The FERPA IT Compliance Checklist for Illinois Schools
A FERPA IT compliance checklist has to start with an inconvenient fact. FERPA does not publish one. The law sets no specific technical requirements for encryption, access control, or logging. What it sets instead is a reasonable methods standard: schools must use “reasonable methods” to make sure school officials only reach records where they have a legitimate educational interest (34 CFR 99.31(c)). That’s a performance bar, not a spec sheet.
So “FERPA IT compliance” really means building a defensible security program, not checking boxes off a document that doesn’t exist. This guide translates that performance bar into a working checklist. It draws on what “reasonable methods” means in practice, plus a second layer Illinois schools carry that most national FERPA guides skip entirely: the Student Online Personal Protection Act (SOPPA).
SOPPA is Illinois’s own student-data law, and it is more prescriptive than FERPA. Where FERPA says “reasonable,” SOPPA tells you what that has to look like for an Illinois district. Together they set the real technical bar your school’s IT program needs to clear.
Key Takeaways
- FERPA itself has no technical/IT checklist. It requires “reasonable methods” (34 CFR 99.31(c)) to limit access to legitimate educational interests.
- Illinois schools carry a second, sharper standard through SOPPA: security that “meets or exceeds industry standards” (105 ILCS 85/27).
- SPPO enforcement is complaint-driven and funding-based. No institution has ever lost federal funding over a FERPA violation.
- SOPPA enforcement runs through the Illinois Attorney General, a separate and sharper legal path than FERPA’s.
- The PowerSchool breach, roughly 62 million records exposed through one credential with no MFA, is the clearest real-world argument for the checklist below.
What an SPPO Investigation Actually Looks For
FERPA is enforced by the U.S. Department of Education’s Student Privacy Policy Office (SPPO). It doesn’t audit schools proactively. It responds to complaints. Here’s the process:
- A parent, eligible student, or other party files a complaint with SPPO alleging a FERPA violation. 2. SPPO opens an investigation into the school or district named in the complaint. 3. 4.
That funding lever sounds severe, but it has never actually been pulled. It has worked toward voluntary corrective action in every case on record instead. That doesn’t make a finding low-stakes. A finding still creates real legal exposure, reputational damage, and in some cases parental lawsuits, even with no dollar penalty attached.
This is where SOPPA raises the stakes for Illinois schools specifically. It requires districts to implement “reasonable security procedures and practices that meet or exceed industry standards” to protect student data (105 ILCS 85/27). If a breach happens, the school must notify affected parents within 30 calendar days of learning about it. That’s a hard deadline with a real clock, not a vague standard. And SOPPA violations are treated as unlawful practices under Illinois consumer protection law, giving the state Attorney General an enforcement path that runs independently of anything SPPO does.
In practice, that means an Illinois school’s IT program has to satisfy two standards at once: FERPA’s “reasonable methods” test, and SOPPA’s “meets or exceeds industry standards” test. The checklist below is built to cover both.
The FERPA & SOPPA IT Compliance Checklist
Each item below ties back to a specific section of federal or Illinois law. Where FERPA and SOPPA overlap, both citations are listed.
Access Control
FERPA’s core access rule is the “school official” exception. A school may share student records without consent with anyone, staff or a contracted vendor, who has a “legitimate educational interest” in that record (34 CFR 99.31(a)(1)). The catch: schools routinely grant broader access than that interest actually requires. That gap is where most access-control failures start.
What to check:
- Every staff account, substitute account, and volunteer account is scoped to only the records that role’s job actually requires. No blanket admin access “to be safe.”
- Every user, including substitutes and part-time staff, has a unique login. No shared credentials, no generic accounts.
- Access reviews happen on a schedule, not only when someone leaves. Staff who change roles lose the access their old role had.
- Vendor and contractor access is reviewed the same way as staff access, tied to the specific legitimate interest in the contract.
Authentication
FERPA doesn’t name multi-factor authentication (MFA) directly. But “reasonable methods” is hard to argue you’ve met if a single stolen password can unlock a district’s entire student information system.
