At SafeShare, we understand the paramount importance of safeguarding personally identifiable information (PII), especially in the context of our products that collect data from students and teachers. Recognizing the concerns of schools and districts regarding potential data breaches, we want to assure you that we have implemented a robust set of safeguards and best practices to protect the privacy and security of the PII entrusted to us.

Administrative Safeguards:

Robust Data Governance Policies:

Our organization has established and enforces comprehensive data governance policies, meticulously outlining the collection, storage, and processing of PII.
Clear roles and responsibilities for data protection have been defined and are actively upheld.

Ongoing Data Privacy Training:

Regular training sessions are conducted for our team members handling PII, emphasizing the paramount importance of data protection and privacy.
All staff members are well-informed about the legal and ethical obligations surrounding PII.

Strategic Access Control:

We have implemented stringent access controls, ensuring that access to PII is limited to employees with specific roles that necessitate such access.
Regular reviews and updates of access permissions are conducted based on job roles and responsibilities.

Effective Incident Response Plan:

Our organization has developed and routinely tests an incident response plan, ensuring a swift and effective response to any potential data breaches.
A clear communication plan is in place to promptly notify affected parties in the event of a data breach.

Vigilant Vendor Management:

Third-party vendors are carefully vetted based on their robust data security measures.
Contractual agreements with vendors include stringent data protection clauses, and regular audits ensure ongoing compliance.

Operational Safeguards:

Prudent Data Minimization:

We adhere to a policy of collecting only the minimum amount of PII necessary for the intended purpose.
Regular reviews of data holdings are conducted, and unnecessary information is promptly deleted.

Secure Physical Spaces:

Physical storage locations housing PII are secured, with controlled access measures in place.
Strict controls are maintained over servers, data centers, and other physical locations storing sensitive data.

Advanced User Authentication:

Strong user authentication protocols, including multi-factor authentication, are in place to control access to systems containing PII.
Regular updates and reinforcement of password strength contribute to enhanced security.

Continuous Monitoring and Auditing:

We employ continuous monitoring systems to detect and respond to any unusual activities.
Regular audits of systems and processes ensure ongoing compliance with our data protection policies.

Encrypted Communication Channels:

Communication channels and data transfers involving PII are encrypted to safeguard against unauthorized access.
Secure methods for transmitting PII, especially over the internet, are consistently enforced.

Technical Safeguards:

End-to-End Data Encryption:

We encrypt PII both in transit and at rest, employing robust encryption algorithms to ensure the security of sensitive data.
Stringent measures are in place to safeguard against unauthorized access.

Robust Firewalls and Intrusion Detection Systems:

Firewalls and intrusion detection systems are deployed to monitor and filter network traffic.
Alerts for suspicious activities and potential security breaches are actively managed.

Timely Software Updates:

Our commitment to security includes keeping all software, including operating systems and security software, consistently updated with the latest patches.
Regular updates and patches address vulnerabilities in applications that process or store PII.

Comprehensive Endpoint Security:

Endpoint security measures, including antivirus software and endpoint detection and response (EDR) solutions, are in place.
All devices accessing or storing PII are secured, including laptops, desktops, and tablets.

Regular Data Backups:

PII and critical data are regularly backed up, ensuring a robust data recovery process in the event of system failure or data loss.
Periodic testing of data restoration processes is conducted to maintain readiness.

Privacy-Driven Development:

Privacy features are seamlessly integrated into the development of systems and applications from the outset.
Privacy impact assessments are conducted for all new initiatives or modifications to existing systems.

This comprehensive set of measures reflects our unwavering commitment to data protection and privacy. Regular reviews and updates to these safeguards, in response to evolving threats and changes in technology, are part of our ongoing commitment to maintaining the highest standards of data security and compliance.

At SafeShare, we remain steadfast in our commitment to providing a secure and privacy-conscious environment for handling PII in education. If you have any further questions or would like additional information on our data protection practices, please feel free to reach out to our dedicated privacy team.

Data Breach Communication Plan (Incident Response Plan):

Identification and Verification:

Confirm and internally verify the breach promptly.

Assessment of Impact:

Assess risks and legal obligations.

