3 Tips for Selecting Education Vendors

Cybersecurity continues to be top of mind in new ways that we might not have considered during “normal” times. One area that needed our attention then and now is vendor management. Especially with the mad dash over the summer to get many districts ready for at least some remote learning, there are a lot of new third-party vendors on the scene.

Pre-COVID, third-party vendors for schools and universities meant everything from transportation systems and student information platforms to applications like PowerSchool, Quizlet, and Google Classroom. Post-COVID, the term references all of that–plus things like COVID tracking and tracing programs.

Related content: 3 ways to improve online learning security

Regardless of whether we are talking pre- or post-pandemic, third-party vendor risk is a serious topic. Ponemon Institute found that in the United States, 61 percent of data breaches were caused by third parties and vendors.

Are you wondering if you should get rid of third-party vendors? There’s no need to take such a dramatic step, but you should plan to get more focused on knowing what third-party vendors bring to the table when working with your institution.

Let the vetting begin

Vetting third-party vendors is like asking a teenager if they cleaned their room. As long as you don’t look under the bed or in the closet, everything looks good. The problem is, when you’re in education, you have to really dig into those dark places no one wants to look.

It doesn’t matter if you are hiring a new vendor or examining one that the institution has worked with for 30 years–the best way to get a baseline on a vendor is to run a risk assessment on them. Just like you assess physical risks to your school, best practice dictates that you apply the same rigor to the companies you work with and that have access to student or stakeholder data.

While it won’t help you make sure the vendor contract is written fairly, a well-executed vendor risk assessment will help you understand how every vendor handle security and privacy. It will also uncover those vendors who will act as true partners that want to work with you if something goes awry.

3 key areas to focus your efforts

Once you’ve done a complete risk assessment and know who brings what to the table, there are three critical areas you need to focus your attention on to help minimize vendor risk:

1. The Contract: Your institution is not going to cut a check to any vendor without first having a contract in place. But, when it comes to data privacy and breach specifics, what’s in that contract? Who owns stakeholder data? If something does go wrong, what responsibilities do you have vs. the vendor?

Questions such as these are critical to understand and agree upon before moving forward. State privacy laws vary, and you need to understand yours because they define what the institution’s obligation looks like. For instance, in some states, if a data breach occurs, the party that notifies individuals of the breach is financially responsible for things like annual credit monitoring for the victims. This type of financial outlay can get very expensive for a you very quickly, so it is critical that you denote in your contract what obligations your vendor has should a data violation occur.

2. Disaster Recovery: All of us have had the internet go out during a critical task. The same will happen at some point with your vendors. There is nothing wrong with asking – and in fact, you should ask – what happens if your service/product goes out? What’s the alternative? You want to depend on your vendors, so work with vendors to create a responsible expectation for when services will be restored.

3. Data Destruction: Taking a page from Europe’s book, many U.S. states have adopted data privacy laws much like GDPR. California, Delaware, Illinois, Louisiana, Maine, and Texas are among those recognized as having the toughest data privacy laws in the country, and most have requirements stipulating that if data needs to be destroyed, it be destroyed everywhere – including with vendors and in backups. Work into your contracts that if data needs to be destroyed, you get it back from the vendor and do it yourself, or, if the vendor destroys it, they do so pursuant to NIST Special Publication 800- 88 guidelines. Either way, make sure there is proof that the data has been destroyed properly.

Third-party vendors help your educational institution offer fantastic services to your stakeholders. However, the fact that third-party vendor risk is one of the fastest-growing cybersecurity threats in the industry means that vetting your partners is more important than ever. You want partners that are in the arena with you, not just collecting a check. First and foremost, you have to assess the risk a vendor brings to your school. Then you have to get into the weeds to understand how they handle data, service delays and privacy. If a vendor seems too in it for themselves and isn’t showing an interest in making you successful or keeping your students secure, keep looking.

Follow us on social media for the latest updates in B2B!

Image

Latest

Breaking the Cycle and Inspiring Others
July 23, 2024

Nowadays, the traditional path to education is being questioned more than ever and there are numerous stories that provide a beacon of hope for those considering alternative routes. As the number of adults without a high school diploma reaches nearly 22 million in the United States, the importance of understanding and embracing non-traditional education…

Read More
School Safety and Regulatory Compliance
Approaching Safety and Regulatory Compliance with Intent and Purpose
July 23, 2024

In this episode of School Safety Today by Raptor Technologies Michelle Dawn Mooney sat down with special guest, Carrie Mockler, the Vice President of Operations at PublicSchoolWORKS, a Raptor Technologies company. PublicSchoolWORKS is a fully automated, all-in-one learning management system for online training for school staff and a comprehensive risk management program. Key Takeaways: •…

Read More
The Power of Self-Compassion in Leadership and Cognitive Diversity Can Transform Workplaces
July 23, 2024

Mental health and a sense of belonging are critical issues in today’s workplaces. So much that it is essential to practice self-compassion and form a better understanding of cognitive diversity. Leaders today must navigate the complexities of fostering connection and reducing isolation among their teams. Recent studies indicate that 40 percent of employees feel…

Read More
Knox Kronenberg
Passion, Nature, and Fine Art Photography with Knox Kronenberg
July 23, 2024

In the ever-evolving world of fine art photography, capturing the intersection of the old and the new is both a challenge and an art form in itself. Knox Kronenberg, a prominent photographer based in Austin, Texas, embodies this intersection through his work, which uniquely blends historical elements with modern contexts. As technology advances and…

Read More