That breach traced to one support-portal credential. No multi-factor authentication stopped it from reaching the underlying student data. It’s the clearest real-world case for treating MFA as table stakes, not an optional upgrade.
What to check:
- MFA is enabled on every system that touches student records: the student information system (SIS), email, cloud storage, and any vendor portal with access to covered data.
- MFA applies to vendor and support-portal logins, not just staff logins. PowerSchool’s breach ran through a support portal, not a teacher’s laptop.
- Password policies are enforced technically, not just written in a handbook.
- Login attempts and failures are logged somewhere someone actually reviews.
Disclosure Recordkeeping
FERPA requires more than just controlling who can see a record. For most disclosures, schools must document who requested it, who received it, and why (34 CFR 99.32). That record has to be kept alongside the student’s education record for as long as the record itself exists.
This is a real, auditable burden. FERPA doesn’t specify what software to use for it. It just requires that it happens.
What to check:
- A log exists that captures every disclosure request: requester, recipient, and their stated legitimate interest.
- That log is retained alongside the student record it describes, not in a separate system that could be deleted independently.
- The log is something you could actually produce if SPPO opened an investigation tomorrow.
- Staff know which disclosures are exempt from logging (routine directory information, for example) and which aren’t.
Directory Information Controls
Schools can release “directory information,” things like a student’s name or enrollment status, without consent. But only under two conditions: the school gave public notice of what it counts as directory information, and it gave parents a real window to opt out in writing (34 CFR 99.37(a)).
Two mistakes show up constantly here. One: disclosing information the school never formally designated as directory information in its annual notice. Two: releasing directory information for a student whose parent already filed an opt-out.
What to check:
- The annual FERPA rights notice is actually sent every year, not just posted once and forgotten.
- The notice clearly lists what the school designates as directory information.
- Opt-out requests are tracked somewhere systems staff can check before any directory-information release, not just filed in a folder.
- Front-office and communications staff know which fields are directory information and which aren’t, so a yearbook or newsletter request doesn’t accidentally cross an opt-out.
Vendor & EdTech Oversight
FERPA does not require a written agreement with vendors. SOPPA does.
Under 105 ILCS 85/15, an operator needs a signed data privacy agreement (DPA) first. An operator is a vendor whose product is built for K-12 school use. No DPA means no data transfer. That’s the rule.
A valid DPA has to cover specific ground:
- The categories of covered information the vendor will receive.
- A description of the product or service.
- A statement that the vendor acts as a “school official” with a legitimate educational interest under FERPA.
- Who pays for what if a breach happens.
- A concrete deadline for deleting or returning the data once it’s no longer needed.
Districts also publish their signed DPAs so parents can see them. That publishing step is part of the vendor compliance process ISBE oversees.
Operators face restrictions too. They can’t use covered information for targeted advertising. They can’t build student profiles for non-educational purposes, or sell the data (105 ILCS 85/10). They also must delete or return data once it’s no longer needed. A parent’s consent is the only exception.
What to check:
- No vendor receives student data without a signed DPA on file.
- Every DPA names a specific deletion or transfer deadline, not “eventually.”
- Someone owns the job of tracking which vendors have signed DPAs and which haven’t.
- New EdTech tools get vetted against these requirements before a teacher starts using them, not after.
Breach Readiness
FERPA does not set a breach-notification deadline. SOPPA does, and it’s a hard one.
| Notification | Who notifies whom | Deadline | Source |
|---|---|---|---|
| Vendor breach notice | Operator to school | 30 calendar days after the operator determines a breach occurred | 105 ILCS 85/15 |
| Parent breach notice | School to parents | 30 calendar days after the school learns of the breach | 105 ILCS 85/27 |
Those two clocks run separately, not back to back. The vendor’s clock exists so the district still has time on its own 30 days to act.
What to check:
- One person is assigned to track both notification clocks. – Parent-notification templates are drafted in advance, not written during a crisis. – The plan includes a fast way to identify exactly what data was involved.
