In Part 1, participants will walk through a realistic K-12 cyber incident scenario, uncovering vulnerabilities and examining response protocols in real time. CISA facilitators will guide teams through critical decision points, sparking valuable discussions around communication, containment, and continuity.

In Part 2, the workshop continues with a deeper dive into the later stages of incident response and recovery. District teams will evaluate their processes, identify gaps, and explore ways to improve coordination across technical and leadership roles.

Whether you're new to tabletop exercises or looking to refine your current IR plans, this workshop will leave you with actionable insights, a partially completed template, and a stronger understanding of your district’s cybersecurity posture.