Back in December 2017, I wrote about a tabletop exercise game built after hearing Round Rock ISD’s CTO (Chief Technology Officer) Mark Gabehart (now retired) talk about disaster preparedness. “It’s the processes and procedures,” he said. “One way is to do tabletop exercises to see what we would do in the event of a disaster.” This idea caught my imagination.
That post introduced When Disaster Strikes, a digital card deck of scenarios designed to help K-12 technology leaders stress-test their cybersecurity, disaster recovery, and business continuity plans in a low-stakes, collaborative setting. More than 20 scenarios. Real incidents. Stolen USB drives, ransomware on cafeteria point-of-sale systems, hurricanes, disgruntled employees.
Several years have passed. The threat landscape has not stood still. Neither should our tools.

Today, I am releasing a significantly expanded update: When Disaster Strikes: Cyber Edition, a standalone, interactive, web-based game rebuilt from the ground up for 2025 and beyond.
Why Update Now?
When the original game published, ransomware was an emerging concern. Today it is the dominant threat facing K-12 districts. The FBI, CISA (Cybersecurity and Infrastructure Security Agency), and MS-ISAC consistently rank education as one of the most targeted sectors. Districts have been forced to cancel school days, rebuild their entire Active Directory from scratch, notify tens of thousands of families, and face federal investigations. All of this from incidents that a well-run tabletop exercise might have surfaced as a gap beforehand.
Federal guidance has also matured considerably. NIST (National Institute of Standards and Technology) released Cybersecurity Framework 2.0 in 2024, adding a new Govern function and sharpening its applicability to organizations of all sizes. CISA expanded its free K-12 resources, including a full suite of Tabletop Exercise Packages covering ransomware, active threats, and vendor supply chain compromise. These resources are exceptional and I wish I had enjoyed access back when I first prepared the tabletop game. Unfortunately, too few districts know they exist. The update puts them in one place.
Another reason for updating? Andrea Olkin (Instructional Technology, Lander Grinspoon Academy) asked a question in the TCEA Community:
I am interested in setting up and running a tabletop exercise to help us ensure our incident response plan for a cyber security attack, should bad actors gain access via phishing or a BEC/fake business interface.
Absent any other changes, Andrea’s question would have been enough. Thank you, Andrea, for bringing this forward.
What’s New
The game is a single self-contained HTML file. No server, no installation, no login. Open it in a browser and you are ready to play. I love how easy it is to access without login and password, as well as the random scenario button.
40 scenario cards
Eighteen new cyber-focused scenarios address threats that were rare or nonexistent in 2017, including but not limited to: MFA (Multi-Factor Authentication) fatigue attacks, deepfake voice fraud, Active Directory Golden Ticket compromises, misconfigured cloud storage, and QR code phishing placed physically inside school buildings. But wait, there’s more! Also, zero-day vulnerabilities on student Chromebooks, GPS and transportation system attacks, wiper malware that permanently destroys student records, and AI-generated voice cloning used for wire fraud. Each scenario draws from patterns observed in real K-12 incidents. How cool is that?
CISA-aligned response guidance
Every scenario card includes two panels: immediate action steps and preventive controls. Both panels link directly to free federal resources available to every K-12 district.
Some more updates:
- NIST CSF 2.0 integration. Every scenario is tagged to one or more of the six CSF functions: Govern, Identify, Protect, Detect, Respond, and Recover. A quick-reference guide is built into the game so teams can map their responses to a recognized national standard.
- AI scenario generator. For facilitators who want a scenario participants have never seen, the built-in generator creates new incidents on demand by threat type and severity. It produces a full scenario narrative, discussion prompt, and CISA-aligned guidance in seconds. This feature requires an internet connection; the scenario library works entirely offline.
- Anatomy of a Response framework. Every response should address six questions: What is your Recovery Time Objective? What is the likelihood of this scenario? What is the operational impact? Who needs to be involved? What systems or data must be restored first? What NIST CSF controls would prevent recurrence?
Wow, right?
Getting Started
To get started, you can either view the game online (it’s hosted at GitHub with a README that includes a full scenario list and links to all referenced federal resources) or follow these steps:
- Download the HTML file
- Open it in Chrome, Firefox, Edge, or Safari
- Run a session.
The game even includes a dice roll for those of you who like to roll dice:

Go Cross-Functional
Cross-functional participation matters more than ever. Your technology team should not be the only people in the room. Bring in your CFO (Chief Financial Officer) for Business Email Compromise scenarios. Bring campus principals for social engineering scenarios. Bring HR for insider threat scenarios. Bring communications staff. Every major cyber incident becomes a public communications crisis within hours. These scenarios surface those dependencies naturally. This is a great way to explore your incident response plan. As Andrea Olkin plans to do, consider adding your own mix of questions to each scenario response. Andrea includes these:
- Who does our director call when everything is locked up?
- What are the steps we need to take, and what is the order in which to take them?
- Who does what here?
- What are the costs?
If you are a Texas district, your regional Education Service Center may be able to help you facilitate a session. CISA also offers free facilitation support through its regional offices, a resource worth requesting.
The threat is real. The guidance is free. The game is ready. Get your team together and run the exercise.
Access the game at mglearn.github.io/wds. Questions? Reach me at mguhlin@tcea.org (@mguhlin). This game was vibe coded using Claude 4.6 Sonnet, Thinking mode.
Related Resources






























