Key Takeaways
- FERPA governs student education records processed by a workforce development platform. A vendor must be formally designated as a school official under 34 CFR 99.31(a)(1) before accessing those records, and must operate under a signed agreement restricting use to authorized purposes.
- The FTC Safeguards Rule, enacted under the Gramm-Leach-Bliley Act, covers higher education institutions handling Title IV financial aid data and requires a written information security program, encryption, multi-factor authentication, and breach notification to the FTC within 30 days for incidents affecting 500 or more individuals.
- State privacy laws in California, Virginia, Colorado, and other states add data subject rights, including deletion requests and processing restrictions, that federal law alone does not require a workforce development platform to support.
- SOC 2 Type II certification provides third-party audited evidence that a vendor's security controls operated continuously over a sustained period. That record makes it the technical standard most aligned with FERPA's reasonable methods requirement for vendor data protection.
- KnowledgeCity's workforce development platform is aligned to the AICPA SOC 2 Type II criteria and maintains audit-ready records behind every training completion, with SAML 2.0 SSO, SCIM 2.0, encrypted PII, and DSAR support built into the platform's data governance layer.
Deploying a workforce development platform at your university puts 4 kinds of record in one environment. Those records cover student training completions, employee data, financial aid information and continuing education enrollment, and each answers to a different regulator. Sign the vendor agreement without auditing how those categories are handled and you carry an exposure nobody will name until a breach does.
Higher education workforce development platform decisions are student data privacy decisions, and 3 frameworks divide the ground between them. FERPA governs the education records among them. The FTC Safeguards Rule under the Gramm-Leach-Bliley Act governs the financial aid and employee financial data. State privacy statutes add their own requirements on top of both rules, and no single vendor checkbox covers all 3.
What FERPA and the Safeguards Rule Ask of Your Platform
FERPA defines an education record as anything directly related to a student that your institution maintains, or that somebody maintains on your behalf. Inside a workforce development platform that covers training completions tied to enrolled students, continuing education enrollment data and any learning record connected to an academic or credentialing program. That classification follows the record itself, whatever category the platform assigns it.
The 4 Conditions of the School Official Exception
Contract a third party to run that platform and you need the school official exception at 34 CFR 99.31(a)(1). Those conditions number 4, and your vendor has to meet every one of them before the exception applies to anything it touches:
- Institutional function: It performs a service you would otherwise use your own employees for.
- Direct control: You keep direct control over how it uses and maintains the education records.
- Authorized purpose only: It uses personally identifiable information only for the purposes you authorized.
- Annual notification: It meets the criteria in your annual FERPA notification for a school official with legitimate educational interest.
Miss one of those conditions and the compliance responsibility is still yours. That same responsibility runs through the FTC Safeguards Rule as well. That rule applies to you as an institution participating in federal student aid and functioning as a financial institution under the Act.
Which Amendment Carried Which Duty
The FTC's 2021 amendments bound you from June 2023. Those amendments require a designated qualified individual over a written information security program, annual risk assessments, and encryption in transit and at rest. They also require multi-factor authentication and vendor monitoring. A further amendment in 2023 added a single duty on top of those, which is notice to the FTC within 30 days of discovering a breach affecting 500 or more people.
None of those duties can be handed to a vendor, however much of the processing the vendor takes on for you. What you can require from that vendor is the technical controls that let you show your written information security program is intact. Encryption, access monitoring and breach notification are the 3 that carry the most weight.
The Risk of Skipping Formal Vendor Review
Those controls are harder to verify because most enterprise platforms run multi-tenant, sharing infrastructure between institutions. Good isolation in a multi-tenant system keeps your records out of another tenant's queries and API calls. A misconfiguration in a shared layer does the opposite, and it surfaces in somebody else's audit first. Without reviewing the architecture, you cannot tell which one you bought.
800+
Confirmed data breaches in the education sector in the Verizon 2025 Data Breach Investigations Report, against 1,075 recorded incidents. Source: Verizon 2025 Data Breach Investigations Report
State Law Above the Federal Floor
Those federal rules are a floor, and your state law builds on it. California's Consumer Privacy Act gives students and employees rights beyond FERPA's scope, covering what data is collected, deletion and restriction of processing. Virginia and Colorado carry comparable provisions, so any enrollment in those states obliges you to support data subject access requests.
The gap opens operationally, long before anybody writes it down. You discover it when the first deletion request arrives and the platform has no mechanism to fulfill it. It becomes a liability when a state regulator asks how you honored that right, and your answer depends on a mechanism nobody specified at procurement.
Audit Your Platform's Data Handling Before You Sign
See how KC LMS structures role-based access, audit logging and retention controls for FERPA-covered records and employee data.
What to Verify Before Deployment
That review starts with encryption, which is the floor under everything else. Data moves under TLS and sits encrypted at rest, because both frameworks require reasonable methods to protect covered information. A stored unencrypted record fails that test whatever the vendor says elsewhere, and the category of the record makes no difference to the finding.
