Few sectors have adopted technology as quickly as education. A single district may run learning management systems, student information systems, assessment platforms, communication apps, tutoring tools, and an expanding roster of AI-assisted products — many of them adopted by individual teachers or departments without a central review. Each of those tools touches student data, and each one represents a point where the institution’s compliance obligations quietly extend beyond its own walls.

That expansion is where many schools and colleges are exposed. The Family Educational Rights and Privacy Act (FERPA) was written in 1974, long before cloud platforms, mobile apps, or machine learning existed. Yet it remains the federal standard governing how student education records are protected and shared — and under its structure, the legal responsibility for that data does not transfer to the vendor holding it. It stays with the school.

What FERPA Actually Governs

FERPA is administered and enforced by the U.S. Department of Education’s Student Privacy Policy Office, which investigates complaints, develops guidance, and provides technical assistance to the education community. The law protects “education records” — broadly defined as records directly related to a student and maintained by an educational agency or institution. That includes far more than grades and transcripts: it can extend to disciplinary records, special-education documentation, identifying information, and the data captured by the digital tools students use every day.

FERPA applies to schools, districts, and postsecondary institutions that receive funding under programs administered by the Department of Education. In practice, that covers virtually all public K-12 systems and most colleges and universities, including private institutions whose students receive federal financial aid. As a general rule, the institution must have written consent before disclosing personally identifiable information from education records — subject to a set of specific exceptions that have become central to how technology is adopted in schools.

The “School Official” Exception — and the Liability It Creates

The exception that matters most in a technology context is the “school official” provision. It allows an institution to share education records, without separate consent, with outside parties that perform a service the school would otherwise handle itself — provided those parties are under the institution’s direct control regarding the use and maintenance of the data, and have a legitimate educational interest.

This is the mechanism that makes modern EdTech possible. When a district adopts a cloud gradebook or a university licenses an analytics platform, the vendor is typically designated a “school official” so that student data can flow to it lawfully. The arrangement is routine, and for the most part it works as intended.

The complication is where accountability sits. Designating a vendor as a school official does not move the compliance obligation to that vendor. If student data is mishandled, exposed, or used outside the agreed purpose, it is the institution — not the software company — that answers for it. FERPA’s ultimate enforcement mechanism is the potential withdrawal of federal funding, and there is no private right of action for families to sue under the statute. But the practical consequences reach well beyond that: federal complaints and investigations, mandated corrective action, reputational damage, breach-notification obligations under state law, and a loss of trust among the families and students the institution serves.

In other words, schools carry the risk for data they no longer physically hold. That asymmetry is the heart of the EdTech compliance problem.

Why the Exposure Is Growing

Three trends have widened this gap considerably in recent years.

Tool sprawl. The number of digital products in use across a typical district has climbed into the hundreds, and by some industry estimates well over a thousand distinct tools are accessed across a district in a given month. Many enter through individual classrooms rather than a procurement process, which means a meaningful share of the data-sharing happening in a school has never been reviewed against FERPA at all.

Vendor breaches as routine events. Concentrating student data in a handful of large platforms creates concentrated risk. The May 2026 incident involving the Canvas learning management system — which took the platform offline during final-exam periods at many institutions — underscored how a single vendor compromise can disrupt operations system-wide and put records belonging to millions of students in question. The Department of Education subsequently sought information from the platform’s parent company regarding its FERPA obligations. For most institutions, the prudent assumption now is that an EdTech vendor breach is an operational risk to plan for, not a remote possibility.

Artificial intelligence. AI-assisted tools that analyze student behavior, generate feedback, or personalize instruction introduce new questions about what data is collected, where it is processed, whether it is used to train models, and how long it is retained. These are precisely the questions FERPA’s “legitimate educational interest” and purpose-limitation principles are meant to address — but only if someone is asking them before a tool is adopted.

A Tightening State-Law Layer

FERPA is the federal baseline, not the ceiling. Over the past decade, states have introduced hundreds of bills addressing student data privacy, and many now impose obligations that go beyond federal requirements — mandatory contract terms with vendors, prohibitions on using student data for advertising, deletion rights, and breach-notification timelines. Long-standing examples include California’s student-data provisions and New York’s Education Law 2-d, and additional comprehensive state privacy laws have continued to take effect into 2026.

