November 3, 2026
A Message from Satish
Trust Is Earned Through the Work
Forward by Satish Shetty, Senior Vice President, Chief Technology Infrastructure and Security Officer
Protecting student, staff, and district information is one of the most important responsibilities entrusted to educational organizations and the companies that serve them. More importantly, it is foundational to nearly every other aspect of a district’s mission. From teaching and learning to family engagement, student services, and daily operations, schools rely on trusted systems and secure data to serve their communities effectively.
It is also a responsibility that cannot be reduced to a compliance checklist.
Cybersecurity is not a destination. Threats evolve, technology changes, and expectations continue to rise. Every organization must continually evaluate its assumptions, test its defenses, and improve its ability to respond when challenges arise.
One lesson has become increasingly clear: preparedness matters just as much as prevention. Strong security programs are built on more than technology. They depend on clear ownership, repeatable processes, independent validation, transparency, and a commitment to continuous improvement.
At PowerSchool, we have used our experiences as an opportunity to examine how security decisions are governed, how access is controlled, how risks are monitored, and how teams prepare for and respond to incidents. That work is ongoing, and strengthening how we protect the data entrusted to us.
This guide shares five practical principles that can help school districts, education leaders, and technology providers evaluate their own practices, identify opportunities for improvement, and strengthen trust with the communities they serve.
The Five Principles
- Build security into every layer
- Give customers control over their data
- Put privacy into practice
- Govern AI responsibly
- Treat security as a shared responsibility
Principle 1: Build Security into Every Layer
Secure by Design
Why It Matters
Security is most effective when it is built into infrastructure, products, development processes, monitoring systems, and daily operations from the start. When security is treated as an afterthought, risks can become embedded in systems and processes that are difficult to address later.
What Experience Teaches
No single tool, certification, or security team can protect an organization on its own. Strong cybersecurity programs rely on multiple layers of protection working together across identities, endpoints, networks, applications, data stores, and operational processes.
Organizations must continuously identify weaknesses, prioritize remediation efforts, validate corrective actions, and reassess risks as their environments evolve. Dedicated security resources, clear accountability, and ongoing oversight are essential to maintaining momentum.
What Strong Practice Looks Like
K-12 organizations should:
- Encrypt sensitive information both at rest and in transit.
- Keep operating systems, applications, frameworks, and software libraries up to date.
- Deploy network defenses, endpoint protection, secure configurations, and continuous monitoring.
- Implement role-based access controls and regularly review permissions for users, service accounts, cloud workloads, and databases.
- Integrate security reviews, code scanning, dependency analysis, penetration testing, and remediation practices into product-development processes.
- Establish clear accountability for governance, monitoring, incident response, recovery, and continuous improvement.
PowerSchool Perspective
PowerSchool applies a layered approach to security across its technology environment and product portfolio. Examples include:
- Continuous monitoring through a dedicated Security Operations Center.
- Regular vulnerability scanning and penetration testing across products and infrastructure.
- Static and dynamic application security testing integrated into development workflows.
- Ongoing security initiatives focused on operating-system upgrades, framework patching, credential management, remote access controls, cloud permissions, encryption standards, and modernization of security protocols.
PowerSchool’s security program is regularly evaluated through independent assessments and recognized frameworks, including:
- ISO 27001:2022 Certification
- SOC 2 Compliance
- 1EdTech TrustEd Apps Certification
Questions to Ask Your Organization
- Do we have visibility into our most critical security risks?
- How quickly are vulnerabilities identified and remediated?
- Are security controls consistently applied across systems and environments?
- Who is accountable for security governance and oversight?
Principle 2: Know and Govern Your Data
Customer Control Over Data
Why It Matters
Districts cannot protect data they don’t see or manage. A clear view of what information they collect, where it resides, how it moves, who can access it, and when it should be deleted allows leaders to set sound rules and hold both internal teams and technology providers accountable.
What Experience Teaches
Many organizations accumulate sensitive information over time without fully understanding the risks created by exports, integrations, backups, historical records, and third-party systems. The more copies of information that exist, the greater the importance of clearly defined ownership, retention policies, and deletion procedures.
What Strong Practice Looks Like
K-12 organizations should:
- Collect only information required for a defined educational or operational purpose.
- Document where sensitive data is collected, stored, processed, shared, backed up, and deleted.
- Implement role-based access controls and regularly review privileged access.
- Define retention schedules based on legal, regulatory, educational, and operational requirements.
- Verify that deletion processes extend to connected systems, exports, archives, and backups where applicable.
- Review third-party data practices before procurement and throughout the vendor relationship.
PowerSchool Perspective
Schools and districts should retain authority over how their information is accessed, used, retained, and deleted. Technology providers should give them clear information, practical controls, and reliable processes to exercise that authority.
Examples include:
- District-controlled retention timelines.
- Student-record purge capabilities within PowerSchool SIS.
- Support for cascading deletion across connected systems where available.
- District-managed permissions and identity-provider integrations.
- Product-design decisions that minimize collection of sensitive information when that information is not required to deliver functionality.
Questions to Ask Your Organization
- Do we know where all student and staff data is stored?
- Are retention schedules formally documented?
- Can we confidently remove information when it is no longer needed?
- How often do we review access to sensitive information?
Principle 3: Put Privacy into Practice
Privacy by Practice
Why It Matters
Privacy is about more than collecting, storing, and securing data. It requires organizations to make thoughtful decisions about how information is used, explained, reviewed, and governed throughout its lifecycle.
Privacy commitments are only meaningful when supported by clear accountability and consistent execution.
What Experience Teaches
Compliance requirements establish an important baseline, but privacy outcomes are shaped by everyday decisions across an organization.
Families, educators, and district leaders should be able to understand how information is used without needing legal or technical expertise. Transparency, documentation, and governance help build confidence and trust.