Prepare a Clear Message:

Craft a factual and transparent message.

Define Target Audiences:

Identify affected individuals and relevant authorities.

Select Communication Channels:

Choose direct channels and prepare public statements.

Establish a Timetable:

Define urgency and implement a phased approach.

Offer Support and Guidance:

Provide support resources and guidance.

Monitor and Respond to Feedback:

Establish feedback channels and respond promptly.

Coordinate with Regulatory Authorities:

Notify and update relevant regulatory bodies.

Post-Incident Analysis and Improvement:

Conduct a debriefing for continuous improvement.

By following these concise steps, we can effectively communicate during a data breach, demonstrating responsibility and commitment to mitigating the impact on affected parties.

Training on Confidentiality Laws for Student, Teacher, and Principal Data.

Tailored Training:

Develop role-specific training modules for officers, employees, and assignees covering Federal (e.g., FERPA) and State confidentiality laws.

Interactive Approach:

Use interactive methods and real-life scenarios to enhance understanding and emphasize the practical application of confidentiality laws.

Periodic Updates:

Provide regular updates on changes to laws and regulations to ensure ongoing compliance.

Assessment and Certification:

Implement assessments, quizzes, and certifications to evaluate understanding and emphasize the importance of compliance.

Access Permissions Linked to Training:

Grant access to data only upon successful completion of confidentiality training.

Documentation:

Maintain records of training sessions attended to demonstrate the organization's commitment to compliance.

Clear Policies:

Establish and communicate clear policies and procedures for handling sensitive information.

Continuous Communication:

Encourage ongoing communication, questions, and updates regarding data privacy.

This streamlined approach ensures a focused and effective training program while strongly emphasizing compliance with confidentiality laws.

Limiting Internal Access to PII

To restrict internal access to personally identifiable information (PII) and ensure that only employees or subcontractors with a genuine need can access it for contracted services, we follow these measures:

Role-Based Access Control (RBAC):

Implement RBAC to assign specific access permissions based on job roles and responsibilities. Define roles with the minimum necessary access required to perform their duties related to the contracted services.

Data Classification:

Classify PII based on sensitivity and necessity for the contracted services. Limit access to different categories of PII according to the roles and tasks associated with the services.

Need-to-Know Principle:

Adhere to the "need-to-know" principle, allowing access only to individuals who require the information to fulfill their job responsibilities. This ensures that employees and subcontractors access only the data necessary for their tasks.

Access Monitoring and Auditing:

Implement robust access monitoring and auditing mechanisms to track who accesses PII and when. Regularly review access logs to detect any unauthorized or unnecessary access, enabling timely corrective action.

User Authentication and Authorization:

Enforce strong user authentication measures, such as unique usernames and strong passwords, and use multi-factor authentication where applicable. Ensure that authorization mechanisms are in place to control access based on user roles.

Employee Training:

Educate employees and subcontractors about the importance of data privacy and the significance of limiting access to PII. Emphasize the legal and ethical obligations associated with handling sensitive information.

Contractual Agreements:

Clearly define access requirements and restrictions in contractual agreements with subcontractors. Specify that access to PII is granted solely for the purpose of fulfilling the contracted services and that any unauthorized use is strictly prohibited.

Regular Access Reviews:

Conduct periodic reviews of access permissions to ensure alignment with job roles and contracted services. Remove or modify access for individuals whose responsibilities no longer require access to certain types of PII.

Encryption and Anonymization:

Implement encryption for stored and transmitted PII. Consider anonymizing data where possible to reduce the risk associated with unnecessary exposure of personal information.

Incident Response Plan:

Develop and maintain an incident response plan to address any unauthorized access incidents promptly. Ensure that employees and subcontractors are aware of the procedures to follow in the event of a security incident.

Continuous Compliance Monitoring:

Establish ongoing processes to monitor compliance with access restrictions. Regularly assess and update access controls to align with changes in job roles, services, and regulations.

By combining these measures, the organization can establish a robust framework for limiting internal access to PII, promoting data security, and ensuring compliance with privacy regulations.

