Compliance that gets you past district and university procurement.

Education runs on data that people care deeply about. A learning platform holds names, birthdates, grades, disciplinary notes, attendance, and increasingly the behavioral signals that come from watching how a student works. A university system holds all of that plus financial aid records, health information, and research. When any of it belongs to a child, the stakes and the scrutiny climb sharply.

Selling into this sector means clearing procurement that treats data protection as a gate, not a preference. A school district's technology office, a university's information security team, and a state education agency each run their own review, and each expects independent evidence rather than your word. A signed SOC 2 report or an ISO 27001 certificate answers questions before a buyer even asks them, which is why the vendors that have one close faster than the ones still promising to get around to it.

The other pressure is trust that has to be earned twice. A teacher chooses your tool because it helps a lesson land, but the district that pays for it judges you on whether you can be trusted with a classroom's worth of children. Those are different audiences with different questions, and edtech companies that grow bottom-up through individual teachers often hit a wall the moment the purchase moves up to the district office. The features that won the classroom count for little in the security review. What counts there is whether an outsider can look at your controls and conclude that a family's data is safe with you.

Families and administrators also expect you to honor the spirit of FERPA, the federal law that governs education records, and to be careful with anything touching students under 13. You are not a law firm, and neither are we in this context, but your buyers will ask how your controls line up with those expectations. The way to answer well is to have your practices examined and documented before the questionnaire lands, so procurement sees a company that took student privacy seriously long before it had to.

There is a budget reality underneath all of this. Schools and public universities spend public money, so their purchasing runs slowly and by the book, with committees, references, and often a formal bidding process. A vendor that shows up with clean, independent evidence removes friction at exactly the point where deals tend to die. That is the practical case for treating compliance as sales infrastructure rather than a cost center: the report you commission this quarter is the reason a district signs next quarter instead of the one after.

For most edtech platforms, SOC 2 is the report that opens doors. It is a CPA attestation that examines how your controls protect data against the AICPA Trust Services Criteria, starting with security and adding availability, confidentiality, or privacy when your promises call for them. District and university security teams read SOC 2 reports fluently, so handing one over shortens the conversation considerably.

The privacy criterion deserves a note in this sector. For most vendors, security alone answers the core question. But if you market your platform on how carefully you handle student information, or your contracts promise specific data practices, adding the privacy criterion lets your report speak directly to those commitments. A district reviewer who sees privacy examined by a CPA, rather than merely described in your marketing, gets exactly the assurance the review is built to find. We help you decide whether that addition earns its place for the buyers you are chasing, so you scope to real promises instead of testing criteria that do not apply to your service.

ISO 27001 earns its place when you sell across borders or when a buyer prefers a certification against a fixed international standard. It certifies that you run a working information security management system, and it travels well with education ministries and universities outside the United States. Many of its controls overlap with SOC 2, so you can build the evidence once and use it twice. Where SOC 2 gives a reader a detailed report to study, ISO 27001 gives them a certificate backed by an ongoing management system, and some buyers simply trust the format they already recognize. Knowing which one a given buyer expects saves you from building the wrong deliverable first.

Privacy expectations sit on top of both. If you serve residents of states with their own privacy statutes, or learners in Europe, you will meet requests shaped by laws like the California privacy rules and GDPR. Those map closely to the student-privacy commitments buyers already care about: collect only what you need, keep it only as long as you need it, and let people see and delete their records. FERPA and COPPA form the backdrop for anyone handling education records or the data of children under 13. We assess your controls against these frameworks and document how they align. We do not give legal opinions, and for questions about your specific legal obligations you should involve counsel alongside the audit work.

You do not need every framework at once, and paying for the ones your buyers never ask about wastes money you could spend on the deal in front of you. We start from your pipeline. If your growth is coming from US public school districts, SOC 2 usually leads and a privacy assessment follows. If a European ministry or an international university network is in play, ISO 27001 moves up the list. The point is to match the evidence you build to the buyers you actually want, then map the overlapping controls so the second framework costs a fraction of the first.

Education carries risks that generic security advice tends to miss, because the data is unusually sensitive and the people it describes are often unusually vulnerable. A breach at a payments company is expensive; a breach that exposes which children receive counseling, which struggle with reading, or where a student lives is a different kind of harm, and buyers know it. That is why their reviews probe deeper than a standard vendor assessment, and why your controls have to be built for the questions this sector actually asks. A few risks show up again and again when we scope education engagements, and each one shapes what your controls need to cover.

• Large student data sets. A single district contract can put tens of thousands of student records in your systems at once. That concentration makes access control, encryption, and retention limits more than checkbox items. A reviewer will want to see who can reach the data, why, and how quickly access ends when a teacher leaves.
• Third-party learning tools. Modern platforms stitch together content libraries, analytics services, single sign-on, and communication tools. Every integration that touches student data is a place your obligations can leak out to a vendor. We examine how you vet, contract with, and monitor those third parties, because your buyers will hold you accountable for them.
• Accessibility. Public institutions carry legal duties to serve students with disabilities, so they expect the tools they buy to work with assistive technology. Accessibility is not a security control, but it surfaces in the same procurement review, and a gap here can stall a deal as surely as a security finding. We flag where it will come up so your team can prepare, even though the formal audit stays focused on security and privacy.
• Seasonal traffic. Education load is not steady. Enrollment week, exam periods, and the start of term drive sharp spikes, and an outage during one of those windows lands hard. If you commit to availability, we test that your capacity planning, monitoring, and incident response actually hold up when the calendar turns.

Two more risks deserve attention because they tend to hide until an auditor or a buyer goes looking. The first is stale access. Schools cycle through staff and students constantly, and platforms that grew classroom by classroom often accumulate teacher accounts long after those teachers left. A reviewer treats every dormant account with real data behind it as an open door. The second is data that outlives its purpose. When a district contract ends, the student records tied to it should not sit in your systems indefinitely. A clear retention and deletion schedule is one of the first things a careful buyer checks, and it is one of the easier gaps to close once you know to look for it.

The following is an anonymized, illustrative composite. It does not describe a specific client.

Picture a reading-comprehension platform used by teachers who signed up on their own. Adoption grew classroom by classroom until a mid-size school district offered a contract that would triple the company's revenue. The district's technology office sent a security questionnaire, and one line stopped everything: provide your current SOC 2 Type II report. The company had none, and the buyer would not sign without it.

We scoped a SOC 2 engagement around the systems that held student data, ran a readiness review, and gave the team a short list of gaps to close: tighter access controls tied to their single sign-on, a documented offboarding process, and a data retention schedule that deleted student records after a district relationship ended. Because the district needed proof it could rely on, we issued a Type I quickly to show design was sound, then ran a Type II covering the following months so the report reflected controls operating over real time. With the report in hand, the platform cleared procurement and, just as usefully, walked into the next three district deals with the answer already prepared.

The detail worth drawing out is how much of the value came after the first sale. Before the audit, every new district meant reconstructing answers from scratch, chasing engineers for screenshots, and hoping nothing had drifted since the last questionnaire. After it, the company had a single report that most buyers accepted on sight, and a set of controls mapped so the next year's renewal and an eventual ISO 27001 push would reuse the same evidence. The engagement paid for itself on one contract and kept paying on the ones that followed, which is the pattern we aim for whenever we scope an education program.