School districts and BOCES
Student data privacy under Education Law § 2-d, with a security program that holds up
Already have an IT provider? Here's how we work together.
An example
Consider a school district that adds a new reading app in September. Teachers like it. Student names, classes and reading scores now flow to the app’s company.
In November, a parent asks who has her child’s data and how it is protected. The answer is spread across the technology office, the curriculum office and the business office. Nobody is sure whether the app’s contract includes the data security and privacy plan that New York requires.
The Problem
New York Education Law § 2-d and the Commissioner’s regulations (8 NYCRR Part 121) protect personally identifiable information about students, and some information about teachers and principals. They set duties for the district and for every vendor that receives that data.
Part 121 names the NIST Cybersecurity Framework as the basis for the district’s security program. Meanwhile, the number of apps and online services keeps growing, and each one is a new place where student data lives. School districts are also covered by the state’s 72-hour cyber incident reporting law.
Privacy for students depends on knowing where their data is, who has it, and what each contract promises.
What we do
A gap assessment against Education Law § 2-d and Part 121, measured on the NIST Cybersecurity Framework.
An inventory of the apps and vendors that receive student data, and a review of each contract’s data security and privacy plan.
Privacy and security policies the board can adopt, written for how the district works.
An incident response plan, including the state reporting steps, and a tabletop exercise with the people who will use it.
A policy for the use of AI tools by staff and students, and a review of the AI tools already in use.
Plain-language reports to the superintendent and the board of education.
Who does what
Security Medic
Leads the security program: assesses, writes the plan and the policies, specifies the controls that must be put in place, reports to leadership, and checks that the work was done.
The district’s technology staff or regional technology provider
Run the networks, devices and systems. We specify what must be in place and check the result.
Superintendent, privacy lead and board of education
Approve policies, decide which tools are allowed, and answer to parents and the State Education Department.
Your attorney and your insurer
Give legal advice and make coverage decisions. We are not legal counsel, and we work alongside both.
What must be met, and how it is met
An obligation is what the organization must meet: a law, a regulation, a contract or a grant condition. A standard is how it is met and checked. The NIST Cybersecurity Framework (CSF) 2.0 connects them, so one program and one body of proof serve every obligation.
Obligations that commonly apply
- NY Education Law § 2-d and 8 NYCRR Part 121. Student data privacy and security duties for districts, BOCES and charter schools, and for every vendor that receives the data.
- FERPA (Family Educational Rights and Privacy Act). The federal law on the privacy of student education records.
- NY General Municipal Law Article 19-c. Cyber incident reporting to DHSES within 72 hours, and ransom payment reporting within 24 hours, for school districts as for other local governments.
- Federal grant conditions (2 CFR Part 200, § 200.303). Internal controls that include reasonable cybersecurity, for any district spending federal awards.
Standards we use to meet them
- NIST Cybersecurity Framework. Named by Part 121. We work in its current version, CSF 2.0, which also connects every other obligation.
- NIST Privacy Framework 1.0. A structure for the privacy side of the program: knowing what data is held, why, and who can see it.
- CIS Controls. A prioritized list of security safeguards, useful for a district with a small technology team.
- NIST AI Risk Management Framework 1.0. The basis for an AI use policy and for reviewing AI tools.
Which obligations apply depends on the organization; the free assessment and the first call sort that out.
Security Medic is independent. We assess against these laws, standards and frameworks as a reference. We do not certify, we are not legal counsel, and we are not affiliated with the agencies and bodies that publish them.
The first step is free
Before anything is bought, the organization should know where it stands. The free assessment shows that, at no cost and with no obligation.
- 1
Free 30-minute call (optional)
Talk through the rule, the grant or the deadline, and what the organization needs.
- 2
Free assessment
Answered online, in plain language. No technical knowledge is needed.
- 3
Gap report
Where the organization stands, the gaps that matter most, and the path to close them.
- 4
Free results review
We walk through the report together and answer questions.
If more work makes sense, it is scoped in writing against the named obligation: a scoped assessment, then audit preparation rounds where a formal review or deadline is coming. When the work has to go through procurement, the gap report helps write a scope that fits the need.
When to talk to us
The best time is before an RFP is written. By the time a solicitation is posted, the scope is set. Earlier, a free assessment can show what the organization actually needs, so the work that follows is the right work.
- Before vendor contracts renew for the next school year.
- When a school technology grant is awarded and the work has to be scoped.
- Before the budget goes to the voters, so the privacy and security work is funded.
- Before writing an RFP for privacy or security help, so it asks for what the district actually needs.
How public bodies can work with us
Through an RFP
We respond to solicitations as the prime contractor or as a named subcontractor on another firm’s team.
Direct purchase
Where the organization’s procurement policy allows a direct purchase or quotes, we provide a written proposal for the scope.
Grant-funded work
When a grant pays for an assessment or plan, we scope the work to the grant’s conditions and reporting.
Procurement officers will find our company details and what to expect in a response in the bid kit.
Start with a free 30-minute call
Bring the rule, the grant or the deadline. We will talk through where the organization likely stands and what a first step would cover.
Book a free call