Private Schools

What arrives

PCI DSS: PCI DSS v4.x. The standard applies to every merchant that stores, processes or transmits cardholder data, tuition and donation card payments among them.; Source
201 CMR 17.00 (Massachusetts): 201 CMR 17.03. Every person, corporations and associations included, that owns or licenses personal information about a Massachusetts resident maintains a comprehensive information security program.; Source
The sample notice (California): California Civil Code 1798.82(f). A single sample copy of any breach notice sent to more than 500 California residents, submitted electronically to the Attorney General.; Source
The edtech vendor's program: COPPA, 16 CFR 312.8(b). An operator collecting personal information from children under 13 keeps a written information security program, with risks assessed at least annually.; Source
The CIPA certification: Children's Internet Protection Act, 47 CFR 54.520. For a nonprofit school taking E-Rate discounts, certification on FCC Form 471 that an internet safety policy is enforced.; Source