We need to comply with MEB's cyber incident response procedure — as a school, where do we start?

The thing they scrutinize most during audits is log verifiability. Storing raw text files on a log server won't cut it; they require time stamps and hash records compliant with Law No. 5651. If you fail to map the internal IP assigned to a parent or student on the guest Wi-Fi to the external IP, you'll be cited for non-compliance on the spot.

Are student and staff computers sitting on the same network subnet? If you don't have proper VLAN separation, you'll fail the technical audit regardless of how well your procedures are drafted. Have you verified whether the ministry inspectors specifically check for administrative network isolation?

The formal decision establishing your institution's Cyber Incident Response Team must be officially documented with the school principal's signature and recorded in the dated board decision registry. Submitting a copy of your incident response plan to the private education institutions department of the district national education directorate alongside an official cover letter will significantly smooth out your audit process.

Last term, we went through a similar audit at our 1,100-student campus. They asked us to fill out the ministry's standard printed forms and provide timestamped DHCP and firewall logs going back 730 days. Without hiring any outside consultants, we passed the inspector's audit with flying colors after two weeks of organizing our files.

edit: fixed a few typos.

at our school they made the assistant principal the lead and put me down as technical staff... we downloaded the sample incident response plan template from the MEB site and tweaked it for our school. it feels like pure formality but district MEM approved it when we submitted the papers, no need to panic.

The templates published by the ministry are usually designed for the massive staff sizes of public institutions. You can't expect a 2-person IT team at a private school to generate reports like a 24/7 SOME team. Write a realistic internal directive; don't trap yourself by including steps in the procedure that you can't actually carry out.

First thing tomorrow, download the 'Cyber Incident Notification Form' attached to MEB's Information Security Directive to your computer. Then, test whether the timestamp license on your internet gateway's logging device is active; these are the two most critical tangible items.

I'd say don't rush. Your time to detect an issue directly determines its cost.

If you post the result here it will help others too.

You're right, I've been down that road too. Start with a small trial; don't commit to everything at once.

Taking measures without an inventory leaves doors you haven't seen open. Proven by experience.

This thread is archived. The harder it is to reverse a decision, the slower you should make it.

Hope this helps.

I agree with this. If you scold false alarms, nobody will report again.

When making decisions, write down the worst-case scenario too, not just the best. Hope this helps.

How did you solve this? The biggest time-waster for us was not knowing who had the final say.

Of course, it varies if your situation is different.

My perspective changed after experiencing that. btw people defend habits, not processes. Resistance comes from there.

Most time waste accumulates in tasks waiting for approval. That's all, sorry if I went on too long.

I feel the same way. When you try to change everything at once, nothing settles.

If permission and scope aren't in writing, don't start that test. This is my opinion I'm not claiming it's absolute truth.

i can't fully agree with this. everything goes well for the first thhree months; problems arise in the fourth.

if the notification path is long, notifications dont arrive; missing notifications mean delayed incident detection but corrct me if Im wrong.

Correct.

Id appreciate it if you shared the outcome.

You're right. An untested backup is not a backup.

I'm also curious if anyone does it differently.