Security Baselines for New Systems

In short, security baselines for new platforms hinges on one issue: which student record system is involved, who holds it, and what purpose justifies the next step with it. Get those three answers right and most of the rest of the determination follows; miss any one of them and the rule applied will be the wrong rule for the facts in front of you.

Fees and formats for record inspection must not become barriers, or the right of access becomes theoretical.

Support staff access to live files is a disclosure in substance, even when the vendor describes it as maintenance.

Vendor selection is a privacy determination before it is a purchasing determination, since the vendor's information practices become the university's risk.

Design-stage review catches problems when they are still cheap to fix, and late review catches them when they are expensive to undo.

Public records requests may reach student information, and employees handling them need to know which records are safeguarded before responding.

Email can be an education file when it is maintained regarding a student, and the fact that it lives in a mailbox does not remove it from the category.

Platforms that feed directory information to outside directories need an opt-out verify built into the feed, not added as a manual afterthought.

Bluetooth beacons in classrooms can record attendance silently, and silent collection deserves explicit notice to the students affected.

A note kept solely for its author's personal use, never shared, sits outside the category, and the moment it is shared that safeguarding may fall away.

AI grading tools create a new record in the form of the grade and the feedback, and that record inherits the protections of the underlying submission.

Log access to personal files, and review those logs, since unreviewed logs protect nobody.

Audit releases against the log, and treat a disclosure missing from the log as a finding, not as a clerical gap.

Protect alumni files with the same care as current files, because graduation does not end the university's duty.

Separate health and counseling systems from broad student systems, with access limited to the employees who provide the care.

Map data flows for each major platform, and update the map when integrations alter, because integrations alter silently.

Review privacy oversight following a merger or platform change, since the information map from before the change will no longer be accurate.

Audit access to personal files, and follow up on anomalies, since an audit that finds nothing is either lucky or blind.

Name a person to ask when the answer is unclear, and welcome escalation, since punished escalation produces quiet non-adherence.

In the badly done illustration, sensitive comments were included in the export, no deletion date was agreed, and the student notice still described the old platform.

In that illustration the removal is logged, and the office can demonstrate a reviewer that the schedule was followed.

Consider a student who requests to see an advising note that contains a factual error, and who receives the note, the correction procedure and a documented decision.

In that illustration the instructor shares the summary, the colleague's advice improves, and no file leaves the instructor's office.

Consider a registrar asked by a parent for a student's grades after the student has turned eighteen and is no longer a dependent for the relevant purpose.

Keeping data just in case is an error dressed as caution, because data kept without purpose is data exposed without benefit.

Sharing a full record when a summary would serve is a mistake, because the extra data adds risk without adding value to the objective.

Writing a policy that employees can not state without opening the document is an error, since the policy shall not be followed under time pressure.

Starting an AI pilot for younger students before completing both the COPPA and the FERPA analysis is a mistake that is discovered, not prevented.

A reader who applies that structure, and who escalates the cases it can not settle, shall make better determinations than a reader who memorises any single rule in this ledger.