1 / 7

Minimum Standards for Privacy and Security of Student and Employee Data

This document outlines the minimum standards for privacy and security of student and employee data in the State of New Hampshire. It provides an overview of the background, scope, and applicability of the standards, as well as considerations and objectives for implementation. The document also includes a question and answer section and references for further information.

edeforest
Download Presentation

Minimum Standards for Privacy and Security of Student and Employee Data

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Minimum Standards for Privacy and Security of Student and Employee Data Dan Dister Chief Information Security Officer State of New Hampshire January 25, 2019 1

  2. Agenda Background Scope and Applicability Considerations and Objectives Q&A References 2

  3. Background New Hampshire HB1612 was signed by the Governor 6/12/2018 and went into effect 8/11/2018 HB1612 amended RSA 189:66, IV and added new paragraph V: The Department of Education requested assistance from the Department of Information Technology to develop the Minimum Standards V. The department shall establish minimum standards for privacy and security of student and employee data, based on best practices, for local education agencies. Each local education agency shall develop a data and privacy governance plan which shall be presented to the school board for review and approval by June 30, 2019. 3

  4. Scope and Applicability • Paragraph B from the Minimum Standards explains the scope and applicability as well as referencing what is meant by “Covered Information” • B. These Standards apply to “Student Personally-Identifiable Data” and “Teacher Personally-Identifiable Data” (RSA 189:65), as well as “Covered Information” (RSA 189:68) handled by LEAs in both electronic and physical formats. Unless otherwise noted, the terms “Covered Information” shall include Student and Teacher Personally-Identifiable Data throughout this document. 4

  5. Considerations and Objectives Brief, clearly written security and privacy objectives (privacy and security objectives overlap) Logically arranged in 14 basic categories Derived from a subset of security requirements in a federal standard (NIST SP 800-171) Direct alignment with FERPA and CUI* guidance in the protection of student records Most of the standards are implementable by any IT professional Adhere closely to the spirit and intent of “minimum standards” language of RSA 189:66,V Consistent with existing security standards in use by the State of New Hampshire *Controlled Unclassified Information. See References. 5

  6. Q&A

  7. References The Family Educational Rights and Privacy Act (FERPA) (20 U.S.C. § 1232g; 34 CFR Part 99) is a Federal law that protects the privacy of student education records. 32 CFR Part 2002 "Controlled Unclassified Information" (CUI) was issued by ISOO to establish policy for agencies on designating, safeguarding, disseminating, marking, decontrolling, and disposing of CUI The CUI registry established the category of “Student Records” relative to education records that are directly related to a student under FERPA The National Institute of Standards and Technology (NIST) created NIST SP 800-171 Revision 1, “Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations” 7

More Related