created 23 August 2026 · last modified 23 August 2026
a cyber weather service for schools
The Storm Scale.
Cyber threats do not arrive like a movie hacker. They arrive like weather — constant pressure, sudden advisories, the occasional named storm. The job is not to defeat the weather. It is to keep school open through it.
This is a six-rung scale you can post on the wall. Each rung tells you two things in plain English: what puts you there (the trigger), and what to do (the concrete moves to pull back risk). It is built for an under-resourced district IT lead who needs to decide something on a Tuesday morning — not for a security team you do not have.
The single move at every rung is the same: as conditions worsen, turn down how much anything is allowed to do on its own — vendors, admin changes, and any agentic AI systems. You tighten the leash as the sky darkens, and loosen it again only after you have confirmed the weather has passed.
the one rule behind the whole scale
Never let the autonomy in your environment exceed what you can safely watch and support. As the weather worsens, safe capacity shrinks — so the autonomy you allow must shrink with it.
Degrading on purpose is not failure. It is how a small, under-resourced district stays open through a storm instead of collapsing in one.
In the framework’s shorthand: A ≤ E — allowed autonomy stays under the environment you can actually support.
§01The scale — Clear to Recovery
Read it top to bottom. Green is calm; the color deepens toward red as the weather turns; amber marks Recovery, the deliberate cool-down where you verify before you restore. Do not wait for a “confirmed breach” to act — by then the storm is already inside. Move up a rung when the triggers appear, and back down only after Recovery.
BackupsRunning daily and restore-tested on a schedule.
NetworksStudent, guest, staff, and admin kept separate.
Level 1
Watch
Something new is on the radar. Reduce your exposed edges.
You are here when…
A new CVE (a freshly disclosed software flaw) affects a system you run.
A vendor issues a security advisory or urgent patch notice.
You see rising scans, blocked logins, or more fake vendor / password-reset emails.
Do this
Internet-facing systemsPatch these FIRST — before internal ones.
Vendor & MSP accessTime-boxed and logged; nothing standing-open.
Admin changesLoop in a second person before the change.
Agentic AI systemsRecommend-only for anything that touches production.
AccountsDisable stale accounts; confirm MFA on every admin.
Level 2
Warning
Schools like yours are being hit right now. Tighten vendor and admin paths.
You are here when…
Active exploitation is reported in your sector — other districts or your edtech vendors are being attacked.
A threat-sharing group (MS-ISAC, K12SIX, your state) flags an in-progress campaign.
Do this
Vendor & MSP accessSupervised — a staff member watches the session live.
Admin changesSecond approval required, no exceptions.
Remote admin pathsClosed unless actively needed and watched.
Agentic AI systemsRecommend-only — no autonomous changes.
BackupsConfirm they are immutable (cannot be altered or deleted).
Student-data exportRestricted to named, approved requests only.
Level 3
Storm
Confirmed attempts, or your telemetry is going dark. Protect the Minimum Viable School.
You are here when…
You see confirmed attack attempts aimed at you.
Your logging or monitoring becomes unreliable, incomplete, or goes quiet (degraded telemetry).
Do this
PriorityProtect the Minimum Viable School (below). Let the rest degrade.
Vendor & MSP accessPaused, or fully supervised only.
Admin changesBreak-glass only — emergency, documented.
Student-data exportBlocked.
BackupsLocked / immutable; pull one offline copy today.
NetworksIsolate student and guest networks from the core.
Agentic AI systemsObserve-only — no recommending, no acting.
Level 4
Severe Storm
Compromise likely or confirmed. Isolate, restore, run school by hand.
You are here when…
A ransomware note, data-theft extortion, or spreading account takeover.
Compromise is confirmed, or so likely you should act as if it is.
Do this
Affected systemsIsolate immediately — pull them off the network.
ContinuitySwitch to manual: paper attendance, phone trees, printed procedures.
RecoveryRestore from a known-clean, immutable backup only.
Vendor & MSP accessOff.
Agentic AI systemsOff.
EvidencePreserve logs and images — do NOT wipe before help arrives.
Who to callCISA, FBI, your state / regional partner, MS-ISAC — now.
Level 5
Recovery
Threat contained. Verify a clean state BEFORE you restore convenience.
You are here when…
The active threat is contained and no longer spreading.
You are ready to bring services back — but have not yet confirmed the environment is clean.
Do this
First ruleVerify a clean state before restoring any autonomy or access.
CredentialsRotate passwords, keys, and tokens across affected accounts.
ServicesRe-enable one at a time, watching telemetry between each.
Vendor & MSP accessRestored last, and supervised.
Agentic AI systemsBack to recommend-only first, then scoped — never straight to autonomous.
After-actionDocument what happened; run a tabletop so next time is faster.
§02The Minimum Viable School
At Storm and Severe Storm, the goal stops being “keep everything running.” It becomes keep school running. These are the services you protect first and give up last. Everything else can degrade — nonessential apps, convenience integrations, automation — so that these stay up.
Decide this list before a storm, not during one. Write down, for each service, the manual fallback that keeps it working when the network is down.
01
Attendance
Legally required and safety-critical — you must know who is in the building.
02
Parent communication
Families need to reach the school and hear from it, storm or not.
03
Emergency communication
The one channel that can never be down — lockdowns, closures, weather, medical.
04
Student information system (SIS) access
Enrollment, schedules, health flags, and contacts that staff need to run the day.
05
Transportation
Buses have to run and route; kids have to get to and from school safely.
06
Food service
Many students depend on school meals; payment can go manual, meals cannot stop.
07
Payroll
Staff must be paid on time — run it under manual procedures if the systems wobble.
08
Identity recovery
A way to safely reset and restore accounts when credentials are in doubt.
09
Backup restore
A known-clean, tested copy to rebuild from — the thing that ends the incident.
10
Manual continuity procedures
The paper-and-phone playbook that keeps school open when the network is down.
§03Use it Tuesday morning
You do not need elite tooling to start. You need a survival posture and a few decisions made in advance. Six of them:
Print the scale. Put it where the people who make the call can see it.
Agree today on your Minimum Viable School list and each service’s manual fallback.
Decide who declares a rung change, and who they call at each level.
Pre-write the Storm and Severe Storm moves as a checklist — so no one is improvising mid-incident.
Confirm backups are immutable and restore-tested. This is the move that ends the incident.
Join MS-ISAC and K12SIX for low-cost tools and early warning; know your CISA / FBI / state contacts.
When your ability to watch drops, the autonomy you allow must drop with it. That is the whole discipline. A district that degrades on purpose stays open.
Perkins, C. (2026). The Storm Scale — a cyber weather service for K-12 districts. Kinetic Trust Protocol Advocacy. https://kinetic-trust-protocol.net/advocacy/k12/storm-scale