For most schools, technology has become so embedded in everyday operations that it's easy to underestimate just how much depends on it.
Teaching and learning platforms. Microsoft 365. Student information systems. Finance and administration. Communications with families. Staff devices. Cybersecurity. Internet connectivity. Cloud applications. Access to files and data.
When everything is working, much of this technology quietly fades into the background. But what happens when it doesn't?
For school leaders, IT resilience is no longer simply a question of whether the IT team can fix a technical problem. Increasingly, it's an operational question: If a significant IT disruption occurred tomorrow, how much of your school could keep operating — and for how long?
1. Start With a Different Question: What Actually Stops If IT Stops?
When organisations think about IT downtime, it's easy to picture something relatively contained: an application becomes unavailable, the internet slows down or staff can't access email for a while.
In a modern school, the consequences can spread much further. Consider what would happen if staff suddenly couldn't access Microsoft 365. Or if your student information system became unavailable. Or if an internet or network outage affected an entire campus.
Could teachers access the resources they need? Could administration staff retrieve student information? Could your finance team continue working? Could the school communicate effectively with staff and families? Could employees access critical cloud applications? Could your IT team determine what had happened and restore normal operations?
The point isn't to assume that every technology problem will become a major crisis. It's to understand which technology failures would have the greatest operational impact on your school.
That distinction is important. Resilience isn't about making every system equally bulletproof. It's about knowing which systems matter most and ensuring the school has appropriate contingencies around them.
2. Cybersecurity Is Only One Cause of Disruption
Cyber incidents understandably receive much of the attention when organisations discuss IT resilience.
And schools have good reason to take cybersecurity seriously. They operate complex technology environments, support large numbers of users and devices, and hold information that needs to be carefully protected.
But a cyberattack isn't the only thing that can disrupt a school. An outage could also begin with:
- hardware failure
- internet or network disruption
- a failed software update
- cloud service downtime
- accidental deletion or configuration changes
- power or infrastructure issues
- a third-party application failure
- an unavailable key member of the IT team
The underlying cause may be different, but leadership ultimately faces the same question: How quickly can the school adapt, recover and return to normal operations?
That's why IT resilience needs to extend beyond cybersecurity prevention alone.
3. Backup Is Important. Recoverability Is What Matters.
Most organisations understand the importance of backups. But having a backup and being able to recover quickly from a major disruption are not necessarily the same thing.
A more useful question is: If we needed our critical systems and data back tomorrow, how confident are we that we could actually restore them?
That means understanding what is being backed up, how frequently, where those backups are stored, who can access them and whether the recovery process has actually been tested.
It also means establishing priorities. If multiple systems were unavailable at once, which would need to be restored first? What could the school operate without for an hour? What about a day? Which systems would become critical almost immediately?
Recovery planning turns backup from a technical checkbox into an operational capability.
4. How Much Knowledge Sits With One Person?
Many schools operate with relatively lean internal IT teams. That isn't necessarily a problem. A small, capable IT team can understand its school's environment exceptionally well and provide a level of institutional knowledge that is difficult to replicate.
The risk emerges when too much critical knowledge or responsibility depends on one person. Consider questions such as:
- Who understands how your core infrastructure is configured?
- Who has administrative access to critical systems?
- Where are passwords, procedures and technical documentation stored?
- Who knows how your backup and recovery environment works?
- Who manages relationships with key technology vendors?
- If your primary IT person was unexpectedly unavailable, who could take over?
This isn't about diminishing the role of internal IT. Quite the opposite. One of the best ways leadership can support a capable internal IT team is to ensure they aren't the organisation's only line of defence.
Documentation, shared knowledge, external expertise and clear escalation paths can all reduce that dependency.
5. Cloud Doesn't Eliminate the Need for Resilience
Schools have steadily moved more of their technology into cloud platforms. That's brought enormous advantages. Applications can be easier to access, infrastructure requirements can be reduced and staff can work from almost anywhere.
But moving something to the cloud doesn't make operational risk disappear. Your school may now depend on Microsoft 365, cloud-based student management platforms, finance applications, learning systems and numerous other third-party services.
For each critical platform, it is worth understanding:
- What happens if the service becomes unavailable?
- What data does the provider protect — and what remains the school's responsibility?
- How quickly could access be restored following an account or identity issue?
- Is important information stored anywhere else?
- Who would the school contact during a major incident?
- Are there alternative processes if the platform cannot be accessed?
Cloud services can strengthen resilience enormously. But only when the dependencies surrounding them are understood.
6. Resilience Also Depends on Knowing Who Does What
Technology is only one part of incident response. During a significant outage or cyber incident, uncertainty can create almost as much disruption as the technical problem itself.
Who makes the decision to invoke an incident response plan? Who communicates with staff? Who updates school leadership? Who contacts technology providers? Who determines whether families need to be informed? Who coordinates technical recovery?
These responsibilities shouldn't need to be invented while an incident is already unfolding. Even a relatively simple incident response plan can help establish roles, escalation paths, contact details and priorities before they're needed.
And like a backup, a plan becomes much more valuable when it has actually been tested. A short tabletop exercise can quickly reveal assumptions and gaps that may otherwise remain hidden until a real incident occurs.
7. The Goal Isn't Zero Downtime
No school can eliminate every technology risk. Networks can fail. Cloud platforms can experience outages. Hardware eventually breaks. Cyber incidents can still occur even in well-protected environments.
The goal of resilience isn't to pretend those events can always be prevented. It's to make sure the school is prepared to respond when something does go wrong.
That means reducing the likelihood of disruption where possible, limiting its impact when it occurs and restoring important services in an order that reflects the school's operational priorities.
A resilient school isn't necessarily one that never experiences an IT problem. It's one that knows what to do next.
A Simple Resilience Conversation for Your Next Leadership Meeting
You don't need a technical audit to begin discussing IT resilience. Start by asking:
1. Which five technology systems would cause the greatest disruption if they became unavailable tomorrow?
2. How long could we realistically operate without each of them?
3. Are we confident our critical data and systems could be recovered within that timeframe?
4. Does too much knowledge or responsibility depend on one member of our IT team?
5. Do we know who would make decisions and communicate during a major IT incident?
If the answers aren't immediately clear, that doesn't necessarily mean your school has a technology problem. It may simply mean there's an opportunity to strengthen the planning around the technology you already have.
Give Your IT Team a Stronger Safety Net
School IT teams carry an increasingly broad responsibility.
They're supporting users and devices, managing infrastructure and cloud services, strengthening cybersecurity, enabling new technology and helping the school respond when something goes wrong. Resilience shouldn't depend on them doing all of that alone.
For some schools, the next step may be better documentation or recovery testing. For others, it could mean reviewing cybersecurity controls, modernising infrastructure or bringing in additional expertise to complement the internal IT team.
The important thing is to understand where the gaps are before an outage exposes them for you. Subnet works with South Australian schools to strengthen IT environments, support internal IT teams and improve resilience across infrastructure, cybersecurity, backup and recovery, and managed IT.
Because when technology supports almost every part of your school, IT resilience is school resilience.
Comments