These two certifications prove that your vendor places high importance on keeping your student data safe. Additionally, requiring recommendations from customers with similar needs is always an excellent idea.
2. Sweat the Details
We see them every day: Privacy Policies and Terms of Service. And while downloading that new photo editing app for your smartphone often involves a skimming, if even that, of the Privacy and Terms of Service policies, these two documents are wildly critical for K-12 cybersecurity. Here is a non-comprehensive list of specifications to look for from the Privacy Policy and Terms of Service.
- Spell out the type of Personally Identifiable Information (PII) collected and what they do with it
- Delete all student data collected ANY TIME you wish
- Detail who at the organization can access student data and what that means
- Offer audit logs for when company staff members access school accounts and/or student data
- Commit to never share student information with third parties except as required to provide their service (including with advertisers)
- Show their plan in the case of a breach
- Display the granularity of its data encryption
- Provide the location(s) of where on earth the district’s data is stored
- Guarantee that the ownership of PII remains solely with the school district
3. Hope for Security, Plan for a Data Breach
While no K-12 school district expects to be hacked or incur a data breach, the odds of one occurring grow daily. No vendor can guarantee 100% security, but what they can do is detail what they do to actively test their defenses and respond in the event of a cybersecurity breach. A few actions to take:
- Examine the vendor’s incident response plan and ensure it is documented along with a discussion of key steps and with what cadence they are executed
- Require the vendor conduct a yearly pen test by a third party (“by a qualified third-party vendor” is common language)
- If the district cares, does data leave the State or the U.S.