Access for Learning (A4L), the umbrella of the Student Data Privacy Consortium (SDPC), has developed the Global Education Security Standard (GESS).
GESS is not a new “standard” but a crosswalk of current standards that pulls out the applicable privacy and security controls pertinent to PK20 education. The goal is to provide educational institutions with concise assurance that the vendor/product is meeting the educational cybersecurity and privacy requirements. By following and becoming certified in GESS, it will streamline the providers’ ability to implement required security controls while at the same time meeting school expectations across jurisdictions, all with one common set of controls.
The crosswalk includes NIST 800-53 and 800-171 Revision 2, and Critical Security Controls (CIS) v8. The Security category has 12 sections, and the Privacy category has 3 sections.
The vendor will complete the online self-assessment tool which includes three main categories – Company and Product Detail, Security, and Privacy. The standard is assessed against a product and not just the vendor. The assessment tool can also be downloaded into an Excel spreadsheet. Each question has a Status option of fully implemented, partially implemented, not implemented, or not applicable. Notes and a Link to Evidence column are also available.
The following categories are presented in the GESS controls: Governance, Personnel, Supply Chain, Asset & Risk Management, Access Control, Platform Security, Data Security, Detect & Respond, Privacy, Safeguarding, Product Information, and Product Functionality. To view the control sets go to https://sdpc.a4l.org/gess/gess_standards.php and the ability to filter controls across frameworks, jurisdiction and control set is available.
The National Data Privacy Agreement v 2.0 has included GESS in the Exhibit F as an applicable standard for selection.
When talking to vendors, please direct them to the webpage below to share this information.
For more information, you can go to: https://privacy.a4l.org/gess/