You may be surprised by what is lurking in your environment. Applications and extensions may appear and disappear like ghosts as staff rotate and needs change. To help “dig up” these tricksters, review the following list.
- Review your SSO to start your list of all applications in use and compare with your vetted apps list.
- Review the list of extensions in the Google Admin console.
- Use your application management platform to identify apps that have not been vetted.
- Consult technical, purchasing, and finance staff for a list of applications and renewals that are processed.
- Create an application vetting process and discuss with staff. The process should involve a timely response to the requestor so they are encouraged to follow the process.
- Remove the local administrator role from devices so applications cannot be installed without vetting.
- Review the SDPC Resource Registry to determine if the vendor signed the NDPA.
- Ask your technical department to review your outgoing traffic for countries of concern if you aren’t geo-blocking. This may trace to an unauthorized application or extension.
- Ask the vendor what AI they use and how.
- Ensure the vendor has a data retention policy and review their targeted advertising policy.
- If an application that has a data privacy agreement recently added AI features, ask them if they still comply with the signed DPA.
- “Free” applications should be scrutinized even closer as the user is the product.
- Fund raising applications – remind staff these applications require vetting also. If there is a QR code on posters, etc. what data does it capture?
- Implement a software audit process to review applications in use.
- Ask staff for a list of applications they are using or would like to use.
- Before staff attend conferences, remind them of your process for vetting applications – paid or free.
- When applications are no longer used, ask the vendor to delete the data and remove the application from your environment.
- If you restore from a backup, confirm you aren’t restoring information that has been purposely deleted since the backup.
- Conduct training to increase awareness of the risk when using unvetted applications and share the district policy on application and extension usage.
- Reviewing a scary application a day will keep the bad actors away – October 2026 Scary Apps List!
- Join the Missouri Student Privacy Alliance!
Additional Resources: