September is National Preparedness Month. On a college or university campus it is also the last stretch of calendar that still belongs to you. Fall semester is underway. Midterms, the next enrollment window, budget fights, and year-end audits are already on the same whiteboard. If leadership does not agree now on what ready means, Q4 will decide it for you in the crunch.
You do not need a half-day offsite and a binder. You need 15 minutes with the people who can actually stop a Monday morning outage from becoming a cabinet meeting: the CIO or CISO, the IT director who owns operations, the owner of identity, the owner of SIS and LMS, and whoever speaks for communications when students cannot register.
This is not a strategy retreat. It is a forced alignment. Write the answers. Name owners. Leave with a date.
Why 15 minutes is the right size
Campus IT leadership is already in meetings. A two-hour tabletop will get declined or watered down into status updates. Fifteen minutes is short enough to put on a calendar that is already full and long enough to surface the three decisions that usually stay implied until an incident.
The goal is not to solve disaster recovery in a quarter hour. The goal is to stop pretending that we have backups and we have a vendor are the same thing as a plan the institution can run.
NewPush works with 75+ institutions supporting 1M+ students and 100k faculty. The pattern is consistent: the campuses that stay calm in enrollment season are the ones that already answered a few ugly questions in a quiet month.
The three questions
1. If SIS or LMS failed at 8 a.m. on a teaching day, who decides, who speaks, and what is the restore target?
Not IT will handle it. Names. A decision owner. A communications owner. A technical owner. A time you are willing to say out loud to the provost. If those four things are not written, you do not have a plan. You have hope.
Include the integrations that actually stop the semester: identity into SIS and LMS, payment for tuition, housing, and the research systems that sit next to student data. You do not need a full dependency map in this meeting. You need agreement on the first three systems that must come back.
2. Which summer leftovers still sit on student or research data?
Summer is when campuses do the work they could not touch in spring. It is also when access, appliances, and projects get left half-closed. Ask for the list that makes people uncomfortable: stale admin roles, visiting faculty, contractor VPN, a cloud project that never got logging, an Exposure Management finding that aged past 30 days.
If you use a CTEM or Exposure Management view, bring the top ten. Do not bring the raw SIEM. The meeting is for ranking, not for touring consoles.
3. What will this institution refuse to start in Q4?
Preparedness is subtraction. If everything is a priority, FERPA evidence and NIST 800-171 work will lose to the next faculty request. Pick the two initiatives that are not allowed to start until restore tests, identity cleanup, and the enrollment-season runbook are green.
Write the refusal down. Send it to the people who will otherwise book your team in October.
How to run the room
Send the three questions 24 hours ahead. No slides. One page. A clock on the table. Someone who is not the CIO takes notes.
Minute 0-3: confirm the scenario (SIS/LMS Monday outage, not a theoretical hurricane).
Minute 3-9: answer question 1 with names and a restore target.
Minute 9-12: pick the top three summer leftovers that get owners this week.
Minute 12-15: name the Q4 freeze and the follow-up date.
If you finish early, do not fill the time with tooling talk. End. The respect for the clock is part of the habit.
What done looks like by October 1
- A one-page runbook for the Monday SIS/LMS scenario, with phone numbers that still work.
- One restore test scheduled on a system students would notice, not a junk share.
- An exposure list with owners, not a ticket pile.
- A short note to cabinet or the president's office: here is what we will not start so we can finish what protects the semester.
That is Q4 readiness in Higher Ed language. It is not a poster about National Preparedness Month. It is operational.
Where NewPush fits
The 15-minute meeting tells you whether the institution can run a Monday outage. It does not tell you how ready the organization is for AI.
If you want an honest read on that, start Phase 0. It is a short AI readiness assessment. You get a Trainer login and a clear next step for fluency, not another console to install.