Control Internal Access to PII

To control access to protected data and prevent the unauthorized use of personally identifiable information (PII), the organization implements a set of stringent access controls and follows specific practices:

Access Control Policies:

Develop and enforce access control policies that clearly outline who can access protected data, the purposes for which access is granted, and the specific conditions under which access is authorized.

Role-Based Access Control (RBAC):

Utilize RBAC to assign access privileges based on job roles and responsibilities. Only grant access to individuals who need the data to perform their duties as outlined in the contract.

Data Encryption:

Implement encryption for both stored and transmitted PII to safeguard against unauthorized access. This ensures that even if data is accessed, it remains unreadable without the appropriate decryption keys.

Audit Trails and Monitoring:

Establish comprehensive audit trails and monitoring systems to track access to protected data. Regularly review these logs to identify and investigate any unauthorized access or suspicious activities.

Data Minimization:

Adhere to the principle of data minimization by limiting the collection and storage of PII to only what is necessary for the specified contractual purposes. Avoid collecting or retaining data that is not explicitly authorized in the contract.

Explicit Authorization Protocols:

Implement protocols for obtaining explicit authorization before using PII for any purpose beyond what is specified in the contract. This may involve obtaining consent from data subjects or seeking additional contractual agreements.

Contractual Agreements:

Clearly articulate data usage restrictions in contractual agreements. Specify that PII can only be used for the explicit purposes outlined in the contract and that any deviation requires formal authorization.

Employee Training:

Conduct regular training sessions for employees to raise awareness about the importance of adhering to data usage restrictions. Ensure that employees understand the consequences of unauthorized use and the legal and ethical obligations associated with handling PII.

Data Access Reviews:

Conduct periodic reviews of data access permissions to ensure alignment with the contractual scope. Remove or modify access for individuals or systems that do not have a legitimate need for the data.

Regular Compliance Audits:

Implement regular compliance audits to assess adherence to data usage restrictions. Identify and rectify any non-compliance issues promptly.

Incident Response Plan:

Develop and maintain an incident response plan to address any unauthorized use incidents. Clearly define the steps to be taken in the event of a violation, including notification of affected parties and regulatory authorities if required.

Continuous Monitoring and Improvement:

Establish a continuous monitoring and improvement process to adapt to changes in data usage requirements, technological advancements, and regulatory updates. Ensure that policies and practices remain effective over time.

By implementing these measures, we can establish a robust framework for controlling access to protected data and ensuring that personally identifiable information is used only for purposes explicitly authorized in its contracts.

Administrative, technical, and physical safeguards to protect PII

To maintain reasonable administrative, technical, and physical safeguards for the protection of the security, confidentiality, and integrity of personally identifiable information (PII) in its custody, we have implemented a comprehensive approach encompassing the following key measures:

Administrative Safeguards:

Data Governance Policies:

Develop and enforce clear data governance policies that define our approach to handling PII. These policies should include guidelines on data access, usage, sharing, and disposal.

Risk Assessments:

Conduct regular risk assessments to identify potential vulnerabilities and threats to the security of PII. Use the findings to implement proactive measures and prioritize risk mitigation efforts.

Employee Training:

Provide comprehensive training programs for employees regarding data security best practices and the organization's policies. Ensure that employees are aware of their responsibilities in safeguarding PII.

Access Controls:

Implement robust access controls, including role-based access, to ensure that only authorized personnel have access to PII. Regularly review and update access permissions based on job roles and responsibilities.

Incident Response Plan:

Develop and maintain an incident response plan to address security incidents promptly. Clearly outline the steps to be taken in the event of a data breach, including notification procedures and coordination with regulatory authorities.

Technical Safeguards:

Encryption:

Implement encryption mechanisms for both data at rest and data in transit to protect against unauthorized access. Utilize strong encryption algorithms to safeguard the confidentiality of PII.

Firewalls and Intrusion Detection Systems:

Deploy firewalls and intrusion detection systems to monitor and control network traffic. These measures help prevent unauthorized access and detect suspicious activities that may compromise the security of PII.

Regular Software Updates:

Keep all software, including security applications and operating systems, up to date with the latest patches and updates to address vulnerabilities promptly.

