Security & Compliance Support

We help programs protect the sensitive data they hold.

Start a conversation Or call (718) 540-8268

Close-up of a hand resting on a laptop trackpad beside a printed checklist of empty tick boxes.

Programs that handle student records and health information have specific obligations for that data, and auditors ask for documentation.

We help organizations align their technology practices with the frameworks that govern their data: access policies, incident planning, and the records an oversight body will ask for, written in plain English. The aim is a small set of controls your team follows day to day.

We work with student records and health information every week.

Our own programs use student records and health-related information every week, so we treat data obligations as a core part of the work. In practice, access is role-based, logged, and reviewed. Data-handling decisions are written down. Vendors that touch sensitive data are held to the same standard as staff. And your team can explain the security setup without relying on the vendor.

Server hardware with security indicator lights

Practical safeguards your staff can follow

We start with the controls that reduce the most risk with the least disruption to the program, and we write policies in language the people who follow them can read. We review vendor and third-party access as closely as staff access, because gaps are common there.

Data-handling and access reviews across systems and staff: We look at how data is stored, who can reach it and where it moves, then surface the gaps that matter before they become an incident or an audit finding.
Alignment with applicable frameworks (FERPA, HIPAA awareness): Practice is matched to the obligations that govern the data you hold, such as student records and health-related information.
Sensible access policies: least-privilege, MFA, logging: The first fixes are the controls that cut the most risk for the least disruption: staff reach only what their role needs, sign-ins are verified and access is recorded.
Incident-response planning and tabletop walkthroughs: A written plan matched to your systems is rehearsed with the people who would run it, so a real incident gets a fast, documented and familiar response.
Plain-English security policies staff can follow: Policies are kept to a small set of controls and written without security jargon, so the people who have to follow them can read them.
Vendor and third-party access review: For each vendor we check what data it can reach, how its access is granted and revoked, and whether its practices match what your obligations require.
Staff security-awareness training in plain language: Sessions use real examples of phishing and data-handling mistakes relevant to your program, so staff recognize them in day-to-day work.

Who it’s for

Programs handling student records
Health-adjacent data holders
Teams prepping for review
Grant & contract compliance
Programs onboarding new vendors or tools

How a security engagement works

Pick any part of the sentence to see the detail.

First, review what you have. Then fix the basics first. Next, document for the auditor. After that, train staff. Finally, practice the response.

We look at how data is stored, who can reach it, and where it moves (including third-party vendors), and identify gaps before they lead to an incident or an audit finding.

Common questions

Which frameworks do you work with?

We focus on the obligations that govern the data in front of us (FERPA for student records and HIPAA-aware handling for health-related information are the common ones in our work), plus widely recognized security practices. We align your practices with the frameworks that apply to you instead of using one generic checklist.

We're a small program. Is this overkill?

No. We size the work to the program. A small program doesn't need an enterprise security program; it needs the few controls that reduce its risk and the documentation to show them. We scope the work to what your data sensitivity and obligations require.

Can you help us prepare for an audit or review?

Yes. We assemble the access reviews, data-handling documentation, and policies an oversight body typically asks for, and we walk your team through what they'll be asked, so they are prepared before the review starts.

What happens if something goes wrong?

That's what incident-response planning is for. We help you write a plan matched to your systems and rehearse it in a tabletop walkthrough, so if an incident happens the response is fast, documented, and already understood by the people who have to run it.

Do you cover the vendors and third-party tools we use, not just our own systems?

Yes. Third-party access is one of the most common sources of security gaps. We review what data a vendor can reach, how their access is granted and removed, and whether their own practices meet your obligations. We check this directly instead of relying on the vendor's own claims.

How do you train staff without it turning into a check-the-box exercise?

We keep it specific and in plain language, using examples of phishing and data-handling mistakes relevant to your program. We measure success by whether staff behavior changes, not by completion records.

Still have a question? Call (718) 540-8268, or see the technology solutions overview.

If a review is coming and your documentation is incomplete

We still have live accounts for people who left years ago, and an auditor will find them.: This is a recurring finding in State Comptroller audits of school district IT: no written procedure for adding and disabling accounts, unneeded accounts left active, and more access than the job requires. It is also the cheapest gap to close. An access review is where we start.
Our vendors hold more student data than we do, and I can't prove what they do with it.: Under Education Law 2-d, a contract that shares student data with a vendor must carry data privacy terms and the parents bill of rights, and the vendor must notify you of a breach. List every tool that receives student data and check each for that agreement. We review vendor access as closely as staff access.
If we had an incident tomorrow, nobody knows who to call or what we have to report.: New York now requires many public entities, school districts among them, to report a cybersecurity incident to the state within 72 hours, so the clock belongs in the plan. We help write a response plan matched to your systems and rehearse it in a tabletop walkthrough. A call is a reasonable first step.

Have this ready when you call