For institutions operating across state lines, or serving students who reside in multiple states, this patchwork means a vendor arrangement that satisfies FERPA may still fall short of a specific state’s requirements. Compliance is no longer a single checklist; it is a layered set of obligations that has to be mapped to the jurisdictions an institution actually touches.

What Sound Governance Looks Like

The encouraging reality is that the controls reducing FERPA exposure are the same disciplined IT practices that protect any organization handling sensitive data. They do not require a large team — they require consistency and ownership.

Maintain a real inventory of tools and data flows

An institution cannot govern what it cannot see. A current record of every platform that touches student data — what it collects, where it stores it, and which staff approved it — converts invisible classroom adoptions into a manageable list. This is the single most important step, and the one most often skipped.

Put the agreement in writing before data moves

The “school official” exception depends on the institution retaining direct control over how data is used. That control has to be documented. Agreements should specify the purpose of the data sharing, prohibit secondary uses such as advertising or model training, define breach-notification timelines, and address how data is returned or destroyed when the relationship ends.

Enforce access controls and monitoring

Most student-data incidents trace back to compromised credentials or excessive access rather than exotic attacks. Role-based permissions, multi-factor authentication, and continuous monitoring limit both the likelihood and the blast radius of an exposure. These are core elements of a managed Security+ program and apply directly to the systems where education records live.

Plan for the vendor breach you don’t control

Because so much student data now sits with third parties, an institution’s resilience depends on how quickly it can respond when a vendor is compromised. A tested incident-response process, a current vendor-risk file, and reliable backup and recovery capabilities determine whether a Canvas-style event becomes a contained disruption or a prolonged crisis.

Treat compliance as a continuous program

FERPA obligations are not satisfied by a signed form at the start of a school year. New tools are adopted continuously, vendor practices change, and state requirements evolve. A standing review cycle — supported where appropriate by outside compliance consulting — keeps the institution’s posture aligned with both its tool inventory and the current legal landscape.

Final Thought: The Responsibility Doesn’t Outsource

EdTech has become inseparable from how schools and colleges operate, and the “school official” exception is what allows that ecosystem to function within the law. But the exception governs how data may be shared — not who is accountable for it. That responsibility remains with the institution, regardless of which vendor’s servers the records happen to sit on.

For administrators and IT leaders, the practical takeaway is straightforward. Know which tools touch student data, document the terms under which they hold it, control access to the systems that matter, and prepare for the breach that originates somewhere outside the institution’s own network. In an environment where student records are spread across hundreds of platforms and a single vendor incident can affect millions, that visibility is not a regulatory formality. It is the foundation of protecting the students an institution is entrusted to serve.

By Thomas McDonald

Modern businesses depend on an expanding network of third-party vendors to operate efficiently. From cloud service providers and software platforms to managed IT firms and payroll processors, external partners now play a critical role in day-to-day operations. While these relationships enable scalability and specialization, they also introduce a growing layer of compliance risk that many organizations are not fully prepared to manage.

Regulators increasingly view third-party exposure as an extension of a company’s own compliance obligations. When a vendor mishandles data, fails to meet security standards, or experiences a breach, the regulatory and operational consequences often fall on the organization that entrusted them with sensitive information. As a result, third-party risk management has become a strategic priority for leadership teams across regulated industries.

Why Third-Party Risk Has Become a Compliance Priority

Historically, compliance programs focused on internal controls—policies, systems, and employee behavior within the organization’s direct control. Today, that boundary has expanded. Regulators now expect businesses to account for the security posture and operational practices of vendors that access or process regulated data.

This shift reflects how deeply integrated vendors have become in core business functions. A healthcare practice may rely on multiple technology providers to manage patient records, billing, and communications. A financial firm may use external platforms for customer onboarding, document management, and data analytics. Each of these relationships creates a new compliance dependency.

To address these growing risks, the National Institute of Standards and Technology (NIST) released updated guidance on cybersecurity supply chain risk management, outlining how organizations should identify, assess, and mitigate risks throughout their vendor ecosystem. The framework emphasizes that third-party risk is not just a technical issue—it is a governance responsibility that requires executive oversight.

What Regulators Expect from Vendor Oversight

Across healthcare, finance, legal, and other regulated sectors, compliance expectations now extend well beyond internal systems. Regulators want to see evidence that organizations are actively managing vendor relationships with the same rigor applied to internal controls.

