Run a 45-minute tabletop exercise for your school

Set up

Invite the people who would actually do the work.

• Invite: an administrator, a counselor, IT, the SRO or law-enforcement liaison, the communications lead and a scribe.
• Bring printed copies of the image-incident and disclosure playbooks.
• Appoint one facilitator who does not play a role.
• Use no real student names or real images. Make the scenario fictional.

Facilitator script

Open (3 minutes)

“This is a practice. No one is being graded. We are looking for gaps in the plan, not mistakes by people.”

“We will read three developments. After each one, tell me what you would do, who does it, and what you need.”

1. Read Inject 1. Give the group 10 minutes.
2. Read Inject 2. Give the group 12 minutes.
3. Read Inject 3. Give the group 10 minutes.
4. Run the debrief questions for 8 minutes. Finish by naming three fixes and owners.

The three injects

Inject 1: Friday, 2:40 pm

“A student stays behind after class and tells a teacher that an adult they met online is threatening to share a private photo unless the student sends money. The student begs the teacher not to tell anyone.”

Ask: What does the teacher say first? What can the teacher not promise? Who do they call, and how fast? Who is on duty at 2:45 on a Friday?

Inject 2: Monday morning

“A counselor learns that a phone confiscated by a teacher may contain an intimate image of another student. The teacher has already unlocked it and scrolled through the messages.”

Ask: What is the hard rule? Who takes custody of the phone and how is it documented? Who calls law enforcement and the NCMEC CyberTipline? What do we do about the teacher’s exposure to the image, without blaming them?

Inject 3: Tuesday, 4:15 pm

“A parent emails a local reporter and copies the school: ‘My child says an image is going around your school and no one will tell me anything.’ The reporter calls the office.”

Ask: Who answers the phone? What is the holding statement? What can and can’t we say about students? Who approves it?

Debrief and score the gaps

Use this checklist. Every unchecked box is a fix.

• Everyone knew their role without looking it up.
• The team named the hard rule: no one views, copies, forwards or screenshots the image.
• A named person called law enforcement and made the NCMEC CyberTipline report.
• A named person owned device custody and the log.
• The reporting timing was correct against district policy and Nevada law, as confirmed with counsel.
• The affected student was protected and supported, not questioned as a group.
• A communications draft was ready in under 30 minutes and avoided naming any minor.
• Contact numbers were current and reachable out of hours.

1. Count the unchecked boxes. Do not rank people.
2. Pick the top three gaps. Name one owner and one date for each.
3. Update the roles table and templates within two weeks.
4. Schedule the next tabletop in 6 to 12 months.