All tabletop exercises
Data breach·Starter·Mixed audience
Student records leak from a school district's hosted information system
The prompt — read this to the room
A parent forwards your district office an email from someone claiming to hold the records of every student in your 14-school district: names, addresses, grades, special-education plans and medical notes. Attached is a spreadsheet with her own child's details, correct as of last month. Your student information system is hosted by a vendor, and their support desk says they are 'looking into an incident affecting several customers'. The superintendent has a school board meeting tonight, and the local parents' group online already has 200 comments. What do you tell parents before the meeting?
Total duration
1 h 15 min
People to involve
6
Best fit
Education, Public
Who to involve
Most important first.
- CEO / Managing director
- Privacy officer / DPO
- Legal counsel
- Vendor / procurement manager
- Communications / PR
- CISO / Head of security
What it tests
- Get usable facts from a hosted vendor that is handling several customers at once
- Give parents an accurate first message that separates the vendor's facts from the district's
- Identify the student-privacy and breach-notification duties that apply and who triggers them
- Protect the most sensitive groups (special education, health notes) first
Outline of activities
- 1The parent's email and the sample
- 2Vendor contact and the contract
- 3First message to families and the board
- 4Legal duties and sensitive student groups
- 5The next seven days: support, monitoring, follow-up
Run sheet (Pro)
The facilitator's timeline of execution, the detailed steps for running the session and the questions to ask each person.
Loading…