Everyone assumes backups run until the night a server fails during registration. Recovery time objectives matter as much as copies on disk. Schools need tabletop exercises that include registrars—not only IT—because roster continuity is operational, not abstract.
Test restores, not just backup jobs
Quarterly, restore a sample database to an isolated environment and verify rosters and attendance rows. Document who approves failover and how you communicate with families if portals are read-only for a day.
Align with security promises
Reference your public security and compliance commitments. Tie vendor SLAs to integration plans and reinforce access controls during incidents.
Offline contingencies
Print minimal emergency rosters only as a fallback; rehearse how quickly cloud systems return so paper does not become the new source of truth.
Vendor and cloud shared responsibility
Know what your SaaS vendor backs up versus what your district must export. Some contracts include point-in-time recovery; others expect you to retain annual archives. Clarify ransomware response: who declares an incident, and when do you freeze changes to rosters? Put registrar and CFO contacts on the IT escalation tree so business continuity is not an IT-only exercise. Practice communication templates for families when read-only mode lasts more than a school day.