Create Next App

KADERA

Dashboard Districts Assessments Reports Vendors Renewals E-rate

Break glass

Cyber Incident Response

What happens in the first hour, the first day, and the first week — and who knows their part of it.

Capture progress

8 of 8 fields captured

Maturity preview · Developing

Incident response tools & services

IR retainers, breach coaches, MSP/MSSP escalation paths, and other external services on call when something goes wrong. The F1–F8 questions below score the plan, the people, and the Texas notification posture; this section captures who you call.

Inventory

Tool

Product

Status

Deployment scope

Manufacturer rep

Partner / integrator rep

Plan fundamentals

F1Cyber incident response plan

Whether a written IR plan exists and how mature it is.

F2Plan owner / accountable role

Who's accountable for keeping the plan current and exercising it. TEC §11.175(d) requires Texas districts to designate this role; the designee is registered in AskTED per TEA's annual reporting process.

F3Last plan update

Plans go stale. Annual review keeps roles, contacts, and procedures current.

Current · 8 mo ago

Operational readiness

F4Last tabletop exercise

A facilitated walk-through of the plan with key staff (IT, superintendent, comms, legal, business office). 12-month threshold.

Stale · 21 mo ago

F5MSP / MSSP role in IR

Whether outsourced operations partners participate in the plan, and at what level.

F6Severity / classification framework

How incidents are triaged so the response matches the threat. Drives notification timing, escalation, and external comms.

IR team & coordination

F7IR team composition

Who is on the team — by role, not by name. The plan should map roles to current people, but the team itself is role-anchored.

Texas notification compliance

F8Texas-specific notification awareness

Texas K-12 has unusually specific reporting obligations. Each unchecked item is a finding.

DIR 48-hour incident notification

Texas Government Code §2054.603

Notify the Texas Department of Information Resources within 48 hours of discovery — applies to breaches of sensitive personal, confidential, or regulated data and to ransomware introduction. SB 271 (2023) redesignated this obligation from §2054.1125 and extended it to school districts as “local governments.”

TEA breach reporting

TEC §11.175(e)

Report any cybersecurity incident constituting a breach of system security to the Texas Education Agency “as soon as practicable” after discovery.

Parental notification (student info involved)

TEC §11.175(f)

When a TEA-reported incident involves a student’s information, the cybersecurity coordinator must provide notice to the student’s parent or person standing in parental relation. Statutorily distinct from the BCC §521.053 60-day individual notification — different trigger, different audience.

60-day individual notification

Texas Identity Theft Enforcement and Protection Act, BCC §521.053

Notify affected individuals within 60 days of breach discovery if sensitive personal information was exposed.

DIR closure report at 10 days

Texas Government Code §2054.603(c)

File a closure report with DIR within 10 business days of eradication, closure, and recovery from a reportable incident, including a cause analysis.

Plan fundamentals

Operational readiness

IR team & coordination

Texas notification compliance

Notes