# Security for colleges, schools and education technology vendors

> Colleges that take part in federal student aid must follow the GLBA Safeguards Rule, all institutions must protect education records under FERPA, and vendors selling to universities are asked to complete the HECVAT. CyberAccord builds the written security program, tests and monitors systems, and helps vendors answer the HECVAT accurately.

Source: https://www.cyberaccord.com/industries/education · Last reviewed: 2026-10-23

Institutions protect student records under FERPA, and colleges that handle federal student aid must meet the GLBA Safeguards Rule. Vendors that sell to them face the HECVAT. We help both sides build the safeguards and the evidence.

## Key facts

- **Student aid:** GLBA Safeguards Rule, 16 CFR Part 314
- **Student records:** FERPA, 34 CFR Part 99
- **Vendor reviews:** EDUCAUSE HECVAT

## The obligations and risks you face

### Federal student aid brings the Safeguards Rule

Institutions that participate in Title IV programs agree to comply with the GLBA Safeguards Rule. Federal Student Aid has said findings will be resolved through its administrative capability reviews, and institutions out of compliance must provide a corrective action plan.

Source: [FSA: Updates to the GLBA cybersecurity requirements](https://fsapartners.ed.gov/knowledge-center/library/electronic-announcements/2023-02-09/updates-gramm-leach-bliley-act-cybersecurity-requirements)

### Education records must stay protected

FERPA limits disclosure of personally identifiable information from education records without consent, and institutions remain responsible when school officials and contractors access those records. Access controls, logging and vendor oversight are how you show records are protected.

Source: [FERPA regulations, 34 CFR Part 99](https://www.ecfr.gov/current/title-34/subtitle-A/part-99)

### Universities assess vendors with the HECVAT

The Higher Education Community Vendor Assessment Toolkit is the questionnaire many universities send to software and service vendors. It covers security, privacy, accessibility and AI, and vendors are expected to keep their answers current.

Source: [EDUCAUSE: HECVAT](https://www.educause.edu/higher-education-community-vendor-assessment-toolkit)

## What we recommend

- [Security Questionnaires](https://www.cyberaccord.com/services/advisory/security-questionnaires)
- [vCISO](https://www.cyberaccord.com/services/advisory/vciso)
- [Managed Security](https://www.cyberaccord.com/services/managed-security)

## Applicable frameworks

- [FTC Safeguards Rule](https://www.cyberaccord.com/compliance/ftc-safeguards-rule)
- [NIST](https://www.cyberaccord.com/compliance/nist)

## Frequently asked questions

### Does the FTC Safeguards Rule apply to our college?

If your institution participates in federal student aid programs, yes. Your program participation agreement commits you to the GLBA Safeguards Rule, which requires a qualified individual, a written risk assessment, specific safeguards such as multi-factor authentication and encryption, and regular reporting to your board.

### How should an edtech vendor approach the HECVAT?

Answer it once, carefully, with evidence behind each answer, then keep it current and reuse it. We help vendors complete the HECVAT accurately, close the gaps it exposes, and maintain an answer library for other questionnaires.

### Can you support a small IT team on a campus or in a district?

Yes. A part-time virtual CISO can lead the security program and report to leadership, while our managed endpoint, email and cloud security services protect day-to-day systems alongside your existing IT staff.

## Contact CyberAccord

- Book a free consultation: https://www.cyberaccord.com/contact
- Phone: +1 (832) 429-5665
- Email: info@cyberaccord.com