Teacher Talk with MystrS: Unit 1, Spot It, Lock It, Recover
Checked October 27, 2026 (Pacific time). Tags: Cyber.
Why this unit
Scams, account takeovers and oversharing hit high school students through texts, apps and school devices. This unit was built from the classroom out. Each day is an activity that fits a real period, runs on a projector or printed cards, and does not need student logins to personal accounts. CyberSandberg already publishes short family lessons on these topics. This unit brings them to your class: six days that teach students to spot a trap, lock down an account, and recover when something goes wrong.
Unit at a glance
- Essential question: How do I spot a scam, lock down my accounts, and recover when something goes wrong?
- Grades: 9 to 12
- Length: Days 1 to 6 (Day 6 includes a short unit assessment)
- Each day: 20 to 50 minutes. A Core (20 min) for short days, and an Extension (up to 30 min) for a full period.
- Format: teacher demo on a projector, paper handouts, pairs or small groups. No live phishing. No real personal data. Made-up examples only, labeled as such.
Unit goals: By the end of Unit 1, students will be able to:
- Name the FTC's four signs of a scam and apply them to a made-up message.
- Spot phishing and scam-text patterns, and practice a safe response (stop, and check through a channel you already trust).
- Explain passwords, passkeys and multifactor authentication, and choose a stronger option for a made-up account.
- Describe account takeover and SIM swap or port-out risk, and name one way to protect a phone number.
- Sort what is fine to share, what to change first, and what never to share.
- Follow a recovery and reporting path using IdentityTheft.gov and ReportFraud.ftc.gov as the starting points named by the FTC.
Our rule of thumb: the teacher drives demos and sample messages; students do the thinking on paper. That keeps every day inside shared-device and blocked-site realities, and it keeps student data out of tools.
The days
| Day | Activity | Time |
|---|---|---|
| Day 1 | How Scams Work | Core (20 min), Extension (up to 30 min) |
| Day 2 | Scam Texts and Phishing | Core (20 min), Extension (up to 30 min) |
| Day 3 | Passwords, Passkeys and Multifactor | Core (20 min), Extension (up to 30 min) |
| Day 4 | Account Takeover and SIM Swap | Core (20 min), Extension (up to 30 min) |
| Day 5 | Privacy and Your Digital Footprint | Core (20 min), Extension (up to 30 min) |
| Day 6 | If It Happens: Recover and Report | Core (20 min), Extension (up to 30 min) |
Where Unit 1 sits in the year
The long-term plan is a full year of 180 days of classroom activities, organized into units. Unit 1 comes first on the Cyber desk because later units build on its habits: spot the pressure, lock the login, and report when something goes wrong.
Possible next units (topic ideas only, not yet written or scheduled):
- Unit 2, Money and Scams: builds on gift-card pressure, election donation lookalikes and our existing finance-adjacent scam lessons.
- Unit 3, Networks You Use: builds on public Wi-Fi risks and everyday device choices.
- Unit 4, Deepfakes and Family Signals: builds on deepfake code words and safe-signal practice for families.
Certification alignment (national)
Chosen credential: ISC2 Certified in Cybersecurity (CC).
Why this one: It is an entry-level credential with no cybersecurity work experience required. The official exam outline (effective September 1, 2026) names social engineering, password protection and phishing under Domain 2.3 (Understand security awareness), authentication and privacy under Domain 1.1, Identity and Access Management under Domain 3, and Incident Response under Domain 5.3. That matches this unit's classroom topics better than a hardware-heavy or network-admin exam.
Official outline (cite this): ISC2, Certified in Cybersecurity (CC) Certification Exam Outline, English, Revised 01-2026, effective September 1, 2026. Landing page: https://www.isc2.org/certifications/cc/cc-certification-exam-outline . PDF: https://edge.sitecorecloud.io/internationf173-xmc4e73-prodbc0f-9660/media/Project/ISC2/Main/Media/documents/exam-outlines/2026/EXAMS-CC_Exam_Outline-English-Revised-01-2026-Final.pdf . Checked October 27, 2026.
