Education Sector Security Intelligence

Educational institutions should begin preparing their annual FERPA notification materials for the upcoming 2026-27 academic year. Under FERPA, schools must annually notify parents and eligible students of their rights regarding education records, including the right to inspect records, request amendments, and control disclosure of personally identifiable information. Institutions should review and update their notification language, directory information policies, and opt-out procedures before the start of the fall semester.

CISA continues to observe ransomware threat actors targeting K-12 school districts, particularly those with limited IT resources and outdated systems. School districts are urged to implement baseline cybersecurity measures including multi-factor authentication, regular patching, offline backups, and incident response planning. CISA's free cybersecurity services and tools are available to help districts improve their security posture.

The Federal Trade Commission has signaled it will increase enforcement of COPPA violations by EdTech companies, particularly those collecting data from children under 13 without verifiable parental consent. With the modernized COPPA rule now in effect, EdTech platforms must ensure compliance with updated data minimization requirements, consent mechanisms, and data retention limits. Companies operating in the K-12 space should review their practices against the updated rule requirements.