34 CFR 99.31(a)(6)(iii)(D) safeguards requirement + the PTAC Best Practices Guidance + SPPO Guidance. The 2011 final rule explicitly requires APPROPRIATE METHODS to PROTECT PII when disclosed under the studies + audit + evaluation exceptions. While FERPA itself does not prescribe specific security controls, the SPPO + PTAC + state-law (e.g. SOPIPA + CCPA-derived state student privacy laws + the 2018 Connecticut Act Concerning Student Data Privacy) impose the following safeguards on educational institutions + vendors processing student PII: (a) ACCESS CONTROL - need-to-know basis + role-based access + login authentication + just-in-time access + multi-factor authentication for sensitive PII; (b) ENCRYPTION - in-transit (TLS 1.2+) + at-rest (AES-256) + key management; (c) NETWORK + INFRASTRUCTURE SECURITY - firewall + IDS/IPS + segmentation + vulnerability management; (d) DATA RETENTION + DESTRUCTION - retention only as long as needed + verifiable destruction (NIST SP 800-88 sanitization); (e) INCIDENT RESPONSE + BREACH NOTIFICATION - written IR plan + tabletop testing + breach notification per state laws (no FERPA-specific breach notification timeline but state laws apply incl. all 50 states + DC); (f) VENDOR + CLOUD MANAGEMENT - written agreements + due diligence + direct control + audit rights + subprocessor controls; (g) WORKFORCE TRAINING - annual FERPA + security training + role-specific training for IT + privacy staff; (h) PRIVACY BY DESIGN - data minimisation + purpose limitation + edtech vendor evaluation matrix per PTAC; (i) COMPLIANCE MONITORING - annual audit + risk assessment + program review aligned with NIST SP 800-53 + NIST CSF 2.0 + FERPA-specific control mapping. The PTAC Best Practices Guidance includes detailed checklists for edtech vendors + cloud providers + administrative practices.
The graph holds this control, the 0 it maps to, and the evidence behind each claim, over MCP and REST.