Strong cybersecurity is not just about technology—it depends on clear leadership, shared responsibilities, and a plan that works when something goes wrong. In this practical session, participants will work through realistic school cybersecurity incidents and examine the decisions that must be made before, during, and after a crisis. Attendees will learn how to define roles, improve communication, coordinate the response, protect critical operations, and turn lessons learned into stronger district practices. Participants will receive an incident response plan template, and we will walk through each section of the document to help schools adapt it to their own needs. The session is designed to help districts move beyond policies on paper and build an incident response process that works in the real world.