Data Backups:

Establish regular data backup procedures to ensure the availability and integrity of PII. Test backup and recovery processes to verify their effectiveness.

Physical Safeguards:

Access Controls to Physical Spaces:

Implement access controls to restrict physical access to areas where PII is stored. This may include secure entry systems, biometric authentication, and surveillance.

Secure Storage:

Store physical records containing PII in secure, locked cabinets or rooms with limited access. Implement additional safeguards, such as tamper-evident seals, to prevent unauthorized access.

Disposal Procedures:

Establish secure procedures for the disposal of physical and electronic records containing PII. Ensure that sensitive information is properly shredded or permanently deleted to prevent unauthorized retrieval.

Physical Security Audits:

Conduct regular physical security audits to assess and enhance the effectiveness of measures in place. Identify and address any vulnerabilities or lapses in physical security.

Continuous Monitoring and Improvement:

Regular Audits and Assessments:

Conduct regular internal and external audits to assess compliance with security policies and identify areas for improvement.

Incident Analysis and Remediation:

Analyze security incidents, if they occur, to identify root causes and implement remediation measures to prevent similar incidents in the future.

Adaptation to Emerging Threats:

Stay informed about emerging cybersecurity threats and adjust security measures accordingly. Adopt new technologies and practices to address evolving risks.

By implementing and consistently maintaining these administrative, technical, and physical safeguards, we can establish a robust framework for protecting the security, confidentiality, and integrity of personally identifiable information in its custody.

Adoption of Technologies to Protect PII

The National Institute of Standards and Technology (NIST) Cybersecurity Framework is a widely recognized set of guidelines and best practices for improving cybersecurity risk management. Organizations that adopt the NIST Cybersecurity Framework typically follow a structured approach to enhance their cybersecurity posture. Here's a general overview of how we’ve adopted technologies, safeguards, and practices aligned with the NIST Cybersecurity Framework:

Identify:

Asset Inventory: The organization creates an inventory of all its information assets, including hardware, software, data, and personnel.
Risk Assessment: Conducts a thorough risk assessment to identify and prioritize cybersecurity risks.

Protect:

Access Controls: Implements strong access controls to ensure that only authorized individuals have access to sensitive information.
Data Encryption: Utilizes encryption technologies to protect data both in transit and at rest.
Security Awareness Training: Provides regular cybersecurity awareness training to employees to educate them about potential threats and best practices.

Detect:

Intrusion Detection Systems (IDS): Implements IDS to monitor network traffic and detect unusual or suspicious activities.
Security Information and Event Management (SIEM): Deploys SIEM tools to collect, analyze, and correlate security events across the organization.

Respond:

Incident Response Plan: Develops and maintains an incident response plan to outline the steps to be taken in the event of a cybersecurity incident.
Communication Protocols: Establishes clear communication protocols for reporting and responding to incidents promptly.

Recover:

Backup and Recovery: Implements robust backup and recovery processes to ensure quick restoration of systems and data in the event of a disruption.
Business Continuity Plan: Develop a business continuity plan to minimize the impact of a cybersecurity incident on the organization's operations.

Continuous Improvement:

Regular Assessments and Audits: Conducts regular cybersecurity assessments and audits to identify areas for improvement.
Patch Management: Establishes a systematic process for applying security patches and updates to software and systems.
Information Sharing: Participates in information-sharing initiatives to stay informed about emerging threats and vulnerabilities.

Framework Customization:

Tailoring the Framework: Adapts the NIST Cybersecurity Framework to the specific needs and characteristics of the organization.
Integration with Other Frameworks: Integrates the NIST framework with other relevant cybersecurity frameworks and standards to create a comprehensive cybersecurity program.

Governance and Accountability:

Leadership Involvement: Ensures that leadership is actively involved in cybersecurity initiatives, providing necessary resources and support.
Compliance Monitoring: Regularly monitors and assesses compliance with cybersecurity policies, standards, and regulations.

By following these steps, we can significantly enhance its cybersecurity posture and align with the principles of the NIST Cybersecurity Framework.

Updated on: 08/02/2024