1. Data Security and Privacy Overview: NJDOE’s Approach to Cybersecurity
Update to the State Board of Education
March 1, 2017
Script:
Introduce yourself, quickly move to next slide.

2. NJDOE’s Approach to Cybersecurity
The New Jersey Department of Education (NJDOE) is required by law to collect and store student and educator records. The NJDOE takes seriously its obligation to secure information systems and protect the privacy of all data that is collected, used, shared and stored by the NJDOE.
Data Security: Implementation of safeguards to ensure data is protected from unauthorized access, use, intrusion or modification.
Ex: Firewalls, Encryption, Back Ups
Data Privacy: Appropriate use and access of data by individuals or groups to ensure behaviors are followed to protect data.
Ex: Authorized access controls, view/share/edit privileges
Security + Privacy = Strong Cybersecurity

3. NJDOE’s Strong Data Security and Privacy Structure
Through statutory and regulatory provisions, as well as State agency partnerships, the NJDOE layers safeguards to protect data.
State Regulation in N.J.A.C 6A:32-7 (LEA)
NJDOE Security and Privacy Policy
6A: General considerations
6A: School contact directory for official use
6A: Mandated student records
6A: Maintenance and security of student records
6A: Access to student records
6A: Conditions for access to student records
6A: Rights of appeal for parents and adult students
6A: Retention and disposal of student records
Provides accountability framework for:
Internal use/access of data
External use, disclosure, and destruction of data
Incident response protocols
Data governance program
Staff Training
Adhering to federal laws (FERPA, etc)
State Agency Partnership of Shared Security
The New Jersey Department of Education (NJDOE) Network Services team provides security with support from the New Jersey Office of Information Technology (NJOIT) and the New Jersey Department of Homeland Security and Preparedness (NJOHSP) to provide the necessary safeguards to protect education information and data from intrusion, modification, disruption and/or destruction. In partnership we provide information, analysis, and incident reporting internally and among the security agencies.
NJOHSP
NJOIT
NJDOE

4. Data Management Committee Data Stewards
NJDOE’s Data Governance Program
The NJDOE’s Data Governance Program provides an organizational approach to data and information management through a system of decision rights, accountabilities, and processes that help ensure the appropriate access, awareness, and accuracy of our data.
Data
Council
Data Management Committee
Data Stewards
Approve governance & data policies
Assign resources to support governance program
Hold all staff accountable for adhering to policy
Resolve issues escalated by the Data Management Committee
Approve data elements 
Prioritize, resolve & escalate data issues as needed
Establish agency-wide standards, processes & procedures for data collection, reporting & release
Assign Data Stewards
Service data needs of their program area/office
Identify critical data issues & possible resolutions from their program area/office
Propose standards, process & procedural improvements
Ensure data quality & appropriate use

5. Resources for the Education Community
The NJDOE’s policies align with federal law and best practices to ensure the privacy of our student data
Family Educational Rights and Privacy Act (FERPA):
Overview, FAQ, and Complaint Filing - FERPA
Children’s Online Privacy Protection Rule (COPPA):
Rule, Federal Register, and Related Documents - COPPA
Protection of Pupil Rights Amendment (PPRA):
Overview and Further Resources - PPRA
Privacy Technical Assistance Center (PTAC):
Resources for Education Stakeholders to Learn About Data Security and Privacy - PTAC

6. Questions?