The worst time to work out who’s supposed to do what is during the incident itself. A cyber incident response plan only earns its name if it’s been read, agreed, and actually rehearsed before the day it’s needed.

Where to start

However an attack happens, the immediate response follows a consistent shape:

1. Disconnect and contain: take affected devices off the network and internet, and get IT support involved immediately.
2. Identify and isolate: work out what’s actually happened and ring-fence the affected systems before anything spreads further.
3. Change compromised credentials: starting with the most critical accounts, and enable MFA wherever it isn’t already on.
4. Notify the right people: IT, senior leadership, and legal counsel where relevant, without delay.
5. Document everything: what happened, when, what was done, and every communication sent, as it happens rather than reconstructed afterwards.
6. Do not pay the ransom. It offers no guarantee of recovery, and it funds further attacks. Government guidance already discourages this for the public sector, and a formal ban on public sector ransomware payments is a confirmed policy direction.  Check your cyber insurance.
7. Get expert help: cyber security professionals, law enforcement, or a regional Cyber Resilience Centre.

Who gets told, and by whom

The Cyber Security: Core Standard sets out a specific escalation chain, and it’s worth stating precisely because “tell someone” isn’t specific enough to act on:

• Anyone in the school can report a suspected incident to IT support and the SLT digital lead.
• Report Fraud (the national reporting centre for fraud and cyber crime (formerly Action Fraud) should always be informed.
• The DfE sector cyber team should be told directly.
• The NCSC should be notified for long-term closures, multi-school closures, or serious financial damage — not every incident needs to go this far up, but the threshold is lower than “catastrophic.”
• The ICO must be notified within 72 hours of a high-risk personal data breach, this clock starts when the school becomes aware, not when the investigation concludes. Liaise with your DPO for guidance.
• Cyber insurers need telling as part of any claim.
• Further education institutions should also report to Jisc.
• Governors or trustees must be informed of significant risks and the response, which ties directly back to the oversight role covered earlier in this series.

Academy trusts have an additional obligation under the Academy Trust Handbook to report significant incidents through the trust’s own governance and financial reporting structure, worth checking the current edition directly for the specific requirement, since it’s updated annually.

Why transparency matters

There’s a persistent, understandable instinct to want to handle an incident quietly. The NCSC has directly challenged this, and it’s worth mentioning: concealing an attack doesn’t protect the school. It makes the next attack on someone else more likely, because the wider sector loses the chance to learn from what happened. Reporting to the right authorities doesn’t automatically make an incident public, and most of the reporting routes above exist specifically to get the school help, not to punish it for having been targeted.

Preserving evidence

• Keep logs, screenshots, and anything else relevant rather than “cleaning up” before the investigation is complete.
• Forward suspicious emails to your organisation’s designated reporting address.
• Forward SMS scams to 7726, the free spam-reporting number.

Build the contact list before you need it

A Cyber Emergency Contact list:  IT support, bank and card provider, cyber insurer, Report Fraud, the DfE sector cyber team, and the NCSC, should exist on paper or somewhere accessible without needing the systems that might be the thing that’s down. If the plan only exists as a file on the server that’s just been encrypted, it isn’t a plan.

Wider communication: telling parents, and planning for closure

The sections above cover the technical and regulatory response. There’s a separate, equally important strand: what the school actually says to parents, staff, and the wider community,  and what happens if the school can’t safely operate while it’s being sorted out.

• Decide who speaks externally, in advance. This should be the headteacher, CEO, or a named communications lead, not IT support, and not whoever happens to answer the phone first. Put it in the incident response plan by name or role, not as an assumption.
• Prepare a holding statement before you need one. A short, honest, pre-agreed template (“we are aware of an issue affecting our systems and are investigating; we will update you by [time]”) buys time to understand what’s happened properly, rather than forcing a detailed explanation before the facts are known.
• Think about channels that don’t depend on the affected systems. If email, the school’s website, or the parent app is down or itself part of the incident, how do you actually reach parents? A text/SMS service, a phone tree, or a notice at the school gates may be the only options that still work. Decide this now, not while it’s happening.
• Coordinate before going public. Where the trust, local authority, or the DfE sector cyber team are already involved, align messaging with them before anything goes out externally. Inconsistent statements from different parts of the same organisation are their own kind of damage.
• Plan specifically for closure. If systems being down means the school genuinely can’t operate safely: registers, safeguarding systems, catering, access control, that’s a business continuity decision, not just a cyber one. The NCSC’s advice to governors is directly relevant: a business continuity plan should cover more than IT, including how the school would keep basic functions running, or communicate a closure,  if it lost access to its data or systems altogether, and it’s worth considering paper copies of genuinely critical records as a fallback.
• Be careful what gets said publicly about the cause, early on. Speculating about who’s responsible, or how serious the breach is, before an investigation has actually established the facts, is how false or retractable statements end up out in public. “We are investigating” is a complete, honest sentence on day one.

There are safeguarding considerations alongside IT and communications: any message to parents involving a data breach affecting children’s information should be reviewed with the DPO and designated safeguarding lead before it goes out, not drafted in isolation by whoever’s writing the update fastest.

Who’s accountable

IT support is Responsible for the technical containment and investigation. The SLT digital lead is Accountable for the overall response and for deciding who gets told outside the school. The DPO is Consulted,  and often directly involved in the ICO notification,  wherever personal data is affected. Governors or trustees are Informed, formally and promptly, not after the fact.

💡Daily Cyber Tip

Find your school’s cyber incident response plan and check two things: is it somewhere you could actually access if the network was down, and does it name real people rather than just job titles? Both are common, quiet failure points.

Further resources

• NCSC guidance on responding to and recovering from a cyber incident
• Report Fraud (the national fraud and cyber crime reporting centre)
• DPE’s Cyber Security Best Practice Area