K12 Learning Continuity Plan Learning Impact Analysis

K12 Learning Continuity Plan Learning Impact Analysis

Mission Statement and Scope

Mission

The mission of [District Name], in cooperation with parents and the community, is to provide a caring and challenging environment where all students develop as lifelong learners to become contributing, responsible members of a changing world.

Scope

This plan document exists to provide a framework for the prioritization and recovery of essential services in the event of a major outage of any type, putting the operations or learning activities of the district in jeopardy. The plan may include scenarios such as:

• Communications loss
• Cybersecurity attack
• Data theft, breach, or corruption
• Fire
• Internet/Network services loss
• Power outage
• Tornado, flood, or other weather-related damage
• Vandalism and acts of sabotage

Key roles

LCP sponsor: Superintendent

The LCP Sponsor is an executive level leader in the district who serves as the champion of the LCP in the organization. The sponsor is ultimately responsible for the completion of the project within the organization and can remove barriers, authorize budget, and assist with problem solving for the LCP Coordinator and team to ensure the development of a plan is successful.

LCP coordinator:  Director, Technology and Information Services

The LCP Coordinator is responsible for leading the development and maintenance of the district’s LCP. The LCP Coordinator serves as the point person for directing the development of the plan, and ultimately is responsible for providing training on the plan and overseeing testing of the plan.

LCP project team: Information Security and Data Privacy Committee & Other Staff as needed

The LCP project team is tasked with developing the district’s LCP, under the direction of the LCP coordinator. We involve a team because no one person should have the sole responsibility for creating an LCP for the whole organization. It is not possible for a single person to know and understand every nuance of the organization and to individually make a plan that meets the diverse needs of the district.

The LCP project team may include:

• Director, Technology & Information Services (LCP Coordinator)
• Network Infrastructure Manager
• Network Systems Administrator
• Information Systems Manager
• Virtual Chief Information Security Officer (vCISO)
• Select members of the Information Security and Privacy Committee
• Select members of the Innovation Steering Committee

Learning Impact Analysis

In the business world, these documents are commonly referred to as a Business Impact Analysis and a Business Continuity Plan. Since we are an educational institution, our business is learning. We’ve taken the liberty of reconstituting these industry standard labels to reflect our core purpose: Learning.

The Learning Impact Analysis (LIA) exercise is a critical prerequisite to forming the Learning Continuity Plan. During the LIA, we predict the consequences of disruption or complete loss of a critical district’s functions or processes, and gather the information needed to develop recovery strategies. There are many possible scenarios which should be considered. Identifying and evaluating the impact of disasters on our support of learning activities, the district provides the basis for investment in recovery strategies as well as investment in prevention and mitigation strategies.

Existing resources

Identification of critical services

• Communications policies and procedures
• Emergency procedures
• Equipment inventories
• Inclement weather policies and procedures
• Information security incident response plans
• Information security policies and procedures
• Inventory of critical learning services
• Inventory of critical staff
• School closure policies and procedures
• System backup schedules and procedures
• System recovery procedures and documentation

Before determining the potential consequences of loss, we have identified those services we deem critical to the district’s operations and those which sustain learning activities. A few of the key factors considered include:

• What services are mission critical to district operations and learning activities?
• What population is serviced by each service?
• What services support life, health, or safety requirements?
• What services support specific legal requirements?
• When must each service be available and operational?
• How long can each service be unavailable before significantly, negatively impacting operations or learning?

Identification of critical staffing resources

In addition to services, the human beings that deliver or oversee those services are also critical resources. In the case of a disaster of some magnitude, key staff could be unavailable as well. We must identify those staff roles that we deem essential to the district’s operations and those who are required to sustain learning activities. A few of the key factors that must be considered include:

• What staff members directly support services that are mission critical to district operations or learning activities?
• Who are these staff members and what is their job function and description?
• Who functions as a backup for each identified critical staff member?
• How do we build depth to ensure backup staff are available?