Access, Residency, Retention
Role-based access decides who can view, change or export which category of record. Ask whether a department administrator can read outside their own department. Then check whether a continuing education coordinator can reach degree program records, or a report exports to somebody with no legitimate interest in it. A model that does not restrict by role, program and data category creates an exposure on every cross-departmental query.
Data category | Framework | Control you need | The question to ask |
|---|---|---|---|
Student training completions | FERPA, 34 CFR 99.31 | Role-based access and a signed school official agreement | Does the vendor sign a FERPA agreement naming it a school official? |
Employee financial and benefits data | GLBA and the FTC Safeguards Rule | Encryption at rest and in transit, multi-factor authentication | Does the SOC 2 Type II report cover security and confidentiality? |
Continuing education enrollments | FERPA plus state law | Data residency confirmation and DSAR support | Can the vendor confirm US residency and fulfill a deletion request? |
Compliance training audit records | FERPA and state credentialing law | Immutable audit trail with exportable logs | Are logs kept as long as your records retention policy requires? |
SOC 2 Type II is the audit standard closest to what you need. It shows controls operated continuously over at least 6 months, across the security, availability, confidentiality and privacy criteria. A Type I report covers design only, which is a plan. Read it alongside the FERPA agreement, since one sets the technical controls and the other sets the legal conditions for access.
Residency and retention close the set. Confirm where records physically reside, how long the vendor holds them, and what triggers deletion, because a vendor retaining student data indefinitely after the relationship ends creates your exposure. Your audit trail then has to record every access event and export, since a log of training completions alone cannot produce the specificity a 30-day FTC notice demands.
What KC LMS Gives Your University IT Team
KC LMS is built to clear that review, with its controls aligned to the AICPA SOC 2 Type II criteria. Access follows organizational data from your HRIS, so what a user sees reflects their role, and the audit log, 2FA enforcement, password policy and IP allowlist are configurable per account. SAML 2.0 SSO and SCIM 2.0 provisioning connect to your identity provider, so de-provisioning in your directory closes the gap manual offboarding leaves open.
Every assignment, completion and certification event generates an audit-ready record your administrators can pull on demand. The export covers regulatory reporting and accreditation review. The governance layer covers encrypted PII handling, DSAR support for institutions under state privacy law, and retention controls you configure. Pair it with FERPA refresher training and the same record answers both the training question and the access question.
Those architectural decisions are set at deployment and expensive to revisit. An institution that builds school official agreements, SOC 2 Type II review, state law assessment and residency confirmation into its standard evaluation reduces exposure across every vendor relationship that follows. Your vendor risk assessment and your certification expiry tracking run on the same evidence.
Frequently Asked Questions
1. Does FERPA apply to a workforce development platform deployed at a university?
FERPA applies to any record directly related to a student that is maintained by or on behalf of the institution. If a workforce development platform processes FERPA compliance training records for students, continuing education enrollment data, or any record connected to a student's academic program, FERPA governs that data. The vendor must be formally designated as a school official under 34 CFR 99.31(a)(1) and must operate under a signed agreement restricting access to purposes with legitimate educational interest.
2. What is the FTC Safeguards Rule and does it apply to universities?
The FTC Safeguards Rule, issued under the Gramm-Leach-Bliley Act, requires financial institutions to implement a written information security program protecting covered financial data. Higher education institutions that participate in federal student aid programs are covered. The 2021 amendments, binding from June 2023, require covered institutions to encrypt financial data in transit and at rest, implement multi-factor authentication, conduct annual risk assessments, and monitor vendor service providers. A 2023 amendment added notice to the FTC within 30 days of a breach affecting 500 or more individuals.
3. What is SOC 2 Type II and why does it matter for workforce development platform procurement?
SOC 2 Type II is an audit report demonstrating that a vendor's security, availability, confidentiality, and privacy controls operated effectively over a period of at least six months. For universities, SOC 2 Type II provides third-party-audited evidence that a vendor's security controls meet the reasonable methods standard that FERPA and the Safeguards Rule require for protecting covered records. A SOC 2 Type I report covers only control design and not continuous operation, which does not provide the same level of regulatory assurance.
4. What should a university require from a workforce development platform vendor before deployment?
Before deploying a workforce development platform that handles student or employee data, universities should require a current SOC 2 Type II report covering the security and confidentiality criteria; a signed FERPA school official agreement specifying authorized purposes and prohibiting re-disclosure; written confirmation of data residency for institutions with geographic restrictions; documentation of DSAR support for institutions in states with consumer privacy laws; and a contractual vendor breach notification commitment with a defined timeframe.
References
- Legal Information Institute. 34 CFR 99.31(a)(1), FERPA, the school official exception.
- Federal Trade Commission. FTC Safeguards Rule: What Your Business Needs to Know, 16 CFR Part 314.
- U.S. Department of Education. Student Privacy Policy Office, FERPA guidance for educational agencies.
- Verizon Business. 2025 Data Breach Investigations Report, educational services.
- EDUCAUSE. Cybersecurity Program, higher education data governance.
- AICPA. SOC 2 Examinations, trust services criteria.