Education Compliance (K-12 & Higher Ed)

Regulations That Apply

Regulation	What It Covers
FERPA (20 USC §1232g)	Education records and student personally identifiable information
COPPA	Online services collecting data on children under 13
CIPA	Children’s Internet Protection Act — required for E-rate funding
GLBA Safeguards	Higher ed financial aid offices — Department of Education enforcement
HIPAA	If on-campus health clinic operates as a covered entity
State Student Privacy Laws	State-specific student data privacy requirements

What You Need In Place

• Role-based access to student information systems
• Vendor agreements with FERPA-compliant terms
• Multi-factor authentication for staff and faculty
• Content filtering for E-rate eligibility
• Encryption of student data
• Incident response with parent notification workflow
• GLBA Safeguards program for higher ed financial aid

Common Threats In This Sector

K-12 districts and small colleges are heavily targeted because of the combination of valuable data (SSNs, full PII for minors, special-education records) and chronically limited cybersecurity budgets.

• Ransomware crippling student-information systems and pushing weeks of remote-learning improvisation
• Student data exfiltration — PII, SSNs, IEPs, and discipline records
• Phishing targeting administrators with payroll, HR, or vendor-payment authority
• Compromised student accounts used for spam, abuse, or further phishing
• Free or reduced-price meal program data exposure (specifically protected by federal law)
• Online learning platform compromise reaching enrolled students

Documentation You’ll Be Asked For

FERPA, COPPA, and CIPA form the federal floor. 130+ state student-privacy laws layer on top, and ed-tech vendor due diligence now expects districts to document the same controls private-sector data processors maintain.

• FERPA compliance documentation — annual notice, directory-information policy, parent and eligible-student consent records
• COPPA compliance evidence for any service collecting data from students under 13
• CIPA Internet Safety Policy if accepting E-Rate funding, with documented filtering and education
• IDEA records protection procedures for special-education data
• State student-privacy law compliance (varies; California SOPIPA, New York Ed. Law 2-d, Colorado HB 16-1423, etc.)
• Ed-tech vendor agreements with FERPA-compliant Direct Service or School Official designation
• Incident response plan with state breach-notification requirements

Where Most Small Districts and Colleges Fall Short

Education leaders consistently report the same gaps in K12 SIX and CoSN benchmarking surveys. The challenge is rarely awareness — it is budget and staffing.

• No formal data classification distinguishing FERPA-protected records from general data
• Ed-tech tools onboarded by individual teachers without district privacy review
• No district-level CIPA compliance documentation despite accepting E-Rate funding
• Staff training on FERPA limited to annual click-through with no reinforcement
• No tested backup of the student information system — the backups run, but no one has done a restore
• Legacy SIS or LMS systems with default or weak credentials