Priority and sequence of restoration of services

Timing Considerations

• MTD – Maximum Tolerable Downtime (Worst-case scenario)
  • How long can the service be unavailable?
  • How long can the service be down without causing significant damage to the district?
  • At what point will the lack of the service become intolerable?
  • When is there a life/safety issue? When are we in violation of legal requirements?
  • Can vary based on certain cycles and timeframes
    • Hiring season
    • Student testing windows
    • Payroll and other cyclical, critical processes
• RTO – Recovery Time Objective (Goal)
  • How long will it take to reestablish the critical services ?
  • What is our reasonable estimate and plan for how quickly this can occur?
    • Restored to minimally operational status (as in disaster recovery)
    • Full operational restoration is often a secondary process, requiring additional time and resources
• RPO – Recovery Point Objective (Data loss)
  • How much data can be lost related to this service, before significant harm occurs?
  • This is measured from the point of a critical event to the most recent, preceding data backup

Critical Services (table linked from master asset/role spreadsheet)

.Application/Service Location MTD (Max Tolerable Downtime)RTO (time to recover)RPO (max data loss)Building Automation Management On-Prem Varies around weather conditions Need to set DR process N.A. District Websites Cloud Vendor SLA Vendor SLA Vendor SLA Google Classroom Cloud Vendor SLA Vendor SLA Vendor SLA Google G Suite Enterprise Edition Cloud Vendor SLA Vendor SLA Vendor SLA Local Network File/Print AccessOn-Prem2 days Need to set DR process 2 weeks Security Camera Access (Health Life Safety)On-Prem1 day Need to set DR process N.A. Telephone – Calling Access On-Prem 1 day Need to set DR process N.A. Telephone – Voicemail AccessOn-Prem1 day Need to set DR process N.A. Zoom Cloud Vendor SLA Vendor SLA Vendor SLA Source Table

Learning Continuity Plan (LCP)

LCP Response Team

While the LCP Project Team was charged with the development of the LCP, the LCP Response Team has the responsibility of putting the plan into action in the event of an emergency, disaster, or crisis, requiring the use of the LCP. Members of this team have major tasks to complete in order to ensure the successful execution of the LCP and ultimately, maintaining the continuity of learning and other critical services for the district.

Primary members of the LCP Response Team may include members of these departments:

• Administration
• Communications
• Data Privacy
• Human Resources
• Instructional Support
• Physical Security
• Technology Support
• Information Security
• Information Technology

Roles and Responsibilities

A RACI matrix may be developed to document key tasks and identified roles, to make it clear who is responsible, accountable, consulted, or informed related to each key task.

• Responsible – person or role responsible for addressing or completing a task or process
• Accountable – person or role responsible for ensuring that a task or process is completed, this is also the task approver and/or the final authority on whether the task should be done
• Consulted – person(s) or role(s) whose subject matter expertise is required in order to complete the item
• Informed – person(s) or role(s) who needs to be kept informed of the status of item completion

Triggering Events

Key triggers that may invoke activation of the LCP may include, and are not limited to, events such as the following.

• Flooding of the district and/or surrounding areas
• Loss of access to key building(s)
• Loss of data (e.g. data center destruction, crippling ransomware attack)
• Permanent physical loss of key building(s)
• Spread of disease or illness (measles outbreak, norovirus outbreak, new infectious disease outbreak like COVID-19)

Triage Process

The LCP response team must determine whether a particular event is significant enough to warrant triggering the LCP. As used in a healthcare setting, a triage process is used to accomplish this task.

Events that would require the district to activate the LCP are those that jeopardize the continuity of critical services including student learning. Some key questions for the LCP response to consider include:

• What is the event that is being addressed?
• Does this event limit access to essential physical or virtual resources?
• Does this event impact the ability of students to access district facilities, resources, applications, data, staff members, teachers, or other critical services?
• What is the anticipated duration of the event?
• Once the event has ended, how long will it take to restore services to pre-disaster status?

Activation of the LCP

The LCP coordinator in consultation with the LCP sponsor has the authority to declare activation of the LCP. If these individuals are unavailable, the Network Infrastructure Manager in consultation with the Associate Superintendent for Student Learning has backup authority.

Depending on the situation(s) causing activation of the LCP, the critical services list must be reviewed and prioritized, identifying those specific services that need to be re-established or provided in order to support learning continuity.

Steps one through five below must be completed for each of the highest priority services identified in the assessment above, based on the critical service inventory. These are then documented and added to the working LCP.

1. Identify the key components of the service being addressed
2. Identify options for delivering the service in a new way (What is the disaster recovery plan?)
3. Identify required resources
4. Identify dependencies and barriers
5. Confirm the recovery objective

Communications Planning

The single point of communications contact during execution of the LCP will be the Communications Director. The Communications Specialist will serve as a backup point of contact. The LCP coordinator and LCP sponsor will be included as reference points to ensure consistency and accuracy of information being communicated.

Our single overriding communications objective is to keep staff and other stakeholders informed about what has happened, and what is happening to resolve the situation.

