Education Impact Consultant

Protecting student data through smarter vendor risk management. Thousands of Software as a Service tools create risks districts cannot manage equally. A rightsized program starts with visibility and focuses resources where exposure is greatest. Nathan Eddy works as an independent filmmaker and journalist based in Berlin, specializing in architecture, business technology and healthcare IT. He is a graduate of Northwestern University's Medill School of Journalism. Recent breaches involving Canvas and PowerSchool, resulting in the theft of millions of individuals' private information, have intensified attention on third-party technology risk in K-12 education environments. The incidents underscore that a district can protect its own environment and still be exposed through a vendor - a risk difficult to contain when the average district relies on thousands of ed tech tools, many delivered through Software as a Service (SaaS). While small IT teams cannot investigate every provider with the resources of an enterprise security organization, they can build a defensible program by establishing visibility, ranking risks and setting minimum requirements. What the Canvas breach reveals about K-12 vendor risk. Large education platforms concentrate risk because one compromise can affect many customers at once. Matt Leger, research lead for IDC Public Sector's worldwide education and education technology digital strategies, says districts increasingly depend on outside providers to keep daily operations and instruction running. "Schools have become very dependent on third parties to do what they need to do for teaching and learning to happen every day," he says. Moving systems to the cloud may strengthen an individual district's security, but it can also create shared dependencies outside the district's direct control. Vendor reviews should therefore consider not only data protection but also hosting arrangements, redundancy, recovery capabilities and the operational consequences if a widely used provider becomes unavailable. Building a SaaS inventory for your district. Building a SaaS inventory is a strong first step toward better understanding a district's vendor risk profile. Districts should begin with known systems, such as student information, learning management, finance, communications and identity platforms. They should then add classroom tools, browser applications, administrative software and services purchased outside of central IT. The inventory should record the owner, purpose, data handled, users, integrations, hosting environment, authentication method and renewal date for every tool. Mapping connections matters because a compromised application may provide a path into another system. "Without investing in a full cloud access security broker platform, I think the most common and effective way is through the use of unified threat management firewalls to identify which platforms are being accessed," says Chester Wisniewski, director and global field CISO at Sophos. How to tier ed tech vendors by risk level. Districts should not devote equal scrutiny to every application but rather evaluate what type of information is being shared with vendors and then use that to determine which ones to scrutinize most, based on impact. High-risk vendors include those handling regulated or highly sensitive information, supporting mission-critical operations or integrating broadly with other systems. This tier typically includes student information systems, learning management platforms, identity providers and any tool with single sign-on access or broad application programming interface connections. A compromise in any of these can propagate across multiple systems. Tools that collect health, financial or behavioral data on students also belong here, regardless of their operational role. Medium-risk tools may access limited student records or support important but replaceable functions. A tool moves from medium to high risk when its access scope expands, either through broader system integrations, additional data collection at renewal or connections to other platforms. Low-risk products should receive basic review if they use little or no identifiable information. Reference tools, general productivity applications and anonymous content platforms typically fall here, though districts should verify that assumption rather than take it on faith. "Districts should also determine what student data each tool genuinely needs and restrict access accordingly," says Mary Schlegelmilch, business development manager for education at Cisco. That principle applies at the tiering stage; if a tool is requesting more data than its function requires, that itself is a signal worth flagging. Vendors who exhibit high levels of transparency typically have a stronger security culture as well as more mature practices." Chester Wisniewski Director and Global Field CISO, Sophos Contract language that protects districts before a breach. Security expectations should appear in the request for proposals and remain enforceable in the final agreement. Addressing security requirements at the RFP stage gives districts leverage before a vendor is selected, making it harder for a preferred vendor to negotiate those provisions away after the fact. Once contracts are on the table, they should define authorized access, breach notification deadlines, service levels, backup and recovery obligations, data deletion, audit evidence and each party's incident response responsibilities. For example: * Breach notification windows should be explicit and should require the vendor to notify the district even when the full scope of an incident is not yet known. * Subprocessor disclosure clauses are worth including, as many SaaS vendors rely on their own third parties to deliver the service, and those relationships extend the district's exposure. Leger says that, within contracts, districts need to embed requests pertaining to resilient design, which can include zero-trust controls, stronger identity management, reauthentication between sensitive functions and plans for maintaining service during a vendor outage. Right-to-audit provisions support this, giving districts or their representatives the ability to request evidence of security controls rather than relying solely on vendor-provided assurances. Vendor monitoring without enterprise tools. Monitoring can begin with inexpensive, repeatable checks. "The easiest thing is to contact [the vendor] and discover which security and privacy certifications they have achieved and inquire as to which frameworks they use for managing risk," Wisniewski says. Districts can subscribe to vendor security notices, review public incident disclosures and require annual updates from high-risk providers. "Vendors who exhibit high levels of transparency typically have a stronger security culture as well as more mature practices," he adds. He advises districts to document those reviews so they can show how monitoring decisions were made. Shadow IT: finding unapproved apps that store student data. Firewalls, endpoint security and device management systems can reveal cloud and locally installed applications. Districts can compare those discoveries with the approved catalog and investigate exceptions. Leger cautions that technology alone will not expose every tool, particularly when employees and students use personal devices or cellular connections. Schools need a nonpunitive process for educators to disclose what they use. Training should explain why unreviewed tools create risk while recognizing that teachers usually adopt them to solve real instructional problems. An accessible review process gives staff a safer alternative to bypassing central IT. Building a vendor incident response plan for K-12. An incident plan should identify the district owner for each vendor, escalation contacts, legal and communications roles, procedures for revoking access and steps for continuing critical services. Risk tiers should drive how detailed those playbooks are. High-risk vendors warrant named contacts, documented revocation steps and tested runbooks, while medium-risk vendors can be covered more lightly. Exercises should test what happens when a provider is unavailable or a compromise spreads through an integration. Two scenarios worth running explicitly: * A critical vendor going down during a high-stakes window, such as state testing or enrollment * A breach propagating from one integrated tool into another Even a short tabletop discussion with IT, administration and legal stakeholders can surface gaps that a written plan misses. K-12 districts also face a communication obligation that enterprise organizations do not. When a vendor breach involves student data, parent and community notification may be required - and the plan should designate who owns that process, what triggers it and how messaging will be coordinated with legal counsel. The inventory and risk tiers determine which vendors require the most detailed playbooks. Plans should be reviewed whenever services, data flows or contract terms change. "Knowing what your service-level agreement is with those vendors, whom to contact and what steps you can take, from both a continuity and containment perspective, is a bare minimum," Wisniewski says.

