K12 SIX Essential Cyber Incident Response Runbook: Independent School Adaptation by ATLIS

Cybersecurity incidents don't wait for a convenient moment — and the actions taken in the first hours matter most. This ATLIS adaptation of the K12 Security Information eXchange (K12 SIX) Essential Cyber Incident Response Runbook gives independent schools a practical, print-ready guide for preparing for and responding to cyber incidents of every kind.  Developed with independent school realities in mind — small technology teams, cloud-first environments, outsourced IT support, and Head of School governance — this runbook helps schools move from uncertainty to coordinated action when it matters most. 

What's inside:  

First 60 Minutes guide — immediate, step-by-step actions for a live incident, including a three-tier decision framework to match the response level to the situation

Four-phase response framework — preparation, detection and analysis, containment and recovery, and post-incident review Scenario playbooks — quick-reference guides for ransomware, phishing, business email compromise, vendor breaches, student-initiated incidents, AI-enabled impersonation, and more
Vendor and Third-Party Incident Response Guide — an in-depth appendix covering vendor risk preparation, contract provisions, containment options, and reconnection criteria, specific to independent school vendor portfolios

Communication matrix and message templates — audience-by-audience guidance for parents, board members, faculty, students, donors, and media

Emergency contacts worksheet, RACI matrix, glossary, and references — ready-to-customize tools your team can complete, print, and keep offline Designed for independent schools.

This runbook accounts for the governance structures, vendor-heavy technology environments, and community trust obligations that make independent school incident response distinct from larger public district models.  

This resource was reviewed and contributed to by technology leaders from across the global ATLIS community. Special thank you to K12 Six for generously permitting us to create an adaptation to meet the unique needs of independent schools.  Based on the K12 SIX Essential Cyber Incident Response Runbook.

Keep an offline copy — during an incident, your normal systems may be unavailable.

ATLIS members, access your copy of the report here.

Not yet a member? Access a preview of this resource.