Document the vetting process that the organization will use to approve outbound communications during the execution of the LCP. This must be included in the LCP communications plan.

Identify and document all audiences with whom the educational organization will need to communicate during the crisis.

Identify and document how the phone system works and any steps for accessing and using the phone system remotely. Include the LCP plan documentation of single points of failure in the phone system setup.

Identify and document how the automated messaging system works, who has access to send messages, and include this information in the LCP communications plan.

Clearly define in the communications plan if, when, and how email will be used. Determine what accounts will be used and/or whether an event specific email account will be set up. Add to the LCP communications plan.

Include whether email communications will be one-way with a message that the mailbox is unmonitored, or bi-directional. If communications are bi-directional, identify those responsible for answering incoming messages. Include this information in the LCP communications plan.

Complete a thorough inventory of all social media accounts and platforms in use by the school, district, college, or university. Make sure to include primary and secondary contacts for all social media accounts and how to reach those individuals. Document in the LCP communications plan.

Clearly document how access to each social media site is protected and ensure that there is a plan for monitoring and removing inaccurate posts from social media. Include this information in the LCP communications plan.

Identify and document radio stations and programs with which to work to distribute information during an emergency or crisis when the LCP is being used.

Complete a thorough inventory of all websites in use in the school and district. This can include public-facing sites and student or staff-facing sites. Make sure to include primary and secondary contacts for all web sites and how to reach those individuals. Document in the LCP communications plan.

Clearly document where each web site is hosted and how access to each web site is protected. Ensure that there is a plan for monitoring and removing inaccurate content from the web site(s). Include this in the LCP communications plan.

Identify television stations, newsrooms, and reporters with whom the organization may work in a crisis or emergency. Document the contact information for connecting with these resources and include them in the LCP.

Identify newspapers and reporters with whom the organization may work in a crisis or emergency. Document the contact information for connecting with these resources and include them in the LCP.

Maintain the Plan

Determine where and how the plan will be stored. Make sure to include two separate storage options and mediums.

Determine what information is considered confidential or sensitive, who should have access, and how the plan should be protected.

Assign ownership and responsibility for maintaining and updating the plan.

Develop a schedule for agreed upon updating and maintenance of the plan.

Test the Plan

Document goals for the test.

Identify test scenarios and document the scope of the test.

• Tests can be based on:
  • A specific building or location, e.g. school/building, lab, data center
  • A specific critical service, e.g. education delivery, food services, payroll
  • A specific process, e.g.  communication, data restoration, state testing, admissions, etc.
  • Failure of critical infrastructure, e.g. power, transportation, etc.
  • Or any combination of the above
• Create a disaster storyline complete with a timeline of events that are beyond the control of the test participants.
• Identify who will participate in the test.
• Schedule the tabletop test.
• Document goals for the test.
• Identify test scenarios and document the scope of the test.
• Tests can be based on:
  • A specific building or location, e.g. school/building, lab, data center
  • A specific critical service, e.g. education delivery, food services, payroll
  • A specific process, e.g.  communication, data restoration, state testing, admissions, etc.
  • Failure of critical infrastructure, e.g. power, transportation, etc.
  • Or any combination of the above
• Create a disaster storyline complete with a timeline of events that are beyond the control of the test participants.
• Identify who will participate in the test.
  • Schedule the tabletop test.

Conduct a Tabletop Test

Designate a facilitator to conduct the test and an observer to take notes on the process.

Useful questions to ask as part of a lessons learned activity include:

• What went well?
  • Provide examples of successes in the learning continuity response process.
• What did not go well?
  • Where did the team run into challenges with the response process?
• What gaps were identified in the LCP that should be addressed?
• What components of the response might have been handled better if done differently?
• What challenges or surprises emerged during the tabletop test that the team had not anticipated?
• What mistakes did the team make?
  • What steps would they take to avoid these mistakes in the future?
• What skills or which people were missing from the response process?
  • Who should be added to the plan and/or included next time?
• Were there team members that were unnecessary?
  • Should they have been removed from the scenario?
• What processes were missing?
• What should be added to the LCP?

Activating the Plan

Identify the possible or actual emergency/disaster and activate the plan.

Notify and assemble the LCP response team.

Identify and agree on a check-in schedule for the LCP Response Team.

Designate the communications coordinator and communicate early and often.

Identify the scope of the emergency.

