FERPA student record access monitoring — SIS and LMS coverage

FERPA (Family Educational Rights and Privacy Act, 20 U.S.C. § 1232g) protects the privacy of student education records at institutions receiving federal funding. While FERPA is primarily a privacy law rather than a cybersecurity regulation, it creates cybersecurity obligations by prohibiting unauthorised disclosure of education records. Institutions must implement technical safeguards to prevent unauthorised access and demonstrate appropriate data governance.

ManySignal integrates with Student Information Systems (Ellucian Banner, Colleague, PowerSchool, Infinite Campus) and monitors access event metadata — who accessed which student records, when, from what device, and from what IP. It baselines each staff member's normal access scope (their assigned students, department, and role) and flags access to records outside this baseline — a common indicator of FERPA violation.

FERPA does not have an explicit breach notification requirement to individuals — unlike HIPAA. However, the Department of Education requires institutions to notify ED if a breach results in unauthorised disclosure of education records. Institutions may also face state breach notification obligations if student SSNs or financial aid data are involved (which triggers separate state law obligations). ManySignal's case management tracks these overlapping notification obligations.

FERPA allows access to education records by school officials with a 'legitimate educational interest.' ManySignal operationalises this standard by baselining each staff member's role-appropriate access and flagging access that appears to fall outside their legitimate interest — e.g., an admissions officer accessing financial aid disbursement records, or a facilities staff member accessing grade records.

Yes. ManySignal integrates with Canvas (via Canvas API audit events) and Blackboard (via activity report API) to monitor instructor and administrator access to student course data, grade submissions, and assignment submissions. Bulk access to student submissions or grades outside of grading periods triggers anomaly alerts relevant to FERPA's access control requirements.