describe without looking. One copy off-site, because "in the school office" fails if the building is the problem.

It names a person and a deputy.

Roles are not enough at seven in the morning. Names, mobile numbers that work out of hours, and a deputy who knows they are the deputy. That last part is worth checking directly — it is the single most common gap a tabletop exercise finds.

It covers the first hour, not the first fortnight.

Whether to disconnect. Who calls whom, in what order. What gets said to parents, and by whom. Whether the school opens, everything beyond that hour can be worked out once somebody competent is engaged; the first hour cannot, because it is happening while everyone is still working out what is going on.

It has been walked through out loud.

Not approved and walked through by the people named in it, in a room, saying what they would do. An hour in a leadership meeting finds more than any amount of drafting — the out-of-hours number that rings a desk in an empty office, the assumption that somebody else is notifying the local authority, the deputy who had no idea.

The notification question

Two obligations, frequently confused.

The DfE expects significant cyber incidents to be reported through Action Fraud, with the department informed. Separately, where personal data is involved, the ICO clock runs seventy-two hours from the point of awareness — not from resolution, and not from the point the picture is complete.

Boards do not need to memorise the detail. They do need somebody to own the decision, named before it is needed, who understands when the clock starts. If reporting would currently be decided by whoever happens to be in the room, that is worth fixing this term.

A one-page structure you can lift

● Who makes the first call, and who deputises. Names and out-of-hours numbers.

● First-hour actions. Disconnect or not, who is contacted, and whether the school opens.

● Communications. Who speaks to parents, staff and governors, and roughly what the first message says.

● Notification. Who decides, what triggers it, and the seventy-two-hour point.

● Where this page lives, in print, including the off-site copy.

One page, reviewed annually, walked through once a year. That is a proportionate arrangement for a school or trust, and it is far more than most currently have.