This is the third and final installment of a three-part series on cyber preparation and cyber resilience in Indiana schools. Can classrooms maintain essential student services if their technology systems become unavailable?
A school district can write a cybersecurity plan, identify backup procedures and train employees to recognize suspicious messages. But how does the district know those preparations will work when a critical system becomes unavailable?
The answer depends in part on practice.
A plan can assign responsibilities and outline steps to take during a cyberattack. An exercise can help reveal whether employees understand those steps, whether departments can communicate and whether essential services can continue when the systems they depend on are offline.
For Indiana schools, the question is whether districts have tested that kind of operational readiness — and what those tests have revealed.
The Indiana Department of Education’s (IDOE) spring 2026 annual education technology survey found that more than 75% of schools have an incident response plan. About 85% either conduct regular phishing simulations or planned to begin them during the 2026-27 school year. Nearly all schools use multifactor authentication, and nearly half of school corporations completed a cybersecurity audit or assessment within the previous three years.
Those figures offer a useful starting point. They do not establish how many schools have conducted exercises simulating the loss of critical digital services, how long those exercises lasted or whether staff outside information technology participated.
Those details matter when evaluating whether a school can keep operating through a disruption.
A test that focuses only on whether IT staff can identify and contain a security incident may not answer whether a nurse can retrieve emergency information, a teacher can account for students or a transportation department can coordinate routes without its usual systems. Each function presents its own operational needs.
Asked whether schools can function without technology, educators gave answers that ranged from doubt to certainty. Charmayne Wright, a middle school assistant principal, said schools have to depend on technology for nearly every daily operation.
“I don’t believe schools can function effectively without technology in today’s educational environment. While education existed long before technology became so prevalent, schools have become increasingly dependent on it to manage daily operations, from grading and tracking student progress to collecting data, communicating with families, and accessing educational resources. Twenty years ago, I might have answered this question differently, as technology did not play nearly as significant a role in education as it does today. Although schools could still operate without it, doing so would require significant adjustments and likely impact efficiency and productivity. Technology has become an essential tool in education, but it should complement, not replace, the human connections and relationships that are at the heart of teaching and learning.”
Jeremiah Lockett, Jr., of Crescent Learning Group, said schools can operate without it, but at a cost.
“Schools can function without technology; however, doing so places them at significant disadvantage, particularly in the speed and efficiency with which data is collected, stored, retrieved, and managed. Schools have a responsibility to provide a high-quality educational experience for students while effectively serving families and the broader community. Technology plays an important role in fulfilling that responsibility.”
Nashawnya Richardson, director of student support for grades 3-5, took a firmer view.
“Schools can absolutely function without technology. I honestly believe it would be better if life went back to how it was before technology. Those of us raised in the “before technology” era turned out perfectly fine. Our social and emotional well-being is better because there was no technology. We played and learned together; we truly looked forward to seeing our friends at school. Kids today lack social skills and emotional intelligence because many of them are also not being taught these things at home and because they spend a majority of their time behind a screen, even in school.”
She added, “If schools were successful before the technology era, this proves technology is not 100 percent necessary when it comes to educating our children. Has it helped? Absolutely! It has made life a lot easier but look at the harm it has caused when it comes to the social and emotional well-being of our children.”
A school could begin evaluating those needs by simulating the loss of access to selected systems. Staff could be asked to follow established procedures for attendance, emergency communication, instruction or other essential responsibilities. The purpose would not be to create unnecessary risk for students, but to identify gaps in a controlled exercise before an actual emergency exposes them.
The most useful evidence would go beyond confirmation that an exercise occurred. Districts could document which departments participated, which systems were unavailable in the simulation, what procedures employees used, what problems emerged and whether corrective actions were completed.
For example, a district might discover that its written contingency plan refers employees to a printed roster that has not been updated, or that staff members do not know where secure backup information is stored. Such examples should be reported only if a district confirms that they occurred. The point of an exercise is to find and correct vulnerabilities, not to presume what those vulnerabilities are.
Recovery also deserves scrutiny. After systems are restored, schools may need to reconcile attendance records, update information entered manually and verify that restored data are complete and accurate. A recovery procedure should account for those responsibilities, not only the moment a network becomes available again.
The Cybersecurity and Infrastructure Security Agency recommends that K-12 schools maintain offline backups and test data restoration. That guidance reinforces the need to verify that recovery measures work rather than assuming that a backup will be usable during an incident.
Operational continuity is a related but separate challenge. Restoring digital records does not, by itself, demonstrate how well a school has maintained student services while access was disrupted.
For Tashi Jones, a middle school assistant principal, an outage tests a school’s planning more than its technology.
“I do believe schools are able to function without technology. However, as a society, we have become so reliant on technology that when technology fails, it exposes the gaps in our preparedness. Schools must have systems and procedures in place that allow essential operations to continue without compromising student safety, communication, or learning. Technology should enhance how schools operate, not determine whether they can operate at all.”
Whether Indiana schools have those systems and procedures in place is a question; records can help answer. To understand Indiana’s readiness, school corporations should be asked to provide records of recent cybersecurity exercises, disaster-recovery tests or technology-outage drills. They should explain what was tested, who participated, which services were covered and what changes followed.
IDOE should also be asked whether it collects statewide information on these exercises, whether it evaluates schools’ ability to maintain essential services during technology outages and whether it has recommendations for districts that have not tested those procedures.
The answers would help establish whether the state’s reported cybersecurity measures are accompanied by evidence of operational preparedness. If the information is not collected statewide, that should be made clear rather than treated as proof that districts have not practiced.
Schools should not be expected to prevent every cyberattack. They should, however, prepare for disruptions and understand how to limit their effects on students and staff.
That requires more than a document stored on a server. It requires clear responsibilities, reliable backup procedures, staff who know what to do and exercises that reveal whether the plan works as intended.
The ultimate measure of preparedness is not whether a district can say it has a plan. It is whether the district can show what it has tested, what it learned and how it addressed the problems it found.
*At the time of publishing, IDOE had not responded to the additional questions posed surrounding the cyber preparedness intended top-down approach.
Contact Health and Environmental Reporter LaTasha Boyd Jones at tashaj@indyrecorder.com or follow her on social media @iamtashajones.
Tasha Jones is a poet, writer, researcher, and educator whose work explores language as a tool for liberation and resistance. She hosts In the Beginning: The Spoken Word Podcast, the #1 spoken word podcast on Apple and Spotify. Tasha is also the Poems & Parables Literary Journal editor and is currently writing Pyramids. Plantations. Projects. Penitentiaries. You can follow her on social media: @iamtashajones, @itbspokenwordpod, and @poemsandparables.
