Which platforms are actively collecting data from the network. Vendor-native dashboards (Meraki, Aruba Central) count if they're the actual operational tool, not just incidental. “Not sure” is valid when the platform inventory hasn't been formally audited.
How deep visibility goes. “Up/down only” is the floor — you'll know when a switch dies, but not when a link is saturating before users complain. Flow data, synthetic monitoring, and end-user experience monitoring each add a layer above the baseline.
Who's actually watching the alerts and triaging. A monitoring platform with nobody watching is data, not detection.
How alerts actually reach humans. Email + dashboard-only is the K-12 baseline but is often functionally “no alerting” — alerts hit a shared mailbox nobody reads. SMS, push, or a paging service is the floor for real on-call response. Empty selection is a hard finding.
What happens when the first responder doesn't acknowledge. Formal documented chains (primary → secondary → manager) are best practice; informal “we know who to call” works in small teams but degrades on staff change.
How tuned the alerts are. Out-of-the-box defaults work for a fraction of K-12 environments; untuned-and-watched is fine, untuned-and-ignored is alert fatigue — and only the latter is a hard finding.
Whether network diagrams reflect production reality. The diagram in someone's head doesn't survive vacation; an outdated diagram is misinformation at incident time.
Where IP, VLAN, and device-config data is authoritatively maintained. Connects to the dashboard's existing NET-IPS-01 finding (“No documented IP scheme”) — same documentation gap, different surface. Spreadsheets with drift are the K-12 default; they're not a hard finding on their own, but they pair badly with F7 outdated and F9 informal.
How changes to the production network are reviewed and tracked. Formal CAB processes are uncommon in K-12; informal peer-acknowledgement is the practical baseline. Logged-after-the-fact and no-process variants surface real risk.