Home / Policy Templates Store / FERPA for Education SaaS

Education templates

FERPA Policy Templates for Education Software-as-a-Service Companies

School districts expect their cloud and SaaS providers to protect student and staff data under FERPA and state student privacy laws. These templates show them you do.

See what’s included

Overview

An easy, affordable path to FERPA compliance.

Cloud and software-as-a-service companies serving the education market are required by their customers to comply with FERPA and various state laws protecting student-generated data and teacher and administrator data.

These policies use internationally recognized security standards from the Center for Internet Security (CIS), along with controls specified by NIST and ISO 27001. They cover the duty to report violations and security incidents, transparency regarding data practices, breach reporting (including special requirements for New York and Connecticut), and disaster recovery.

Why these templates

What you get.

Increase sales with the strong FERPA compliance school districts demand.

Impress customers during their audits and increase retention.

Avoid the high costs of data breaches.

Know your organization follows FERPA and security best practices.

Protect your organization from costly and embarrassing data loss.

Reduce the risk of a financially devastating ransomware attack.

Contents

What’s included.

About 90 pages in Microsoft Word, with references to the relevant CIS Controls and other materials.

Policies for all staff

1000Definitions for Privacy and Security Policies
1010Confidentiality and Security: General Rules
1020Need to Know
1030Confidentiality Safeguards (Oral and Written)
1050Computer Usage
1060Computing Devices and Workstations: Company-owned and BYOD
1070Employee/Contractor Work at Home
1080Duty to Report Violations and Security Incidents

Workforce and human resources

1500Employee/Contractor Recruiting and Termination
1510FERPA Policy and Security Awareness Training
1520Employee/Contractor and Product/Service Access Control
1530Employee/Contractor Sanctions

Third-party management and compliance

1700Customer FERPA Privacy/Security Agreements and Vendor Management
1710Breach Reporting
1720Supporting Parents/Students with their FERPA Rights
1730Use of ER in Product Demonstration and Sale of ER Prohibited
1740Disclosures Required by Law
1750Connecticut Student Data Privacy Law Compliance
1760New York State Data Privacy and Security

Software engineering and customer support

2500Technical Support Procedures
2505Data Conversion and Customer Implementation
2510Software Development Procedures
2520Source Code Management
2530Intellectual Property

Security management and controls

2900Security Official Appointment and FERPA Documentation
3000Security Management Process
3005Data Backup
3010Disaster Recovery Plan
3015Facility Security and Access Control
3020Periodic Security Evaluation and/or Third-Party Audits
3025Audit Control and Activity Review
3030Malicious Software Protection
3033Change Management
3050Device and Media Disposal and Re-Use
3052Encryption and Key Management
3054User Account Management
3056Privileged Account Management
3060Technical Safeguards
3062Technical Controls for Mobile Devices
3080Data Retention and Legacy Systems
3090Security Incident Response

Appendices and forms

Appendix A: Third-Party Confidentiality Agreement
Appendix B: Privacy Agreement for Use with Customers
Appendix B1: Privacy Agreement for Connecticut Schools/Districts
Appendix C: Facility Security and Access Plan
Appendix D: Need to Know Analysis
Appendix E: Miscellaneous
Appendix F: Disaster Recovery Plan
Appendix G: Security Official Job Description
Employee/Contractor-Owned Mobile Device Agreement
Company-Owned Mobile Device Agreement
Acknowledgement of FERPA Policies

Download today