Open campuses. Protected data.
Colleges and universities run open networks, decentralized IT and research that attracts attackers, while answering to GLBA, FERPA, HIPAA and research security rules. We assess your risk and your compliance in business terms, so leadership can fund what matters and you can show regulators, auditors and research sponsors a real program.
- Required
- A written GLBA risk assessment
- Standards
- GLBA, FERPA, NIST 800-171, HECVAT
- Experience
- Dozens of colleges and universities
- You leave with
- A ranked plan, not a binder
What higher education is up against
Why campus security is different.
Openness is the point of a university, and it is also the attack surface.
- Decentralized ITColleges, departments and labs running their own systems.
- Financial aid dataGLBA Safeguards Rule requirements tied to federal student aid.
- Research securityFederal and defense research that brings NIST SP 800-171 and CMMC requirements.
- Thousands of usersStudents, faculty, staff and alumni, arriving and leaving every term.
- Vendor reviewsEvery new platform needing a security review, often with the HECVAT.
Standards we assess against
The standards you answer to.
We assess against the rules that apply to your institution, map them to each other, and score every gap the same way.
GLBA Safeguards Rule
For institutions that handle federal student aid: a written security program, a qualified individual and a written risk assessment.
FERPA
Protecting student education records and controlling who can see them.
HIPAA
For campus health centers, clinics and academic medical programs.
NIST SP 800-171 and CMMC
Protecting controlled unclassified information in federally funded and defense research.
PCI DSS
Card payments across bookstores, dining, parking and athletics.
EDUCAUSE HECVAT
The higher education standard for assessing the security of cloud vendors.
How we work in higher education
One risk language across the whole campus.
A university is many organizations under one name. We give every part of campus, from financial aid to research, the same way to describe and rank risk, so leadership can compare and fund the work across the institution.
Mapped
GLBA, FERPA and NIST together.
One set of controls mapped across the rules you answer to, built on NIST CSF 2.0.
Decentralized
Built for how campuses work.
Shared standards that colleges and departments can adopt without giving up their own IT.
Board-ready
Clear for trustees.
Risk explained in terms presidents, cabinets and trustees can act on.
How we help
Services higher education teams use most.
Runs on one risk language
Scored with your methodology.
Every finding is scored the same way as the rest of your program. Already have a methodology? We use it. If not, we build it with you first, in a single workshop.
How we build a risk methodology →Questions
What people ask us.
Does the GLBA Safeguards Rule apply to colleges and universities?
Yes, for institutions that participate in federal student aid programs. The rule requires a written information security program, a qualified individual to oversee it and a written risk assessment, among other safeguards.
What does a GLBA risk assessment need to include?
It needs to identify reasonably foreseeable risks to customer information, set criteria for evaluating them, and describe how each risk will be reduced or accepted. We document it so your auditors can follow it and your leadership can use it.
Can you help with research security requirements like NIST SP 800-171?
Yes. We assess research environments that handle controlled unclassified information against NIST SP 800-171 and help prepare for CMMC where defense contracts require it.
Do you review vendors with the HECVAT?
Yes. We review vendor HECVAT responses and fold third-party risk into the same risk methodology as the rest of your program.
How do we get started?
Tell us which standards you answer to and what you already have. We scope the work around that, starting with a short call.