The ICP cybersecurity component: what Component 7 asks a district to show
Published September 4, 2026
Florida districts submit an Instructional Continuity Plan, the ICP, describing how instruction continues when something disrupts it. Its cybersecurity component, Component 7, asks the district to show how it protects the systems instruction depends on and how it would recover them. This article walks through the elements that component asks for and how to assemble each one from records a district already keeps.
One caution up front: the component's expected shape comes from the Florida Department of Education's guidance and from how districts have filed it. Check the current guidance and, if you can, a submission your district has already made, before you finalize yours. This article describes the elements in general terms.
The elements
The framework the district follows. The component asks which cybersecurity framework or standard the district has adopted. NIST CSF 2.0 and the CIS Controls are both common choices. The strongest version of this element is a sentence naming the framework and a dated assessment against it, rather than the name alone.
Business continuity plan status. Whether the district has a plan for keeping instruction and key systems running through a disruption and bringing them back afterwards, the date it was last reviewed, and the order in which systems come back. Backup practice sits under this element: how often backups run, whether a copy is beyond the reach of everyday accounts, and when a restore was last tested.
Incident response plan status. Whether a written plan exists for what the district does when something goes wrong, the date it was last reviewed, the notification list, and the date it was last practiced in a tabletop exercise.
Cybersecurity policy inventory. The adopted policies and written procedures that govern the district's practices, with version numbers and review dates. This is also where the district lists the rules it has to meet, including FIPA (s. 501.171), Florida's law on notifying people after a breach of personal information.
Executive summary of the security posture. A plain-language statement of where the district stands: the scope of the assessment, a summary of maturity by area, a few key measures, and the top risks. This is the element a superintendent or board member is most likely to read, so it should read as sentences, not a control list.
Plan of action and milestones. What the district has decided to improve, who owns each item, and the target date. A short list with owners and dates is what the component is looking for. Items without owners and dates are intentions, not a plan.
Assembling it from what you keep
The component is easier to produce than it looks, because each element maps to a record most districts already hold or can create in an afternoon:
| Element | The record behind it |
|---|---|
| Framework | The dated assessment |
| Continuity plan | The plan document, the backup job report, the last restore test |
| Incident response | The plan document, the tabletop exercise record |
| Policy inventory | The policy documents with versions and dates |
| Executive summary | Written from the assessment results |
| Plan of action | The lowest scoring areas from the assessment, with owners and dates added |
A district that assesses once a year and refreshes its evidence on a schedule can regenerate the component each cycle instead of writing it from scratch.
Mistakes worth avoiding
- Naming a framework without assessing against it. The name alone says nothing about where the district stands.
- Describing plans that have not been exercised. A plan's review date and exercise date are what give it weight.
- A plan of action with no owners. Every item needs a person and a date, even if the date is next year.
- Writing the summary in acronyms. The people who read this element are not the people who wrote it.
Where DistrictReady fits
DistrictReady's ICP Component 7 pack assembles these elements from the district's assessment and evidence register: the framework statement, the executive summary with maturity by area, the continuity and incident response status, the policy inventory, and a drafted plan of action from the lowest scoring controls, with owner and date left for the district to fill in. It is written to support the submission. It is not a determination that the submission meets FLDOE requirements, and the district confirms the final content before it files.