Key expectations typically include:

• Documented vendor risk assessments before onboarding
• Written agreements defining data protection responsibilities
• Ongoing monitoring of vendor security practices
• Clear incident response coordination procedures
• Formal offboarding processes when relationships end

In many cases, regulators are less concerned with whether a vendor experiences an incident and more focused on whether the organization exercised reasonable oversight. The absence of documented due diligence, contractual safeguards, or monitoring processes can quickly become a compliance liability.

Where Many Organizations Fall Short

Despite growing regulatory pressure, many small and mid-sized businesses still manage vendors informally. Relationships are often built on trust, convenience, or cost efficiency rather than structured risk evaluation.

Common gaps include:

• No centralized inventory of vendors with data access
• Outdated contracts lacking security or compliance clauses
• Minimal visibility into vendor security practices
• No formal vendor risk tiering or review schedule
• Limited awareness of fourth-party dependencies

These blind spots are rarely intentional. In many cases, they reflect operational constraints rather than negligence. However, when an incident occurs, regulators and insurers focus on what controls were in place—not the resource limitations behind them.

The Hidden Operational Risks of Vendor Failures

Third-party incidents can disrupt far more than compliance posture. Operational consequences often include service outages, data inaccessibility, reputational damage, and delayed customer service.

For example, if a payroll vendor experiences a security breach, employee compensation may be delayed. If a cloud platform goes offline, customer-facing systems may become unavailable. If a document management provider mishandles data, legal exposure may follow.

In these moments, organizations rely heavily on internal IT coordination and external support resources to stabilize operations. This is where structured IT support models—such as those offered through Support+—can play a stabilizing role by ensuring incident response workflows, system visibility, and communication processes remain consistent during disruptions.

Building a Scalable Vendor Risk Management Framework

Effective third-party risk management does not require enterprise-scale resources. It requires consistency, documentation, and leadership alignment.

A practical framework typically includes:

1. Centralized Vendor Inventory

Maintain a current list of all vendors with access to sensitive systems or data. Include service scope, data types handled, and system integrations.

2. Risk-Based Classification

Group vendors into low, medium, and high-risk categories based on data sensitivity and operational impact.

3. Standardized Due Diligence

Use questionnaires, security assessments, or third-party reports to evaluate vendor controls before onboarding.

4. Contractual Safeguards

Ensure agreements include data protection obligations, breach notification timelines, and audit rights.

5. Ongoing Monitoring

Review vendor performance, security updates, and compliance status on a scheduled basis.

6. Exit Planning

Define how data is returned or destroyed when relationships end.

These steps create a repeatable governance structure that supports both compliance and operational resilience.

Why Executive Oversight Matters

Third-party risk is no longer an IT-only concern. Vendor relationships influence legal exposure, financial stability, brand reputation, and regulatory standing. As a result, executive teams must remain engaged in vendor governance decisions.

This includes approving risk frameworks, reviewing high-risk vendor relationships, and ensuring that compliance programs receive adequate resources. When leadership treats vendor oversight as a strategic function rather than an administrative task, organizations are better positioned to respond to both audits and incidents.

Technology’s Role in Vendor Risk Visibility

While governance frameworks define expectations, technology enables execution. Monitoring tools, access controls, and security platforms help organizations track vendor activity and identify anomalies before they escalate into compliance events.

Services such as Security+ can support this visibility by helping organizations strengthen network controls, monitor system access, and enforce consistent security policies across vendor integrations. When technology and governance work together, third-party risk becomes more manageable and measurable.

Preparing for the Next Regulatory Wave

As regulatory scrutiny continues to evolve, third-party oversight will remain a focal point. New data protection laws, cybersecurity mandates, and industry-specific standards increasingly require documented vendor governance.

Organizations that proactively strengthen their third-party risk programs now will be better prepared for future compliance requirements. Those that delay may find themselves reacting to audits, incidents, or contractual disputes without the necessary framework in place.

Final Thought: Trust Requires Structure

Third-party relationships are essential to modern business operations. But trust alone is no longer enough to satisfy regulatory expectations. Structured oversight, clear documentation, and ongoing monitoring are now the foundation of compliant vendor management.

By aligning governance frameworks with operational tools and executive oversight, organizations can reduce regulatory exposure while maintaining the flexibility that vendor partnerships provide.

In a compliance environment defined by interconnected systems and shared responsibilities, visibility is no longer optional—it is the foundation of resilience.

By Thomas McDonald