Community colleges
One program, one source of record, and a clear yearly answer for the trustees
Already have an IT provider? Here's how we work together.
An example
Consider a community college whose Board of Trustees asks for a yearly cybersecurity report: where the college stands, what changed since last year, and what the biggest risks are.
The IT department has a firewall report, a vendor list in a spreadsheet and policies adapted from templates. The risk list in one document disagrees with the status in another. None of it answers the trustees’ question.
The Problem
A college holds student records, financial aid information, payroll and health information, and depends on dozens of cloud services. Each brings its own obligations, and each vendor is a new risk.
IT teams are stretched keeping systems running. An advisory report once a year does not move the program. Some colleges now ask for help that runs the program with them and shows progress year over year.
A board can only govern what it can see. One source of record makes the risk visible.
What we do
A yearly NIST CSF 2.0 assessment, with a maturity trend from one year to the next.
One risk register and plan of action (POA&M) as the single source of record, with an owner, a date and a status for every finding.
A rewrite of the policy framework, removing template text, and including guidelines for the use of AI.
A business impact analysis, continuity and disaster recovery plans, and tabletop exercises with after-action reports.
A third-party risk program: rating vendors, reviewing contracts, and checking the security of new technology before it is bought.
Quarterly reports to leadership and a yearly report to the Board of Trustees.
Who does what
Security Medic
Leads the security program: assesses, writes the plan and the policies, specifies the controls that must be put in place, reports to leadership, and checks that the work was done.
The college’s IT department
Runs the systems and puts the controls in place. We act as an extension of the team, not a replacement.
The president’s cabinet and the Board of Trustees
Set the level of risk the college accepts, approve policies and budgets, and receive the reports.
Your attorney and your insurer
Give legal advice and make coverage decisions. We are not legal counsel, and we work alongside both.
What must be met, and how it is met
An obligation is what the organization must meet: a law, a regulation, a contract or a grant condition. A standard is how it is met and checked. The NIST Cybersecurity Framework (CSF) 2.0 connects them, so one program and one body of proof serve every obligation.
Obligations that commonly apply
- GLBA Safeguards Rule (16 CFR Part 314). The federal rule for protecting customer financial information, which colleges that administer federal student aid are expected to meet.
- FERPA (Family Educational Rights and Privacy Act). The federal law on the privacy of student education records.
- PCI DSS v4.0.1. A contract obligation for any college that takes card payments, for tuition, the bookstore or events, and a standard in its own right.
- Federal grant conditions (2 CFR Part 200, § 200.303). Internal controls that include reasonable cybersecurity, for any college spending federal awards.
Standards we use to meet them
- NIST CSF 2.0. The framework for the yearly assessment and the maturity trend, and the hub that connects every obligation.
- NIST SP 800-53 Rev. 5 with SP 800-53A. The detailed controls, and the methods to check them: examine, interview, test.
- CIS Controls. A prioritized list of safeguards for the technical work.
- NIST AI Risk Management Framework 1.0. The basis for the college’s AI guidelines.
Which obligations apply depends on the organization; the free assessment and the first call sort that out.
Security Medic is independent. We assess against these laws, standards and frameworks as a reference. We do not certify, we are not legal counsel, and we are not affiliated with the agencies and bodies that publish them.
The first step is free
Before anything is bought, the organization should know where it stands. The free assessment shows that, at no cost and with no obligation.
- 1
Free 30-minute call (optional)
Talk through the rule, the grant or the deadline, and what the organization needs.
- 2
Free assessment
Answered online, in plain language. No technical knowledge is needed.
- 3
Gap report
Where the organization stands, the gaps that matter most, and the path to close them.
- 4
Free results review
We walk through the report together and answer questions.
If more work makes sense, it is scoped in writing against the named obligation: a scoped assessment, then audit preparation rounds where a formal review or deadline is coming. When the work has to go through procurement, the gap report helps write a scope that fits the need.
When to talk to us
The best time is before an RFP is written. By the time a solicitation is posted, the scope is set. Earlier, a free assessment can show what the organization actually needs, so the work that follows is the right work.
- When a security, GRC or virtual CISO contract is six to twelve months from ending.
- Before the trustees’ planning cycle, so the yearly report has a baseline.
- When a technology or cybersecurity grant is awarded and the work has to be scoped.
- Before writing an RFP, so it asks for what the college actually needs.
How public bodies can work with us
Through an RFP
We respond to solicitations as the prime contractor or as a named subcontractor on another firm’s team.
Direct purchase
Where the organization’s procurement policy allows a direct purchase or quotes, we provide a written proposal for the scope.
Grant-funded work
When a grant pays for an assessment or plan, we scope the work to the grant’s conditions and reporting.
Procurement officers will find our company details and what to expect in a response in the bid kit.
Start with a free 30-minute call
Bring the rule, the grant or the deadline. We will talk through where the organization likely stands and what a first step would cover.
Book a free call