A recovery playbook for schools and local government. Backups are not the plan. This is the sequence that gets identity, phones, payroll, transportation, and critical services back online in hours instead of weeks.
A few numbers to frame the problem: 82% of reporting K-12 organizations experienced cyber threat impacts per the CIS K-12 Cybersecurity Report; Uvalde CISD canceled four days of classes after ransomware; and federal support for MS-ISAC ended on 09.30.25.
01 — The bad morning
The ransomware call rarely starts with "our files are encrypted." It starts with something more immediate: "the phones are down, the door badges stopped working, and we cannot see the cameras."
When Uvalde CISD confirmed ransomware in September 2025, the district canceled four days of classes because the attack disrupted phones, air-conditioning controls, security cameras, visitor management, and Skyward. That is what a modern district attack looks like. It does not just take data hostage. It takes Tuesday hostage.
02 — The attack before the attack
Your backups are usually the first target. Modern ransomware crews do not encrypt on arrival. They map the environment, escalate access, and find the recovery infrastructure first. If the backup plane trusts the same identity system the attacker controls, one stolen administrator account can compromise production and recovery together.
The fix is architectural. At least one recovery copy must be immutable inside its retention window and inaccessible through production credentials. If every copy can be changed by the same administrator, every copy is inside the blast radius.
Three failure modes to check for:
- Shared trust. Production and backup administration use the same identity plane. One compromise, two environments.
- Untested recovery. A successful backup job proves data was written. It does not prove operations can return on time. Green check, unknown outcome.
- Vendor blast radius. The PowerSchool incident showed how one third-party credential can expose data across many districts. Your plan must include their failure.
03 — The only numbers that matter
Backups answer whether. RTO and RPO answer when and how much. "We have backups" is not an operating commitment. Leadership needs two approved numbers for every critical workload, and IT needs a timed test proving the environment can meet them.
RTO — recovery time objective (hours): how long can the service stay unavailable before the district or municipality cannot operate?
RPO — recovery point objective (lost data): how much recent data can the organization accept losing between the last safe copy and the attack?
04 — Recover in a sequence. Not in a panic.
The first 72 hours decide whether this is a hard week or a lost month. These are illustrative targets, not promises: your real recovery time comes from rehearsing your own environment with a stopwatch.
T+0 — Contain and declare. Minutes, not meetings. Isolate the affected network. Call your insurer, counsel, and incident-response firm. Move communication to a channel the attacker cannot see. Cut lateral movement, preserve evidence, activate out-of-band communications.
T+0–4h — Restore the foundation (Tier 0). Recover identity and core networking into a clean environment. Nothing else can come back safely until trust and connectivity are restored: identity services, DNS, DHCP, core network, privileged access controls.
T+4–24h — Reopen operations (Tier 1). Bring back the systems that determine whether school opens and public services continue. Use the immutable copy as the source of truth: SIS and payroll, phones and transportation, safety and visitor systems.
T+24–72h — Recover in order (Tier 2). Restore the remaining environment in a business-approved sequence. Validate every workload before reconnecting it to production: department applications, file services, validation and monitoring.
T+72h+ — Validate and close. Service comes back before trust does. Confirm eradication with your forensics team, rotate every credential, and keep heightened monitoring in place until the environment has re-earned normal operations.
Recovery principle: isolate affected systems and restore from a clean, offline backup. CISA's StopRansomware guidance recommends maintaining offline backups and regularly testing their availability and integrity.
05 — Back online is not the same as recovered
The restore sequence ends in days. Full recovery takes weeks, and most of it is invisible: proving the attacker is out, proving the data is right, and closing the door they came through. Re-entry through leftover access is how a two-day outage becomes a repeat incident.
Full recovery is declared, not assumed. It ends with evidence:
- Eradication proven. Forensics closes the entry point, persistence is hunted down, every credential is rotated, and monitoring watches for re-entry.
- Data validated. System owners check restored records against known-good points. Grades, payroll, permits: the departments confirm the data is correct, not just present.
- Readiness rebuilt. A fresh immutable baseline, replication re-enabled, the runbook rewritten with what the incident taught, and the next timed failover on the calendar.
06 — Recovery already standing by
A district can build all of this in-house. The honest question is whether a lean IT team can maintain a second recovery environment, protect it from the production blast radius, rehearse it on a schedule, and keep the documentation current while still running everything else. That is why ModernOps runs recovery two ways.
Model A — Managed DR: your infrastructure, run with discipline. Keep the backup and DR investment you already own. ModernOps operates and documents it: immutability verified, restore order written down, restores tested and timed on a schedule, and evidence reports that leadership and insurers can read.
Model B — Hosted DRaaS: we run the recovery side for you. Replication flows to a recovery environment ModernOps hosts and operates: pre-staged, isolated from district credentials, and rehearsed with your team. On the bad morning, failover starts with a call to an engineer who already knows the environment.
| Recovery requirement | Built during the incident | Run by ModernOps |
|---|---|---|
| Clean environment | Designed under pressure | Pre-staged and isolated in advance |
| Recovery copy | May share production trust | Locked, immutable snapshots |
| RTO and RPO | Assumed until tested | Defined, tested, and timed |
| Bad-morning support | Start with a new ticket | Call an engineer who knows the environment |
| Documentation | In one engineer's head | Runbooks and test evidence kept current |
In either model, recovery stops being a binder and becomes an operation. Replication runs continuously. Restores are tested on a schedule and timed. Documentation stays current because keeping it current is the job. Backup is delivered as BaaS on enterprise storage with immutability built in, and failover is covered by DRaaS with defined RTO and RPO.
07 — The 60-second check
Any unchecked item belongs in the recovery plan. This is a quick screen, not a resilience score:
- One recovery copy is immutable and isolated from production credentials.
- RTO and RPO are written, approved, and tied to specific systems.
- A clean restore has been completed and timed in the last six months.
- Identity, network, payroll, SIS, and safety systems have an approved restore order.
- The incident team has an out-of-band way to communicate.
08 — Sources
- CIS: 2025 K-12 Cybersecurity Report
- CIS: MS-ISAC Membership FAQ
- CISA: StopRansomware Guide
- PowerSchool: Notice of United States Data Breach
- Comparitech: 2025 Education Ransomware Roundup
- The Record: Uvalde CISD ransomware closure
09 — Find your real recovery window before someone else does
The free Rapid Infrastructure Resiliency Assessment scores backup, recoverability, immutability, and failure tolerance in a few hours. It is remote-first, carries no obligation, and ends with a prioritized gap list you can act on.
Originally published at modernops.com.
Disclosure: I work for ModernOps, and sections 06 and 09 describe our own managed recovery services. The incident reporting and statistics cited are drawn from the public sources listed above.
Top comments (0)