Key questions to ask to assess the scope of the emergency include:

• What is the physical scope of the emergency (single building, town/city, region, state, nation)?
• What critical services on the service inventory are affected?
• What critical services are affected that are not in the inventory?
  • Be realistic here, there is no such thing as a perfect LCP.
  • There are many functions that happen every day that organizations take for granted.
  • Pay particular attention to any critical services that may have been accidentally ommitted from the LCP.

• Which of these services support life and safety functions?
  • Physiological needs such as food, water, shelter, and warmth/cooling should be highly prioritized for both students and staff.

• Are any communities or populations being disproportionately impacted by the event?
• What additional services need to be extended to support those populations?

• Identify services impacted and confirm priority of response.
• Begin restoring or transitioning services to their continuity state based on the prioritization in the plan.

Create framework for adapting or restoring critical services that support learning continuity:

• Identify any dependencies for providing critical service that have been disrupted or are unavailable. Potable water and electricity or gas ovens are dependencies for providing hot meal services.
• Restore, repair or substitute the dependencies to provide a foundation for continuing or restoring critical services.
• Determine any staffing or resource needs for providing the critical service and identify personnel to do the work. This may include asking staff to do work that is outside the normal scope of their daily duties.
• Determine if the service can be restored or if it needs to be adapted to meet the existing needs.
  • During an extended emergency, critical services may need to be adapted and provided differently.
  • For example, during the COVID-19 pandemic of 2020, many schools adapted their free and reduced lunch service from an on-site hot lunch service to a school bus-based lunch bag delivery service. Schools even drafted staff from all positions to help prepare and deliver meals. Recognizing the food insecurity faced by many families in their communities, some districts even extended their services to providing family meals.

Taking Care of the Team During an Emergency Response

• Identify and document thresholds and expectations for when all personnel involved in implementing the LCP will take breaks.
• Understand the trauma-informed care approach to addressing traumatic events and consider the five components of trauma-informed care in providing continuity of learning and critical services.
• Identify and document available resources in the organization and the community for providing psychological support focused on grief counseling during and after the event. Include these resources in the LCP.
• Build resiliency into the educational culture.
• Encourage positive self-care for educators, students, etc., in your messaging and provide time and resources for self-care.

Adjust the Plan

• Practice and embrace improvisation in daily experiences. Identify and recognize where team members have successfully improvised in adapting responses during training and drills.
• Practice and model the ability to adapt to new situations and new experiences.
• Break the problem(s) into component parts and start resolving them or adjusting services to re-establish learning continuity.

Returning to Standard Operations

Determine when the need for the LCP has passed and if the educational organization is ready to return to standard operations.

Return critical services to standard operations and complete this demobilization checklist.

• Restore critical services to their standard operational procedures.
• Document all decisions and changes to critical services that occurred during the event.
• Complete all financial paperwork and forms (covering any equipment or services purchased, leased, or consumed to support the LCP).
• Return all assigned equipment to the appropriate location.
• Replace or repair broken or lost items
• Have all team members prepare personal equipment and belongings for return to normal work assignments.
• Have all team members return any temporarily assigned equipment to the organization.
• Facilitate the return of temporarily assigned personnel and equipment to their normal work assignments.
• Transition all staff and equipment to their normal location (or into a new permanent location if the circumstances dictate).
• Identify any critical services in which the LCP Response Team has made permanent changes and transition those services to standard operations in their new format.
• Other items as determined by the LCP Response Team.
• Participate in lessons learned and after-action activities.

Lessons Learned

Schedule and complete a lesson’s learned exercise.

Some questions to consider include:

• What went well?
• What went wrong?
• What needs to be improved?
• What would the team do differently next time?
• What was beyond the control of the team?
• What things surprised you?
• What didn’t you expect?
• What mistakes did you avoid making?
• What would have made this experience smoother?
• What information in the plan was inaccurate or requires updating?

Write an after-action report.

The After Action Report should contain the following information:

• Incident Overview
• Performance Metrics
• Analysis of LCP effectiveness
• Recommendations
• Opportunities for improvement and next steps
• Conclusion

Share the lessons learned with your leadership teams and other district peers.

Appendix

Credit and much thanks to Amy McLaughlin for her LCP guidance provided by her book on this topic and to Rod Russeau for his generous contribution to the K-12 information security community.

• McLaughlin, Amy.
• Learning Continuity Planning: A Handbook for Schools, Colleges & Universities
• Self-published, 2021
• Rod Russeau (CHSDistrict99)

Estimate your score or book free demo today

‍Estimator | Get a Demo