FERPA

Family Educational Rights and Privacy Act - student records access, consent, directory info handling.


Region	Americas
Country or scope	United States
Sector	Education
In your workspace	On unless you switch it off in Compliance › Manage.

How Safeguard covers FERPA

Scan requirements: 5, all decided by a scan.
Controls: the scan requirements below, plus 8 controls from Safeguard's control catalog for FERPA.
Automated tests: none map to it directly. You can link any automated test to its controls yourself (how).
Policy templates: 23: 1 written for FERPA and 22 from the standard set.

How each kind of coverage works, and what the readiness score counts: Compliance frameworks.

What a scan checks

Each scan of a product checks these 5 requirements against what the scan found, including the product's software inventory (SBOM).

Requirement	What Safeguard checks	Decided by
`FERPA-99.31-SO` Direct Control of Outsourced Providers	Education records may be shared without consent with contractors and vendors acting as school officials only if the institution maintains direct control over their use of the records, which requires knowing which suppliers stand behind each system component handling records (34 CFR 99.31(a)(1)(i)(B))	Scan
`FERPA-99.31-RM` Reasonable Methods to Limit Access	Institutions must use reasonable methods to ensure school officials access only records in which they have a legitimate educational interest, which requires the systems and components holding records to be individually identifiable (34 CFR 99.31(a)(1)(ii))	Scan
`FERPA-99.32` Recordkeeping of Disclosures	Institutions must maintain a record of each request for and disclosure of education records, which presupposes formally identified, timestamped documentation of the systems through which records flow (34 CFR 99.32)	Scan
`FERPA-1232G-B` Consent-Gated Disclosure Transparency	Federal funding is conditioned on institutions not releasing education records without written consent outside the statutory exceptions; demonstrating this discipline is supported by standard machine-readable descriptions of the record-handling systems (20 U.S.C. 1232g(b))	Scan
`FERPA-SYS-INV` Knowledge of Record-Holding Systems	Meeting access, correction, and disclosure-limitation duties presupposes the institution knows which systems and software components hold education records at all, i.e. an enumerated component inventory (FERPA access and disclosure duties, 20 U.S.C. 1232g / 34 CFR Part 99)	Scan

More controls in the catalog

The framework's Controls tab lists its scan requirements and these controls from Safeguard's control catalog. Evidence them with automated tests, uploaded evidence, policies or an attestation.

Control	Name
`99.7`	Annual Notice of Rights
`99.10`	Access to Education Records
`99.20`	Record Amendment Procedure
`99.30`	Written Consent for Disclosure
`99.31`	Permissible Disclosures Without Consent
`99.32`	Disclosure Recordkeeping
`99.33`	Third-Party Redisclosure Prohibition
`99.34`	Directory Information Policy

Policy templates

Written for FERPA:

FERPA Education Records Access Procedure

And 22 from the standard set, adapted to FERPA.