School District Vendor Risk Management: Why Education Needs Better Vendor Oversight
The California ETS student data breach illustrates why cybersecurity governance have to extend beyond school-owned technology, including third-party providers handling sensitive student information.
Executive Summary
On October 16, 2026, the California Department of Education announced a data security incident involving Educational Testing Service (ETS), its statewide assessment contractor. An attacker used compromised credentials to access and copy student information over a period spanning nearly four months, including identifying information, disability-related records, and assessment results.
The incident involved a third-party system rather than a reported compromise of individual school district networks. For superintendents, school boards, and education executives, it demonstrates why cybersecurity governance must extend beyond school-owned technology. Effective vendor risk management requires visibility into who handles student information, evidence of appropriate security controls, clear incident notification procedures, and accountability when risks are identified.
These responsibilities are particularly relevant to districts navigating Washington and California student-privacy requirements, but the underlying risks apply to educational institutions nationwide.
The ETS Breach: What Education Leaders Should Know
According to the California Department of Education’s official announcement, ETS discovered unauthorized activity on September 25, 2026, involving a secure file-transfer system used for statewide student assessments. The investigation determined that an unauthorized party used a compromised login credential to access and copy student records at various times between May 22 and September 18. A four month period.
The state’s incident notification identifies potentially exposed information including student names, dates of birth, Statewide Student Identifiers (SSIDs), demographic information, disability status, and assessment results. SSIDs are education identifiers, not Social Security numbers; the state confirmed that Social Security numbers and financial account information were not involved.
ETS disabled the affected account, replaced the file-transfer system, and began providing notifications and identity-protection services to affected individuals. Although compromised credentials were used, public findings do not establish precisely how those credentials were obtained or which preventive controls may have failed.
The incident highlights a limitation in traditional school cybersecurity planning: student information can be exposed through a vendor without an attacker ever accessing the district’s own network.
Where School District Vendor Oversight Falls Short
Schools depend on outside providers for student information systems, assessments, learning platforms, special education, transportation, and numerous other essential services. Each relationship introduces security responsibilities that may extend beyond the institution’s direct control.
The ETS incident illustrates two distinct categories of third-party risk:
| Vendor relationship | Leadership’s responsibility |
|---|---|
| District-contracted vendors | Evaluate security practices, contractual protections, access controls, data retention, and incident notification requirements |
| State-selected vendors | Understand what student information is shared, which agency oversees security, and how districts receive incident notifications |
ETS operated under contract with the California Department of Education, meaning individual districts did not necessarily control the vendor relationship or the affected system.
Districts may have limited authority to change state-level vendor agreements, but they can document those dependencies, establish communication procedures, and prepare for possible disruptions or data exposure.
Washington and California Have Additional Student Privacy Considerations
In Washington, Chapter 28A.604 RCW establishes requirements for covered K–12 school service providers, including restrictions on student information use, security safeguards, and applicable data-deletion obligations.
California’s Education Code Section 49073.1 establishes specific contractual requirements for covered third-party services handling pupil records, including confidentiality protections, authorized use, incident notification procedures, and retention limitations.
These state requirements operate alongside applicable federal obligations, including FERPA. Under FERPA’s school-official exception, qualifying outsourced providers must meet conditions involving institutional control, permitted use, and restrictions on redisclosure.
For school leadership, compliance should involve verifying how the applicable requirements are reflected in actual vendor relationships, rather than assuming that existing contracts provide sufficient protection.
Four Questions Every School Board Should Be Asking
School boards and executive leadership do not need to oversee the technical configuration of every vendor system. They do need evidence that significant third-party risks are being identified, assessed, and managed.
1. Do we know which vendors handle our most sensitive student information?
A vendor inventory should identify the information each provider receives, its purpose, the contracting authority, and the person responsible for oversight. It should include relevant state-managed systems alongside district-contracted providers.
2. Can we demonstrate that appropriate security controls exist?
For directly contracted providers, review available evidence concerning authentication, access restrictions, monitoring, data retention, and incident response. State-managed relationships may require coordination with the responsible agency.
3. Would we know if a vendor experienced a security incident?
Document how incidents are reported, who receives notifications, which deadlines apply, and how leadership determines whether students, staff, or institutional operations are affected.
4. Who is accountable for addressing unresolved vendor risks?
Significant findings should have an assigned owner, documented priority, planned corrective action, and review date. Unanswered questions should be recorded as unresolved risks rather than treated as evidence that protections exist.
A Practical Starting Point for Your Next Board Meeting
Ask IT or risk leadership for a vendor risk register covering the institution’s most sensitive student-data relationships. For each vendor, document the data involved, contracting authority, available security evidence, notification responsibilities, unresolved concerns, and the person accountable for follow-through.
This gives superintendents, cabinet members, and trustees a manageable way to prioritize vendor oversight without requiring an extensive audit of every technology provider.
TorchLight also provides dedicated resources for institutions evaluating their broader cybersecurity readiness:
- Washington K–12 Cybersecurity Readiness Checklist — Covers student-data security, incident response, recovery, and relevant Washington K–12 requirements.
- California Education Cybersecurity Readiness Checklist — Provides a structured review of cybersecurity controls, FERPA, California student-privacy requirements, and other applicable obligations.
Strengthening Vendor Risk Management With Experienced Education Cybersecurity Leadership
School district IT departments already manage classroom technology, infrastructure, staff support, security, and daily operations. Developing a formal third-party risk management program adds responsibilities involving assessments, contractual protections, compliance documentation, and executive reporting.
TorchLight helps educational institutions manage these responsibilities through independent cybersecurity assessments, fractional vCISO and vCIO leadership, and ongoing security operations.
Our education-sector experience includes work with the California Community Colleges Chancellor’s Office , delivering GLBA risk assessments, ransomware risk evaluations, and security testing across the state’s community-college system. Headquartered in Liberty Lake, Washington, TorchLight also serves K–12 districts and education organizations throughout Washington and California, alongside institutions in other states.
Recognized Purchasing Qualifications for Washington and California Education
TorchLight has also been awarded cooperative purchasing contracts specifically supporting educational institutions in both states.
Washington: TorchLight was awarded Washington Learning Source (WLS) Contract WLS343 through its competitively bid Cybersecurity Solutions program, administered by Puget Sound Educational Service District. The program provides an established procurement framework for participating Washington K–12 districts and public agencies, subject to applicable contract terms and current availability.
California: TorchLight is an authorized Foundation for California Community Colleges vendor under Agreement #0001-0685, supporting eligible institutions through procurement programs including CollegeBuys and SchoolBuys. Available contracted services include penetration testing, security assessments, managed detection and response, and virtual CISO advisory.
These qualifications help eligible institutions access established purchasing arrangements while working with a provider experienced in the regulatory, operational, and budgetary challenges of education cybersecurity.
For districts with established IT departments, TorchLight’s co-managed IT and security services can provide additional expertise and security capabilities without replacing the people already managing their schools’ technology.
Is Your District’s Vendor Risk Management Program Defensible?
The ETS incident demonstrates how sensitive student information can be exposed through systems outside a district’s direct control. Although no institution can eliminate every third-party risk, leadership can establish a defensible process for evaluating vendors, identifying security gaps, assigning accountability, and documenting corrective action.
TorchLight helps school districts and educational institutions turn those responsibilities into practical, measurable cybersecurity programs.
Whether your organization needs an independent vendor risk assessment, executive cybersecurity guidance, or additional security support for an existing IT department, our team can help identify where meaningful exposure exists and develop a prioritized plan to address it.