SOC 2
Type II
Achieved
Education records
Protected under federal law
K-12 and HE
Different requirements apply
Annual
Notification to students required
DOE
Enforces via funding withdrawal
FERPA Scope & Education Records Inventory
FERPA compliance starts with knowing what constitutes an education record under the Act: broader than most institutions expect: and who has access to it. We inventory your education records systems, identify all parties with access, and establish the data governance foundation for FERPA compliance.
Access Controls for Student Records Systems
FERPA requires that student education records be accessible only to school officials with legitimate educational interest. We implement role-based access controls for your SIS, LMS, and other education record systems to enforce need-to-know access and generate the audit trails required for compliance.
FERPA Policy & Consent Framework
We develop FERPA-compliant policies for annual notification, directory information opt-out, consent for disclosure, and legitimate educational interest definitions. Policies are specific to your institution type: K-12, higher education, or third-party education service provider.
Third-Party Service Provider Agreements
EdTech vendors, cloud providers, and other third parties that access student records must operate under FERPA-compliant agreements with school official exception conditions. We audit your vendor relationships, identify FERPA gaps, and update data sharing agreements to meet statutory requirements.
Staff Training & Awareness
FERPA violations most commonly result from staff disclosing records without authorization: often unknowingly. We deliver FERPA training for faculty, staff, and administrators covering what constitutes a protected record, disclosure rules, parental rights, and how to respond to records requests.
Incident Response for Student Data Breaches
A data breach affecting student records triggers FERPA disclosure obligations and potential FED enforcement. We build the incident response procedures specific to student record breaches: including when and how to notify affected students and parents and how to report to ED.
What Makes Us Different From Others
- K-12 and Higher Education Expertise FERPA applies differently at K-12 and post-secondary institutions. We have specific experience at both levels and with third-party EdTech providers subject to the school official exception.
- EdTech Vendor Assessment Third-party EdTech vendors are the most common source of student data exposure. We assess vendor FERPA compliance and data sharing agreements as a standard part of every FERPA engagement.
- Access Control Implementation We implement the technical access controls for student information systems: not just policy: so FERPA compliance is enforced at the system level.
- COPPA Coordination for K-12 K-12 institutions using EdTech tools with students under 13 must also navigate COPPA. We address both FERPA and COPPA requirements simultaneously for K-12 clients.
- Staff Training Delivered We deliver FERPA training: not just train-the-trainer documentation: to faculty, staff, and administrators who handle student records.
garrisonOne walked us through our first security assessment and built a remediation roadmap that mapped directly to our compliance goals. We hit our SOC 2 Type II milestone on schedule and the auditor said it was one of the cleaner first-time audits they had seen.
Client results
See how we have helped
Manufacturing
Distributor — Network Security Assessment
Full network penetration test and security assessment for a regional distributor ahead of cyber insurance renewal. Coverage secured at preferred rates.
Network
Fully assessed
Insurance
Coverage secured
CMMC
Readiness achieved
Related Services: All Compliance | HIPAA | Education Cybersecurity | Cybersecurity Consulting
Frequently asked questions
What is FERPA?
The Family Educational Rights and Privacy Act (FERPA) is a federal law that protects the privacy of student education records. It applies to educational agencies and institutions that receive federal funding. FERPA gives parents rights over their children's education records and transfers those rights to students when they turn 18 or attend a post-secondary institution.
What are education records under FERPA?
Education records are records directly related to a student and maintained by an educational agency, institution, or a party acting for the institution. This includes transcripts, enrollment records, grades, disciplinary records, financial aid records, and increasingly, digital learning records from LMS systems. Personal notes not shared with others and law enforcement records are excluded.
Who can access student records without consent under FERPA?
FERPA allows disclosure without consent to school officials with legitimate educational interest, other schools where the student is transferring, certain federal and state officials for audit purposes, financial aid processing, accrediting organizations, parents of dependent students (in higher education), and in connection with a health or safety emergency. All other disclosures generally require written consent.
What is directory information under FERPA?
Directory information is information generally not considered harmful if disclosed: typically name, address, phone number, email, enrollment status, major field of study, dates of attendance, and degrees awarded. Schools may disclose directory information without consent unless the student has opted out. Schools must annually notify students of what they designate as directory information and their right to opt out.
What are the penalties for FERPA violations?
The primary penalty for FERPA violations is withdrawal of federal funding. In practice, the U.S. Department of Education typically requires corrective action rather than immediately withdrawing funding for first violations. However, repeated violations or systematic failures in student data protection can result in loss of Title IV eligibility, which would be catastrophic for most institutions.
How does FERPA apply to EdTech vendors?
EdTech vendors that access student education records on behalf of a school may qualify as school officials if they perform functions the school would otherwise use employees for. These vendors must operate under a written agreement restricting use of the data to the school's purposes and cannot use student data for their own commercial purposes. This is the school official exception, and it is frequently misunderstood.
Resources
Company
Contact
- US: 4752 Euclid Rd Suite 11,
Virginia Beach, VA 23462 - India: Orchard Street, Sector 61,
Gurgaon, Haryana - Phone: (301) 825-5518
- info@garrisonone.com
