Unit 1, Day 6: If It Happens: Recover and Report

Lesson 6 of 6 in Unit 1, Spot It, Lock It, Recover

School-year day

Day 6 of 180

Time

20-minute core + 30-minute extension (50 minutes in all)

Teacher Talk with MystrS. Checked October 27, 2026 (Pacific time). Tags: Cyber.

Existing lessons: /cyber/identity-theft-recovery/, /teach-it-this-week/identity-theft-recovery/, /cyber/data-breach-what-to-do/, /teach-it-this-week/data-breach-what-to-do/, /cyber/scam-text-signs/, /cyber/safe-signal/, /cyber/government-impersonator-scams/

Goal: Students will be able to:

• Follow a Stop / Secure / Report / Monitor recovery path for a made-up incident.
• Name IdentityTheft.gov and ReportFraud.ftc.gov as FTC starting points.
• Complete a short unit assessment that checks Days 1 to 5.

Materials:

• Projector
• Recovery flow handout (Stop / Secure / Report / Monitor)
• Unit assessment (one page, paper)
• Exit tickets if assessment is separate

Core (20 min)

1. Warm-up. Prompt: "Something went wrong with a made-up account. What is the first word you should remember?" Target: Stop. (2 min)
2. Teach the recovery flow (aligned to FTC IdentityTheft.gov, ReportFraud.ftc.gov, and CyberSandberg identity-theft and data-breach lessons): Stop the damage; Secure accounts (change passwords from a device you trust, turn on MFA, call bank or carrier if money or a number is involved); Report at ReportFraud.ftc.gov for fraud and scams, IdentityTheft.gov if personal information was used to open accounts or commit identity theft, plus school counselor or admin when school accounts are involved; Monitor statements and account emails. Teacher: "We are not lawyers. These are the starting points the FTC names." (6 min)
3. Activity, Recovery map. Made-up cases: (A) gift cards ordered after a phished login; (B) SSN details from an old breach used to try a new account; (C) number stops working and friends get money-request texts. Pairs fill Stop / Secure / Report / Monitor and include at least one correct FTC reporting destination. (7 min)
4. Unit assessment (paper, no phones): (1) list the FTC's four scam signs; (2) what to do with a surprise text that asks for your verification code; (3) define multifactor authentication in one sentence; (4) why SMS-only codes can be risky if your number is taken over; (5) name one FTC site for reporting fraud or identity theft; (6) short scenario, circle the best first move. Formative classroom use only, not a certification exam. (5 min)

Extension (up to 30 min)

• Assessment review: trade and discuss items 1 to 5; teacher projects model answers tied to Days 1 to 5. (10 min)
• Family recovery plan (half page): who to tell first, which FTC site to open, practice safe-signal reminder via /cyber/safe-signal/. Take home; do not collect private family details. (10 min)
• Pathway talk: connect unit skills to ISC2 CC Domains 2.3 and 5.3 at awareness level. Optional note: Certiport IT Specialist Cybersecurity is a WA IRC-listed related option (code 81) for CTE reporting districts. No promise that Unit 1 alone earns a credential. (10 min)

Check for understanding: Recovery map names Stop plus one Secure action and one correct FTC reporting site; assessment shows mastery of at least four of six items.

Differentiation and EL / IEP supports:

• EL: recovery flow with numbered icons; word bank (report, secure, monitor, fraud).
• IEP / 504: oral assessment option for items 1 to 5; reduced writing on the recovery map.
• Advanced: seventh assessment item comparing ReportFraud.ftc.gov and IdentityTheft.gov in two sentences.
• Trauma-aware: students may skip personal incident stories; made-up cases only for discussion.

Standards (from our standards map):

• CSTA 2026: HS-SYS-SE-32; S1-CYB-PP-14
• NICE: PD-WRL-003; OG-WRL-005; incident-response concepts at awareness
• NSPFE: Managing Risk; Fraud (report and stop loss)

Certification alignment (ISC2 CC): Domain 5.3 Understand Incident Response; Domain 2.3 security awareness (reporting culture). Outline: English, Revised 01-2026, effective September 1, 2026. https://www.isc2.org/certifications/cc/cc-certification-exam-outline

Sources

1. FTC IdentityTheft.gov, checked October 27, 2026.
2. FTC ReportFraud, checked October 27, 2026.
3. FTC: How To Avoid a Scam, checked October 27, 2026.
4. CyberSandberg identity-theft-recovery and data-breach-what-to-do lessons, checked October 27, 2026.
5. ISC2 CC Exam Outline, Revised 01-2026, checked October 27, 2026.
6. OSPI CEDARS Appendix AK: Industry Recognized Certifications, 2026-27, v19.1 (Certiport IT Specialist, code 81), checked October 27, 2026.