FERPA Compliance for Wisconsin Schools: What Your IT Company Should Be Doing (And Probably Isn't)

A Wisconsin school district discovered that an unauthorized user had been accessing student records for six months before anyone noticed. The breach wasn't caught by an alert. A teacher mentioned something odd to an IT contact. By then, the exposure was extensive — and the district had to notify hundreds of families.

That district had an IT company. The IT company just wasn't doing the right things.

FERPA compliance isn't a policy problem. It's an IT infrastructure problem. And most school IT setups in Wisconsin have significant gaps that leave student data exposed — right now, today.

What FERPA Actually Requires from Your IT Setup

The Family Educational Rights and Privacy Act protects the privacy of student education records. Schools that receive federal funding — which is nearly every K-12 school in Wisconsin — must comply. Violations aren't theoretical: they can trigger loss of federal funding, mandatory breach reporting to the Department of Education, and the kind of parent trust collapse that takes years to rebuild.

FERPA compliance isn't a checkbox you hand to your principal and file away. It requires your IT infrastructure to actively protect student records — through access controls, encryption, audit logging, and vendor agreements. If your IT company hasn't talked to you about any of these, that's the problem.

5 FERPA IT Risks Most Wisconsin School Setups Have Right Now

Most school IT environments weren't built with FERPA in mind. They were built to get teachers and students online. These are the five most common gaps we see when we assess school IT in Wisconsin.

1. No network segmentation between administrative and student systems. Your student records system — the one with names, addresses, IDs, grades, disciplinary records — should live on a completely separate network segment from the student WiFi. When they share the same network, a compromised student device can potentially reach administrative systems. Most school networks we assess don't have this separation in place.

2. Shared passwords for student record access. When multiple staff members share a single login to access student information systems, you have no way to know who accessed what or when. FERPA requires the ability to audit access. Shared credentials make that impossible. Every person who touches student records needs their own account with individual audit trails.

3. No encryption on devices that carry student data. A teacher's laptop with a gradebook or student IEPs on it is a FERPA liability if it's not encrypted. A lost or stolen unencrypted device is a reportable breach. Full-disk encryption is not optional — it's a basic protection that most schools haven't deployed consistently across all staff devices.

4. Unauthorized cloud apps storing student information. A teacher signs up for a free online quiz platform. A school counselor uses a cloud note-taking app to track student sessions. These apps may be storing student data on third-party servers — and the school has no signed agreement establishing the vendor as a "school official" under FERPA. Any cloud tool that handles student information must have a signed data privacy agreement on file. Most schools don't have these.

5. No audit logs showing who accessed what. If you can't answer the question "who accessed this student's record on this date," you're not FERPA-compliant. Audit logging means your systems record every access to student data — the account, the timestamp, the action. When something goes wrong, audit logs are how you reconstruct the timeline and demonstrate to regulators that you had controls in place.

What a FERPA-Aligned IT Setup Looks Like

What to Look for in an IT Company if You're a School

Not every IT company is equipped to serve schools. When you're evaluating IT partners for your district, ask these questions directly:

"Have you worked with schools and do you understand FERPA requirements?" "Can you implement network segmentation between our student-facing and administrative networks?" "Do you provide device encryption management and endpoint monitoring?" "Will you help us audit our cloud tool vendors and establish data privacy agreements?" "Can you provide audit logs showing access to our student information systems?"

A general IT company that supports small businesses is not the same as an IT partner who understands education compliance. The requirements are different. The stakes — federal funding, regulatory action, family trust — are different.

How IDN Supports Wisconsin Schools

IDN designed and implemented network infrastructure for all Wisconsin HOPE Schools locations. These are modern, education-appropriate networks built to support learning environments — with the segmentation, access controls, and reliability that school IT requires.

We understand how schools operate. We know that teachers don't think about network segmentation, but they do put student data in cloud apps without asking IT. We know that IT directors at school districts are often managing everything from student devices to the boiler room WiFi. We know that budget constraints are real — and that E-Rate funding exists to help schools pay for eligible IT services. IDN works within E-Rate funded projects.

When IDN assesses a school's IT environment, we look specifically at student data security exposure. You'll walk away knowing exactly where your FERPA risk is — not in vague terms, but specifically: these devices aren't encrypted, this system doesn't have audit logging, these three cloud tools don't have signed agreements. That's actionable. That's what you need to take to your administration and your board.