Minutes 0 to 5: agree the people and boundaries
Appoint a facilitator and recorder. Include the senior decision-maker, IT support, attendance or office lead, designated safeguarding lead, data protection representative and communications role. Invite the examinations officer and boarding lead where relevant. One person may represent several functions where appropriate to the school’s responsibilities. Agree who covers absence.
Use the existing response plan and essential-service card. Work with fictional messages and approved examples, keeping pupil records and sensitive technical details out of the discussion. Do not disable accounts, disconnect equipment or simulate an attack on live systems. This 45-minute format is School Connection’s suggested exercise, not an official test or certification.
Minutes 5 to 15: introduce the lost-access morning
Read this illustrative scenario: at the start of the school day, staff cannot use their normal accounts or email. The cause and extent are unknown. Ask who receives the first report, which approved contact route still works and who coordinates the response. Staff should seek authorised support rather than investigate through improvised access.
Follow attendance first. How would the school establish who is present, identify an unexplained absence and pass it to the responsible person? Ask participants to locate the approved instructions and describe the handover. Record where the answer depends on information or a contact held inside the unavailable system.
Minutes 15 to 30: follow the school’s critical handovers
Add a fictional safeguarding concern and an urgent family message. Ask the safeguarding and communications leads how authorised people obtain what they need, protect information and issue a clear instruction. Separate the known facts, the uncertainty and the decision. Identify who can approve a temporary method and how temporary records would later be reconciled.
Where relevant, ask the examinations officer to identify the current contingency route and who would obtain awarding-body advice. Ask the boarding lead what changes when the office is closed or residential staff take over. These prompts test responsibility and access to instructions. They do not create new assessment rules or prescribe whether a school should remain open.
Minutes 30 to 40: examine the return to service
The facilitator now supplies a fictional update: technical support says an important application is available again, with some questions still open. Who interprets the update, establishes what staff may resume and communicates the decision? Ask which information, permissions and checks the responsible professionals would need before accepting normal use.
Keep the limits clear. A discussion can expose a missing owner, unclear authority or unusable alternative. It cannot prove that backups restore, systems are clean or records are complete. Record any technical restoration or security assessment that needs a separate authorised test. NCSC’s Exercise in a Box offers further structured exercises when the school is ready to extend its preparation.
Minutes 40 to 45: agree the repair and repeat
Choose the gap with the greatest practical consequence. Assign an action owner, decision-maker, completion date and a way to check the improvement. Record what worked as well as what failed. If a real concern emerges during the exercise, stop that part and use the school’s actual reporting and response arrangements.
Finish with a short record that distinguishes demonstrated handovers, assumed capabilities and work still untested. Repeat the relevant part after the repair, involving a deputy where useful. The return on the exercise is a clearer, more dependable response people can carry out under pressure.
Prepare the working record
Use the editable CSV or the PDF pack with your colleagues. Record decisions and evidence references, keeping credentials, sensitive configurations and personal records in the school’s protected systems.
- Exercise record
- Date, facilitator, recorder, participating functions and the school service examined.
- Response roles
- For each function, record its responsible person, deputy, authority and approved contact route. Protect personal contact details appropriately.
- Exercise information
- Which fictional or approved examples were used, and which activities were deliberately kept outside the exercise?
- First report
- Who received it, how did it reach the response lead and which communication route was demonstrated?
- Attendance handover
- How would the approved alternative support recording, follow-up and later reconciliation?
- Safeguarding and communication
- What information and authority did the relevant leads need? Which approved route was available?
- Exams and residential context
- Where relevant, which current instructions, external advice routes and out-of-hours responsibilities needed confirmation?
- Return-to-service decision
- Who would interpret the technical update and authorise and communicate permitted use?
- Demonstrated and untested
- What did participants actually demonstrate, what remained an assumption and what needs a separate technical test?
- Improvement and verification
- What will change, who owns it, when is it due and how will the relevant handover be rehearsed again?
The blank records are completed locally. They are not automatically submitted to School Connection and do not constitute a compliance certificate.
Official guidance and connected reading
- DfE response-plan resources ↗
Official templates and preparation support. Use the school’s existing plan as the basis for this original discussion exercise.
- NCSC incident planning, response and recovery ↗
General guidance on decision authority, preparation and practising a response.
- NCSC Exercise in a Box ↗
Official structured exercises for further preparation. Our 45-minute scenario is separate from that service.
- Recovery for the people using the service ↗
The connected feature distinguishes backup protection, restoration evidence and the school handover.
- Examinations and coursework continuity ↗
Our programme continuation follows assessment responsibilities through interruption and recovery. Check the applicable qualification instructions.