2026 California Education Cybersecurity Checklist

79 auditable controls. All mapped to FERPA, CIPA, the GLBA Safeguards Rule, and California’s own pupil-records and student-privacy statutes. It is the single view that your cabinet, IT leader, board/trustees, and auditor can all read from the same page.

➡️Mapped to FERPA (34 CFR 99), CIPA, the FTC Safeguards Rule (GLBA) and California Education Code.

➡️Covers SOPIPA and Education Code 49073.1 (AB 1584) student-data duties.

➡️Includes the breach-notification clocks for Title IV institutions and California. residents

➡️Built by TorchLight, securing and managing IT for education and regulated institutions.

Why student-data security got harder in 2026

If your institution touches student records, you are now accountable to multiple
rulebooks at the same time. And the bar keeps rising.

For colleges and universities, the GLBA Safeguards Rule is no longer a back-office formality.
Any institution that participates in Title IV federal student aid is treated by the FTC as a
financial institution and is audited against the Rule: a designated Qualified Individual, a
written risk assessment, encryption of student and financial-aid data, multifactor
authentication, and a tested incident response plan. The Department of Education’s
agreements require institutions to report a suspected breach the day it is detected.

For K-12 districts, FERPA governs every disclosure of an education record. CIPA
conditions your E-Rate funding on a written internet safety policy and working content
filtering. California then layers on the strictest student-data statutes in the country:

SOPIPA limits what EdTech vendors can do with student information.

Education Code 49073.1 (AB 1584) dictates exactly what your contracts must say about data ownership, security, breach notice and deletion.

The particular threat is why this matters. Confirmed attacks on U.S. education exposed
roughly 3.9 million records in 2025. That’s up about 27% from the prior year, and the sector now leads the country in ransomware incidents. The Department of Education has flagged roughly 150,000 suspect identities and about $90 million in financial-aid losses tied to ineligible or synthetic applicants. Cyber-insurance carriers price your premium on the
controls you can actually show evidence for.

If your vendor contracts predate SOPIPA, your filtering policy has not been to a public
hearing, or you cannot produce a written risk assessment, those are findings waiting to
happen. This checklist turns that ambiguity into a clear, evidence-backed picture in about
fifteen minutes.

What is inside the checklist

A leadership-ready PDF (Edition 6.2026, 11 pages) organized so anyone from a district CTO
to a college trustee can use it:

Part I, Regulatory Requirements. 8 control domains, 44 auditable controls:

➡️ FERPA student-records governance
➡️ EdTech vendor and data-privacy agreements (SOPIPA and Education Code 49073.1)
➡️ the GLBA Safeguards information security program
➡️ Authentication and access
➡️ CIPA and E-Rate internet safety
➡️ Breach notification and incident response
➡️ Records retention and disposal
➡️ and governance, training and review readiness

Part II, Beyond compliance. 7 forward-looking control sets, 35 auditable controls:
for the threats schools and colleges are losing money and uptime to right now, including:

➡️Phishing-resistant identity and zero trust
➡️Ransomware resilience
➡️AI-era fraud defense
➡️ransomware resilience
➡️Ed-Tech supply chain and SaaS security
➡️Email & Network Hardening
➡️Threat intel & cloud posture
➡️Board & Trustee cyber literacy

3 executive visuals: An applicability map showing which laws bind public K-12,
private K-12, community colleges and universities; An incident-clock timeline of the
overlapping breach-notification deadlines; And a 2024 to 2025 threat-landscape panel.

A built-in readiness self-score: so you can rate Part I and Part II in one sitting and set
your next reassessment date if you choose.

Authority and references: every requirement traces to a specific statute, regulation
or funding condition, ready for your audit and program-review workpapers.

79 auditable controls in total: each one a box a trustee can ask about and an IT
leader can answer with evidence.

Who the checklist is for

➡️District CTOs and IT directors who own the controls and need a defensible, prioritized punch list.

