4 Factors of Third-Party Risk Management for School Districts

The use of technology in schools has increased in recent years, making cyberattacks on K-12 schools more common, as groups with sinister names like BlackCat and Darklord are terrorizing school districts, targeting student information. These cybercriminals hack into district networks and demand hundreds of thousands of dollars in ransom payments, threatening severe consequences if the schools don't pay.

According to the K12 Security Information Exchange, 1,330 attacks have been publicly disclosed since 2016. These aren't just happening in large districts, but in schools of all sizes. The source of these attacks? According to the study, 75% of them stemmed from the third-party IT companies that supply schools with support. 

A prime example is last year's data breach at software company Illuminate Education that affected thousands of current and former students in New York City, Colorado, Los Angeles, and other school districts. Illuminate Education says it serves 5,200 schools and districts across the U.S. That's a lot of personal information at risk from a third-party breach! 

To take action, district leaders are moving to address internal security and fortify their networks. But that's just the first step. An effective third-party risk management strategy is essential to prevent hacking, manage risk, and oversee resources.

What Is Third-Party Risk Management?

4 Factors for Starting a Third-Party Risk Management Program at Your School District

Your school district most likely has some existing policies and procedures about vetting vendors and purchasing. These are good starting points for crafting a formal TPRM program. But beyond a policy, creating an effective TPRM program requires several factors.

1. Obtain third-party risk management program buy-in and support from leadership. This might be tough in a large and complex school district where legal, IT, and purchasing departments are siloed and not used to sharing information. For smaller school districts, it might be easier to share information but harder to get the resources necessary to support your TPRM program. No matter how big or small your school district may be, having an agreed-upon vision for a third-party risk management framework is essential.
   
   Tip: Implementing TPRM can be difficult without the support of your school board or administration. As you speak with your school's administration, keep these things in mind: 
   
   
   • Emphasize the importance of keeping students safe. Keeping their data protected and minimizing disruptions to their education is essential.
     
   • Explain the advantages of TPRM. How will this benefit your school district, the board, and the administrative officials?
     
   • Be aware of the challenges associated with TPRM. Determine what is most important by asking other departments about their pain points.
     
   • Provide an explanation of the damage and costs incurred because of a third-party data breach. Cybersecurity breaches can damage your reputation, result in regulatory fines, and increase the cost of your cybersecurity insurance. Cyber breaches aren't the only cybersecurity concern. Ransomware attacks, for instance, are also on the rise.
2. Establish the TPRM framework. The third-party risk management framework includes policies, procedures, and tools for identifying, assessing, and addressing risks associated with third parties. The framework should incorporate all the requirements, rules, tools, processes, roles, and responsibilities for executing TPRM. The following is a brief overview of the documentation created to help with establishing the TPRM framework:
   • Policy – Your policy should be written at the board level; it sets the tone-from-the-top. It's the basic framework for how third-party risk management is handled within your school district. 
   • Program – Your program document describes the policy concepts in more detail. It lays out what your administration and departments need to know to manage third parties. 
   • Procedures – The procedures are a step-by-step guide for executing TPRM.
3. Create a vendor inventory. You must identify a complete inventory of your school district’s third parties. Dig deep; don't just stop at your known third parties. Look for any legal entities or individuals paid to provide goods or services to your district. Your accounts payable department is probably the best place to get a complete list of your school district's third parties and vendors. Generally, third parties that provide a tangible product or service, you have a written agreement or service-level agreement with, or have invoices for, would be included in your TPRM program. Third parties like public utilities, government entities, donors, and payee relationships would be out of scope.
4. Follow the third-party risk management lifecycle. The third-party risk management lifecycle was originally designed by regulators but has now become a best practice across all industries. A vendor lifecycle is a perfect roadmap for guiding your school district through all the activities and steps necessary to manage vendor relationships effectively, including onboarding, ongoing monitoring, and offboarding vendors.

Consider Leveraging TPRM Technology for Your School District

Building a TPRM program can be challenging, especially if your school district is under-resourced. A TPRM software solution can significantly reduce the time and staffing required to implement and manage a successful TPRM program. Starting from scratch and using manual processes such as spreadsheets and homegrown databases can result in slow processes and time spent correcting administrative errors. From building TPRM frameworks to managing the vendor management lifecycle, a TPRM software solution can help your organization through every step.

With TPRM technology, you can create a central document repository to store information like:

• Request for proposals (RFPs): Store all of your RFPs in one place for quick review and comparison.
• Contracts: Using a software, you could store and track all your contracts in one place, making it easy to monitor which contracts should be reviewed for renewal or termination.
• Vendor risk rankings: Monitor the risks each vendor poses to your school district.
• Vendor assessments: Avoid tracking all your assessments and responses in multiple Excel spreadsheets. A software offers one place to track where each assessment is in the process.
• Vendor performance data: Quickly check how your vendors are performing against your standards in one place. 

You can easily manage your contracts and set up reminders for key dates, such as performance milestones and contract renewals. Additionally, TPRM software streamlines the process of monitoring vendors and taking corrective action if necessary.

Unfortunately, kids and their data are not off limits for cybercriminals, and K-12 school districts have increasingly become targets. As school districts begin mobilizing to increase their internal cybersecurity, they shouldn't neglect those third-party relationships that leave the doors open for cyberattacks when left unattended. Third-party risk management is an essential practice and process for today's school districts to protect student data.