Education and EdTech
Security for colleges, schools and education technology vendors
Institutions protect student records under FERPA, and colleges that handle federal student aid must meet the GLBA Safeguards Rule. Vendors that sell to them face the HECVAT. We help both sides build the safeguards and the evidence.
- Student aid
- GLBA Safeguards Rule, 16 CFR Part 314
- Student records
- FERPA, 34 CFR Part 99
- Vendor reviews
- EDUCAUSE HECVAT
At a glance
Colleges that take part in federal student aid must follow the GLBA Safeguards Rule, all institutions must protect education records under FERPA, and vendors selling to universities are asked to complete the HECVAT. CyberAccord builds the written security program, tests and monitors systems, and helps vendors answer the HECVAT accurately.
GLBA Safeguards Rule and FERPA
The obligations you face
Each point below rests on a primary source. Follow the link to read the rule itself.
Federal student aid brings the Safeguards Rule
Institutions that participate in Title IV programs agree to comply with the GLBA Safeguards Rule. Federal Student Aid has said findings will be resolved through its administrative capability reviews, and institutions out of compliance must provide a corrective action plan.
SourceFSA: Updates to the GLBA cybersecurity requirements (opens in a new tab)
Education records must stay protected
FERPA limits disclosure of personally identifiable information from education records without consent, and institutions remain responsible when school officials and contractors access those records. Access controls, logging and vendor oversight are how you show records are protected.
SourceFERPA regulations, 34 CFR Part 99 (opens in a new tab)
Universities assess vendors with the HECVAT
The Higher Education Community Vendor Assessment Toolkit is the questionnaire many universities send to software and service vendors. It covers security, privacy, accessibility and AI, and vendors are expected to keep their answers current.
Sources last reviewed . This page explains obligations in general terms and is not legal advice.
Recommended services
What we recommend
Three services, most relevant first, chosen for the obligations above.
- 1 · Security QuestionnairesSecurity QuestionnairesHelp completing SIG, CAIQ, HECVAT, VSA, and custom vendor security questionnaires accurately, plus a reusable answer library.
- 2 · Virtual CISOvCISOA part-time, U.S.-based security executive who leads your security program, manages risk, and reports to leadership.
- 3 · Managed Security ServicesManaged SecurityManaged endpoint, email, and cloud security, with a team that monitors alerts and responds to incidents for you.
Frameworks that apply
FAQ
Sector questions, answered
Does the FTC Safeguards Rule apply to our college?
If your institution participates in federal student aid programs, yes. Your program participation agreement commits you to the GLBA Safeguards Rule, which requires a qualified individual, a written risk assessment, specific safeguards such as multi-factor authentication and encryption, and regular reporting to your board.
How should an edtech vendor approach the HECVAT?
Answer it once, carefully, with evidence behind each answer, then keep it current and reuse it. We help vendors complete the HECVAT accurately, close the gaps it exposes, and maintain an answer library for other questionnaires.
Can you support a small IT team on a campus or in a district?
Yes. A part-time virtual CISO can lead the security program and report to leadership, while our managed endpoint, email and cloud security services protect day-to-day systems alongside your existing IT staff.
Talk to a security practitioner
Tell us what is driving the need: an audit, a client questionnaire, a contract clause or an insurance renewal. We'll recommend a scoped next step with a fixed quote.