Say goodbye to PlusPortals: Belmont Public Schools is moving to PowerSchool. Belmont Public Schools July 30, 2026 Beginning August 1, Belmont Public Schools will transition from PlusPortals to PowerSchool, its new student information system. Like PlusPortals, PowerSchool provides students, families, teachers, and administrators with access to important student information, including grades, attendance, class schedules, and more - all in one integrated platform. Belmont Public Schools selected PowerSchool because it offers a simpler, faster user interface, making it easier to access information while supporting improved communication between schools and families. District staff completed initial training this spring, with refresher training scheduled before the start of the school year. Additional information, including parent login instructions and a secure process for families to claim access to their students' accounts, will be shared in the coming weeks.

Government responsible for ensuring companies live up to privacy protection measures: privacy commissioner. May 13, 2026 | 10:43 AM The province's privacy commissioner says the onus is on government to ensure that companies they deal with live up to their contractual obligations in privacy protection. Kerry Hatfield yesterday released her report on the cyber attack involving PowerSchool, and the actions of the public bodies responsible for safeguarding personal information. The PowerSchool cyber attack, which involved jurisdictions across North America, was the province's second largest privacy breach, affecting some 285,000 Newfoundlanders and Labradorians. Hatfield says it's not enough to leave it to the company to ensure that the appropriate privacy procedures are in place and that personal information is protected, it's up to the public bodies involved to ensure that a company is living up to its obligations. "I have kids in school myself, and we're reliant on the department to ensure these security measures are in place. But I think one of the key findings I want people to be aware of is that it's not just what's in the contract, is that the follow-up has to happen. There has to be really strict, systematic monitoring to verify that these big tech companies are actually not just saying they're going to do something in a contract, but they're actually doing it." The provincial government meanwhile says it is taking "proactive steps" to safeguard against future privacy breaches and "ensure stronger cyber protection" for users of PowerSchool. They include enhancing cybersecurity training for all departmental staff, reviewing all data held within PowerSchool, updating a retention and deletion schedule for personal information store in PowerSchool and reviewing and implementing additional security controls.