A charter school network reviews its student-data vendors, filters to CIPA on every Chromebook, locks down device management and trains staff against phishing
A charter school network of 11 campuses in Florida with about 6,500 students and 900 staff, and a two-person central IT team, a leader in its segment.
- Scale
- 11 campuses, ~6,500 students, ~900 staff, ~7,000 managed Chromebooks, 214 apps found, 96 holding student data, 1 phishing simulation program
- Engagement
- One school year: a 6-week vendor inventory, a summer of device and filtering work, then monthly staff training
The challenge
Teachers had adopted learning apps one classroom at a time, and nobody could list which ones held student records. Parents and the charter board were starting to ask, and a state student-privacy law and the school's FERPA obligations require the network to control how vendors use student data. The network also depended on E-rate discounts, so its Internet safety policy and its technology protection measure had to meet the Children's Internet Protection Act. Chromebooks were enrolled unevenly across campuses, and a phishing email that fooled a front-office employee had just exposed a parent mailing list.
What our team delivered
- A student-data inventory built from three sources: the Google Workspace for Education app and OAuth reports, the Chrome extension and web app reports from the admin console, and the DNS logs from each campus. It found 214 apps and extensions in use; 96 touched student names, email addresses, grades or behavior records, and 38 had no active teacher or owner and were retired
- A vendor review for those 96 apps. Each got a short questionnaire on what student data it collects, where it is stored, whether it is sold or used for advertising, how long it is kept, how a deletion request works and who its subprocessors are. Vendors that passed signed a data privacy agreement, using a common model agreement where the vendor already accepted one. The network kept the review as a register with an owner, a renewal date and the legal basis for sharing (the FERPA school official exception, or parental consent for younger students where the vendor's terms required it)
- A simple approval path for teachers: a request form, a five-day answer, a list of approved apps in the Chrome Web Store and Google Workspace allow lists, and student sign-in to third-party apps blocked unless the app is on the list
- Internet filtering that meets CIPA: a technology protection measure that blocks obscene content, child sexual abuse material and material harmful to minors, using DNS and TLS-based filtering at each campus and the same policy on school-owned Chromebooks at home through the device management console. Staff get a lighter policy, as the statute allows for adults, and an authorized person can disable the filter for bona fide research or other lawful purposes. The board's Internet safety policy, the public notice and the education of students about appropriate online behavior stayed the school's own, and we supplied the technical documentation
- Chromebook management cleaned up: every device enrolled in the Google Admin console with forced re-enrollment, sign-in restricted to the school's domain, developer mode blocked, an extension allow list, organizational units by campus and grade band, and an auto-update expiration date tracked for every model so aging devices are replaced on a plan instead of by surprise. Lost-device mode and a remote disable were tested on a real device
- Staff phishing training in 10-minute monthly modules for the 900 staff, with simulated phishing emails that copy what schools actually receive: parent messages, district memos, payroll and benefits notices and shared-document links. A baseline simulation in week 2 gave the starting click rate; a one-click report button in the mail client gave staff a safe action, and the front office and finance staff received extra sessions on payment-change and parent-list requests
- MFA for all staff on the student information system, email and the finance system, with security keys for the two IT administrators, and a written incident plan that says who calls the vendors, the families and the state if student data is exposed
Result
The network can now answer a parent, a board member or an auditor with a register: which apps hold student data, who approved each one and what the agreement says. Every Chromebook is filtered to the same policy on and off campus, and device management is the same on all 11 campuses. The staff click rate on simulated phishing fell from 24% at baseline to 7% after six months, and the report rate rose from 9% to 41%. This is an illustrative engagement and a modeled outcome, not a promise that a school will never suffer an incident.
Get this for your company
Related services with fixed prices and a written scope.
Managed IT and security (MSP)
One monthly price per team member: help desk, device management, patching, backup monitoring and security basics.
Onboarding starts within 10 business days
$100 per team member, per month
Emergency package: security engineer in 1 hour
Is your company in a cybersecurity crisis? Purchase this package and a security engineer will call you within 1 hour.
Callback within 1 hour, 24 hours a day, 365 days a year
$1,950 per incident
Initial assessment of public endpoints
What an attacker can see and reach from the internet: your domains, mail, websites, remote access and cloud exposure.
Report within 5 business days of kickoff
$1,000 per assessment
Show 4 more
Insurance-ready bundle
The three things cyber insurers and clients ask for most: an external assessment, a phishing simulation for 25 users and a disaster recovery plan.
Assessment report in 5 business days; plan draft in 15 business days
$5,400 per bundle, phishing simulation for 25 users
Managed security monitoring
Endpoint detection and response watched by our analysts, priced per device.
Agents deployed within 7 business days
$18 per endpoint, per month
Phishing simulation
A realistic, authorized phishing campaign with short training for anyone who clicks. Priced per person.
Campaign launches within 5 business days of approval
$12 per user, per campaign
Clayton Secure program
One monthly program that bundles monitoring, patching, backups, email protection and security awareness for your whole team. Priced per team member.
Onboarding starts within 10 business days
$150 per team member, per month
After you purchase, we contact you within 1 hour, any time of day or night, to start onboarding.
No payment is taken online. When we call you within the hour we confirm the scope and send an invoice (ACH, card or crypto).
Every sign-in, verified
Staff sign in once, but behind the scenes the device, the identity, a phone approval and your access policy are all checked before any app opens, and strangers are turned away.
Separate by region and by business unit
Each business unit lives in its own VRF and VLAN in every region, so a problem in retail cannot reach finance. Traffic between units has to pass a firewall that denies by default and allows only what is written down.
Super Intelligence data flow
Every request is classified by sensitivity, so confidential data stays on models inside your walls while routine work can use the best frontier AI.
The evidence pack and who asks for what
Twelve artefacts a firm can show about its AI use, and the party that most often asks for each: an insurer at renewal, an auditor or client questionnaire, or a regulator. A typical pattern only; the exact list depends on the policy, framework and sector.
Facing something similar?
Tell us about your environment. We will tell you plainly what we would do and what it would take.