What Strong Practice Looks Like
K-12 organizations should:
- Evaluate privacy implications before introducing new systems, integrations, forms, features, or uses of data.
- Clearly document why information is collected and how it will be used.
- Limit secondary uses that fall outside the original purpose for collection.
- Establish processes for access, correction, deletion, and privacy-related requests.
- Review vendor commitments, subprocessors, data locations, and contractual obligations.
- Train employees to identify privacy considerations during everyday work.
PowerSchool Perspective
PowerSchool seeks to support privacy through documented commitments, governance practices, and ongoing review processes.
Examples include:
- Privacy commitments aligned to specific frameworks and agreements.
- Customer access to data-processing and compliance documentation.
- Consideration of privacy and data-minimization principles during product decisions.
- Ongoing reviews to ensure practices evolve alongside changing regulatory and customer expectations.
Questions to Ask Your Organization
- Are privacy considerations included in project planning?
- Can stakeholders clearly understand how information is used?
- Are privacy responsibilities assigned and documented?
- How often are privacy policies and procedures reviewed?
Principle 4: Govern AI Responsibly
Responsible AI Governance
Why It Matters
Artificial intelligence is creating new opportunities across education, but it also introduces new responsibilities. AI systems should be governed with the same rigor applied to cybersecurity, privacy, and data stewardship programs.
What Experience Teaches
AI governance cannot begin after a solution is deployed. Organizations must understand what information AI systems receive, how that information is handled, whether it is retained, and how outputs are reviewed.
Human accountability remains essential regardless of how advanced the technology becomes.
What Strong Practice Looks Like
Organizations should:
- Maintain an inventory of approved AI tools and use cases.
- Define ownership for approving, configuring, and monitoring AI-enabled capabilities.
- Minimize sensitive information submitted to AI systems.
- Understand whether customer data is retained, shared, or used for model training.
- Require appropriate human review of consequential outputs and recommendations.
- Evaluate bias, accuracy, privacy, security, transparency, and age appropriateness.
- Monitor changes to models, vendor practices, terms of service, and data-handling policies.
PowerSchool Perspective
PowerSchool believes AI governance should reflect the same security and privacy expectations applied across its broader portfolio. Read PowerSchool’s Responsible AI Statement here.
K-12 organizations implementing AI should focus on:
- Aligning AI features with established security and privacy standards.
- Providing administrative controls where supported.
- Documenting data-handling practices at the product and use-case level.
- Evaluating third-party integrations and data flows before deployment.
Questions to Ask Your Organization
- Do we know which AI tools are approved and why?
- How is customer data handled within AI-enabled systems?
- Who is responsible for AI governance decisions?
- What safeguards are in place for human oversight?
Principle 5: Treat Security as a Shared Responsibility
Security as a Shared Responsibility
Why It Matters
Technology providers and school districts each play a critical role in protecting information. Strong security depends on both parties understanding their responsibilities and working together to reduce risk.
What Experience Teaches
Even strong security technologies can be undermined by weak passwords, shared accounts, excessive privileges, phishing attacks, or unclear ownership.
Preparedness must extend beyond prevention and include communication, coordination, recovery, and continuous learning.
What Strong Practice Looks Like
K-12 organizations should:
- Require multifactor authentication wherever available.
- Use unique credentials and approved password managers.
- Eliminate shared accounts and unsecured credential storage.
- Review administrator, privileged, service, and inactive accounts regularly.
- Conduct recurring security-awareness training designed for specific roles.
- Teach users to recognize phishing attempts, suspicious communications, unsafe links, and social-engineering attacks.
- Clearly define provider, district, and shared responsibilities before implementation.
- Validate incident-response contacts, escalation procedures, backups, communications plans, and recovery processes through regular testing.
PowerSchool Perspective
PowerSchool supports districts through configurable security controls, identity integrations, implementation guidance, and defined operational processes. To help districts enforce best-in-class standards as part of a shared responsibility posture, PowerSchool systems require two-factor authentication and minimum password requirements.
Examples include:
- District-configurable access controls.
- Identity-provider integrations.
- Controlled support and maintenance-access procedures.
- Shared planning and collaboration around security responsibilities.
Questions to Ask Your Organization
- Is multifactor authentication enabled wherever possible?
- Are security responsibilities clearly documented?
- Do users receive ongoing security training?
- Have incident-response processes been tested recently?
A Practical 90-Day Starting Point
Improving cybersecurity does not require solving every challenge at once. The most effective programs focus on steady, measurable progress.
Over the next 90 days:
Assess Current Practices
Evaluate your organization against the five principles outlined in this guide.
Identify Priority Gaps
Determine which weaknesses represent the greatest risk to students, staff, and operations.
Assign Ownership
Ensure each improvement area has a clearly designated owner responsible for execution and reporting.
Focus on Measurable Improvements
Choose a small number of realistic actions that can be completed and verified within 90 days.
Examples may include:
- Enabling multifactor authentication for administrators.
- Reviewing privileged-access permissions.
- Updating a retention schedule.
- Testing backup restoration procedures.
- Creating an AI governance inventory.
- Conducting a tabletop incident-response exercise.
Review and Repeat
After 90 days, measure progress, identify remaining gaps, and establish the next set of priorities.
The Work of Cybersecurity Never Ends
Cybersecurity is not a project with a finish line. It’s an ongoing commitment to protecting people, safeguarding information, maintaining trust, and continuously improving.
Whether you are a district leader, technology administrator, educator, or technology provider, the most important step is to begin, assess honestly, improve consistently, and remain accountable along the way. Trust is earned through the work.
PowerSchool’s Commitment to Protecting Your Data
Learn about PowerSchool’s actions and policies to safeguard your student, family, and education data.