➡️College and university CISOs and IT security leaders who have to show evidence of GLBA Safeguards and FERPA compliance on demand.

➡️Business officers, superintendents, presidents, boards and trustees who want confidence the institution will pass its next audit or review.

➡️Compliance, privacy and risk leaders assembling audit-ready and E-Rate-ready documentation.

Built for California education organizations, public K-12 districts and county offices, community and junior colleges, and independent schools, colleges and universities, that carry IT teams of any size.

Why California School Districts choose TorchLight

TorchLight secures and manages IT for education and other regulated institutions, with a cybersecurity-first approach and 24/7/365 security operations. We do not hand you a checklist and walk away. Our Advantage Method takes you from a Stability Foundation, through a Compliance Accelerator, to a Proof Point backed by a virtual CISO.

The outcome education leaders come to us for: walk into your next audit, E-Rate review or program review with every control documented, defensible and owned. When a box on this checklist is unchecked, we are the team that checks it.

California Education Cybersecurity Checklist FAQ

Does FERPA require cybersecurity controls?

FERPA does not prescribe specific security technologies, but it requires institutions to use reasonable methods to protect education records and to control disclosures, and a breach that exposes records can trigger enforcement and state notification duties. For institutions that participate in Title IV federal student aid, the GLBA Safeguards Rule does require specific controls, including a written information security program, risk assessment, encryption, multifactor authentication and an incident response plan. In California, SOPIPA and Education Code 49073.1 add further data-handling and contract requirements.

What is the GLBA Safeguards Rule for colleges and universities?

The FTC treats any institution that participates in Title IV federal student aid as a financial institution subject to the Gramm-Leach-Bliley Act Safeguards Rule. That means a designated Qualified Individual, a written risk assessment, access controls and multifactor authentication, encryption of customer information in transit and at rest, a written incident response plan, service-provider oversight, and an annual report to a board or senior officer. The Department of Education enforces it through the program participation and SAIG agreements and the annual audit.

What does CIPA require for E-Rate funding?

The Children’s Internet Protection Act conditions E-Rate (and certain other federal) funding on a written internet safety policy, a technology protection measure that blocks or filters obscene material, child pornography and content harmful to minors, monitoring of minors’ online activity, public notice and a public hearing before adoption, and education of minors on appropriate online behavior, including cyberbullying awareness.

What California laws protect student data?

Beyond FERPA, California’s Student Online Personal Information Protection Act (SOPIPA, Business and Professions Code 22584) prohibits EdTech operators from selling student data or using it for targeted advertising. Education Code 49073.1 (AB 1584) dictates what district contracts with technology providers must say about data ownership, security, breach notification and deletion. Education Code sections 49060 to 49079 govern pupil records, and California’s breach-notification statutes (Civil Code 1798.29 and 1798.82) require notice when personal information is exposed.

Do private schools and universities have to follow FERPA?

FERPA applies to schools that receive funds under a program administered by the U.S. Department of Education. Many private K-12 schools that take no such funds are not directly bound by FERPA, though they often follow it voluntarily or under state law. Private colleges and universities almost always participate in Title IV federal student aid, so they are bound by both FERPA and the GLBA Safeguards Rule. California’s breach-notification laws apply broadly regardless of public or private status.

How do I prepare for a student data privacy or GLBA audit?

Map your program to the controls auditors actually test: a written, board-approved information security program with a designated Qualified Individual, a current risk assessment, multifactor authentication and least-privilege access, encryption, a tested incident response plan that meets the FSA and California notification clocks, compliant EdTech vendor contracts, and current FERPA notices and CIPA filtering. This checklist lays out all 79 controls so you can find and close gaps before the auditor arrives.

Is the checklist free, and what do I get?

Yes. The download is a free 11-page PDF (Edition 6.2026) with 79 auditable controls across regulatory requirements and forward-looking threats, three executive visuals, a built-in readiness self-score, and a full authority and reference list for your workpapers. No cost and no sales call required.