34 CFR 99.31(a)(1) school officials with legitimate educational interest. The most-used FERPA exception + the source of most institutional disclosure decisions. DEFINITION + REQUIREMENTS: a school official includes institutional employees + contractors + consultants + volunteers + or other parties (e.g. attorneys + auditors + collection agents + cloud + edtech vendors) performing institutional services or functions for which the institution would otherwise use its employees + provided that: (i) the party is under the DIRECT CONTROL of the institution with respect to the use + maintenance of PII (e.g. contract clauses + control of data + return + deletion at end of engagement); AND (ii) the party is subject to the same FERPA + confidentiality requirements as institutional employees + AND (iii) the party uses the PII only to perform the institutional function for which they are designated. LEGITIMATE EDUCATIONAL INTEREST means a need to access education records to fulfil a professional responsibility for the institution. ANNUAL NOTIFICATION must specify the criteria for designating school officials + the legitimate-educational-interest standard. The 2008 + 2011 amendments expanded contractor/vendor coverage + the SPPO/PTAC Best Practices Guidance details documentation + control requirements for cloud + edtech vendors.
This control maps to 23 controls across 13 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 23 it maps to, and the evidence behind each claim, over MCP and REST.