34 CFR 99.30 prior consent requirement + 99.31 exceptions. PRIOR CONSENT (§99.30): the institution must obtain SIGNED + DATED WRITTEN CONSENT (electronic signature acceptable) BEFORE disclosing PII from education records (with the §99.31 exceptions). The consent must specify the records to be disclosed + the purpose + the party to whom disclosure is made. EXCEPTIONS to consent (§99.31) - disclosures permitted without consent: (a)(1) school officials with legitimate educational interest; (a)(2) other educational institutions where the student seeks or intends to enroll; (a)(3) authorised representatives for audit + evaluation; (a)(4) financial aid; (a)(5) state + local officials under State statute (1974 + 1979 statutory exceptions); (a)(6) studies for or on behalf of the institution; (a)(7) accrediting organizations; (a)(8) parents of dependent students per IRS Section 152; (a)(9) compliance with judicial order or subpoena; (a)(10) health or safety emergency (99.36); (a)(11) directory information per 99.37; (a)(12) parents of students under 21 regarding alcohol/drug violations; (a)(13)/(14) sex offenses + crimes of violence; (a)(15) parents of dependent students; (a)(16) registered sex offenders. RECORDKEEPING: 99.32 requires a record of each disclosure (excluding to the student + school officials + directory information + with consent + judicial order) be maintained with each education record + made available to parents + eligible students.
This control maps to 98 controls across 38 other frameworks. If you already hold one of them, the evidence you collected for it is the starting point here rather than new work.
Every mapping shown was judged rather than inferred from wording similarity, and the ones that failed review are published too. See the coverage reports and what was rejected.
The graph holds this control, the 98 it maps to, and the evidence behind each claim, over MCP and REST.