Domain map for this unit (only what a day really teaches):
- Day 1: Domain 2.3 (social engineering, phishing concepts); Domain 1.1 (privacy as a cybersecurity concept)
- Day 2: Domain 2.3 (phishing); Domain 5.5 names phishing among physical-penetration testing tactics (awareness only, no live tests)
- Day 3: Domain 1.1 (Authentication, Authorization, Accounting); Domain 3 (IAM / logical access); Domain 2.3 (password protection)
- Day 4: Domain 3 (protecting identity and access); Domain 2.3 (security awareness); Domain 5.2 (threat actors, motivations, at awareness level)
- Day 5: Domain 1.1 (Privacy); Domain 5.1 (data handling at awareness level)
- Day 6: Domain 5.3 (Incident Response concepts); Domain 2.3 (reporting and awareness culture)
Washington IRC note (not the frame): Washington's list of industry-recognized credentials (OSPI CEDARS Appendix AK, 2026-27, v19.1) does not list ISC2 CC by name, and neither did the 2025-26 list (v18.0). Related credentials that are on the WA list include Certiport Information Technology Specialist (code 81, an umbrella entry listed as "Certiport Information Technology Specialist: Artificial Intelligence, Cloud Computing, Cyber Security, Data Analytics, Device Configuration and Management, IC3 Digital Literacy, ITS Computational, ITS HTML and CSS, HTML5 Application Development, Networking, Networking Security Certification, Software Developer"), and AP Cybersecurity, code 162 (v19.1). Districts that need a WA IRC for CTE reporting may prefer Certiport IT Specialist Cybersecurity alongside or instead of CC. This unit stays framed for a national audience.
Before you start: safety and accounts
| Rule | What it means for this unit |
|---|---|
| No live phishing | Never send real phishing messages to students. Use printed or projected made-up samples labeled "Made-up example." |
| No real personal data | Students never type real passwords, SSNs, phone numbers, or home addresses into a demo tool. |
| No student account sign-ups required | Every day works with paper and a teacher projector. Optional demos use only a teacher account your district already allows. |
| Shared devices and blocked sites | Keep exit tickets on paper or your LMS. Do not assume students can open FTC pages from student Wi-Fi. |
| FERPA and COPPA | Do not collect student account credentials. Do not require under-13 students to create consumer accounts. |
| Age-sensitive topics | This unit does not use the altered-photos lesson as a student handout. Teachers who need that topic should review it separately and follow local policy. |
Career tie-in (any day)
From our standards map: NICE OG-WRL-005 (Cybersecurity Instruction) and CSTA 2026 HS-SOC-CE-46. Ask: "Name one job where spotting a fake message or locking down a login would be part of the work."
Existing CyberSandberg pages this unit uses
Use only these live paths (checked against the draft site build on October 27, 2026):
- /cyber/scam-text-signs/ and /teach-it-this-week/scam-text-signs/
- /cyber/government-impersonator-scams/ and /teach-it-this-week/government-impersonator-scams/
- /cyber/data-breach-what-to-do/ and /teach-it-this-week/data-breach-what-to-do/
- /cyber/identity-theft-recovery/ and /teach-it-this-week/identity-theft-recovery/
- /cyber/deepfake-code-word/ (cyber page only; no Teach it this week slug in the current build)
- /cyber/safe-signal/ (cyber page only)
- /cyber/public-wifi-risks/ and /teach-it-this-week/public-wifi-risks/
- /cyber/election-donation-scams/ and /teach-it-this-week/election-donation-scams/
- /cyber/card-skimmers/ and /teach-it-this-week/card-skimmers/
- /cyber/contactless-rfid-card-theft/ and /teach-it-this-week/contactless-rfid-card-theft/
- /teach-it-this-week/let-your-bank-tap-you/ (SIM swap mention for Day 4)
- /teach-it-this-week/irs-wont-text-you/
Sources (unit overview)
- ISC2 CC Certification Exam Outline (effective September 1, 2026; English Revised 01-2026 PDF linked from that page), checked October 27, 2026.
- FTC: How To Avoid a Scam (four signs), checked October 27, 2026.
- FTC: How to Recognize and Report Spam Text Messages, checked October 27, 2026.
- OSPI CEDARS Appendix AK: Industry Recognized Certifications, 2026-27, v19.1, checked October 27, 2026.
- NICE Workforce Framework for Cybersecurity, NIST (Components v2.2.0), checked October 27, 2026.
- CSTA PK-12 Computer Science Standards (2026; K-12 Standards, 2017 revised, where noted), checked October 27, 2026.
Lessons in this unit
- Day 1: How Scams Work
- Day 2: Scam Texts and Phishing
- Day 3: Passwords, Passkeys and Multifactor
- Day 4: Account Takeover and SIM Swap
- Day 5: Privacy and Your Digital Footprint
- Day 6: If It Happens: Recover and Report
Coming later
Full unit kit
A space for a fuller kit for this unit. Nothing is available yet.