The North Carolina National Guard will help the state Department of Public Instruction conduct security assessments of certain virtual programs used by schools. The State Board of Education held a special meeting Monday to review its contracts with PowerSchool.
"(This) is something new for us to ask the North Carolina National Guard to review a vendor," said Vanessa Wren, chief information officer at Department of Public Instruction.
PowerSchool is the largest provider of cloud-based education software for K-12 schools in the U.S., according to its website. School districts use PowerSchool to track student enrollment, attendance, and other data, according to previous WUNC reporting.
In January, the company suffered a "global breach" that involved decades worth of data from hundreds of school districts in the U.S. and other countries. The breach in PowerSchool's Student Information System exposed Social Security numbers of about 312,000 North Carolina teachers and around 900 K-12 students.
In May, another breach happened, with "threat actors" reaching out to affected school systems in North Carolina to demand ransom for the data. About 20 local education agencies received ransom emails.
North Carolina's contract with PowerSchool's Student Information System is expiring on June 30 and will not be renewed.
"We are working with PowerSchool on data transfer and destruction of data, which is ongoing for the next several months," said Wren.
On Monday, the State Board of Education voted in favor of six month contracts with PowerSchool for use of two products: SchoolSpring Job Board, an applicant tracking service used to hire educators, and the NC Educator Evaluation System.
"These two products, I think its important to note, are separate and apart from the Student Information System," said Wren.
These contracts were approved under the condition that certain security measures are met, including assessments by the North Carolina National Guard.
In addition, PowerSchool must provide the following documentation by Sept. 1: a third party penetration test conducted post-cyber incident, a full forensic report with a list of all the mitigations put in place, and a SOC 2 Type II report, a specialized cyber audit.
"After we have that delivery, we will review those and we will notify PowerSchool of any changes they must make within five days," said Wren.
Beginning July 1, North Carolina schools will transition to a new Student Information System powered by a platform known as Infinite Campus.