Backups, Encryption, and Monitoring
FERPA’s reasonable methods standard and SOPPA’s industry-standard requirement point to the same technical baseline. Neither law spells out a specific product or configuration. Both expect a working baseline of security controls underneath everything above.
What to check:
- Backups run on a real schedule and get tested for restore, not just for completion.
- Data is encrypted at rest and in transit, including on vendor systems that touch covered information.
- Security events, failed logins, unusual access patterns, get logged and actually reviewed.
- Staff and classroom devices run current, managed security software.
Governance
None of the above works without someone owning it. SOPPA lets a district name a privacy officer responsible for its data-protection duties (105 ILCS 85/27). That role can be combined with the district’s records custodian position. It doesn’t require a new hire.
What to check:
- A specific person, privacy officer or records custodian, owns FERPA and SOPPA compliance on paper.
- Staff get annual training on access rules, directory information, and how to spot a breach.
- New hires and substitutes get that training before they touch student records, not after.
- The privacy officer reviews vendor DPAs before a new EdTech tool gets approved.
FERPA vs. SOPPA: Side by Side
FERPA and SOPPA overlap, but SOPPA is sharper everywhere it applies.
| Requirement | FERPA (federal) | SOPPA (Illinois) |
|---|---|---|
| Security standard | “Reasonable methods” (34 CFR 99.31(c)), undefined | Security that “meets or exceeds industry standards” (105 ILCS 85/27) |
| Vendor agreement | No mandatory written agreement | Signed DPA required before any data transfer (105 ILCS 85/15) |
| Breach notification | No fixed deadline | 30 calendar days, school to parents (105 ILCS 85/27) |
| Officer designation | Not required | Optional privacy officer role, can combine with records custodian (105 ILCS 85/27) |
See Where You Stand
Not sure where your district’s gaps actually are? The free 2-minute FERPA & SOPPA Risk-Check asks plain-English questions about access controls, vendor agreements, and breach-notification readiness, then gives you a gap list at the end. No sign-up needed to see your result.
Take the free FERPA & SOPPA risk check
Related Guides
Frequently Asked Questions
No. FERPA sets no specific technical requirement like encryption. It requires reasonable methods that limit access to legitimate educational interests (34 CFR 99.31(c)). In practice, encryption is one common way schools meet that standard, and Illinois’s SOPPA law expects security that meets or exceeds industry standards, which functions the same way.
A DPA is a written contract. Illinois schools must sign it with any EdTech vendor before that vendor can receive student data. It has to describe the data involved. It must confirm the vendor is acting as a school official. It also has to assign breach costs and set a deletion timeline. Districts publish their DPAs so parents can see them.
Under SOPPA, an Illinois school has 30 calendar days from learning of a breach to notify affected parents. The notice has to describe what was compromised and give contact information for relevant agencies. Vendors have their own 30-day clock to tell the school first.
Any operator needs a signed DPA before receiving student data. An operator is a vendor whose product is built and marketed for K-12 use. It also must know its product is used mainly for K-12 school purposes. General-purpose tools also used by businesses usually fall outside that definition.
The Student Privacy Policy Office investigates FERPA complaints. It can require corrective action or issue a cease-and-desist order. In theory it can also withhold federal funding. No institution has ever actually lost funding over a FERPA violation. A finding can still create real legal and reputational exposure.
No, not for the operator-facing vendor requirements. SOPPA’s vendor duties are scoped to K-12 school purposes only. FERPA itself does cover colleges and universities separately. So higher-ed institutions still have federal obligations even though SOPPA’s vendor rules don’t reach them.
Let LeadingIT Handle the Technical Side
Running FERPA and SOPPA compliance in-house is a lot to ask of a stretched district IT team. LeadingIT’s school IT compliance services cover the technical side of both laws: scoped access controls, MFA, disclosure logging, and vendor DPA review.
Want our cybersecurity insights first? Add LeadingIT as a preferred source on Google and see more of our guidance in your results.
