ISO 27001 in education: why schools and institutions are certifying now

On 23 December 2019, a ransomware attack brought Maastricht University to a near standstill: email, research data and student systems were unavailable for days. Almost seven years later, education is still high on the target list. Schools, vocational colleges, universities of applied sciences and research universities hold sensitive data on minors and young adults, work with hundreds of suppliers and rarely have a large security team. October, the European Cybersecurity Month, is therefore a good moment for the question more and more school boards are asking themselves: is ISO 27001 certification the logical next step for us?

Why education is an attractive target

A combination of factors makes education vulnerable:

A lot of sensitive data. Pupil and student records contain not only names and addresses, but also grades, absence records, support files and sometimes medical information. Much of it concerns minors, which is why the GDPR demands extra care. The Dutch Data Protection Authority (Autoriteit Persoonsgegevens) supervises this.

An open culture. Education is about sharing and collaborating. Teachers, pupils and guest users log in from their own devices, at home and at school.

A long supply chain. Pupil tracking systems, assessment platforms, digital learning materials, timetabling software: the average school board works with dozens to hundreds of suppliers that have access to personal data.

Limited capacity. In primary and secondary education in particular, the IT function is often small or outsourced. Security is one of many tasks.

Ransomware incidents at Dutch schools and universities in recent years show the impact: cancelled lessons, postponed exams and personal data ending up in the wrong hands.

Which frameworks already apply?

Education does not start from scratch. Sector frameworks exist that are largely based on ISO 27001 and ISO 27002.

Primary and secondary education

Primary and secondary schools in the Netherlands follow the Information Security and Privacy Framework (Normenkader IBP), a collaboration between the Ministry of Education (OCW), the primary and secondary school councils (PO-Raad and VO-raad), SIVON and Kennisnet, the public ICT organisation for education. The framework works with maturity levels and a growth path, with level 3 as the target level for school boards. The controls align closely with ISO 27001 and ISO 27002.

Vocational and higher education

For vocational and higher education a comparable Normenkader IBP exists, developed by SURF, the ICT cooperative of Dutch education and research institutions, together with Kennisnet and the sector councils. Institutions assess themselves through SURFaudit, with an annual benchmark that shows how the sector is doing. This assessment framework is also modelled on ISO 27001 and ISO 27002.

Legislation

On top of the sector frameworks sits the GDPR, which imposes particularly strict requirements on the data of minors. Educational institutions as a sector do not fall under the Dutch Cybersecurity Act (Cbw), but research organisations can fall within its scope. Universities and institutions that provide research or other designated services alongside education would be wise to check, per unit, whether the Cbw applies to them.

Anyone who applies the Normenkader IBP seriously therefore already has a large part of an ISO 27001 management system in place. The difference lies in demonstrability: a certificate from an independent certification body.

Why certify, rather than merely comply?

A self-assessment against the framework is valuable, but it remains a self-declaration. Certification adds four things:

External demonstrability. Parents, students, the Inspectorate of Education, municipalities and partnerships increasingly ask how a board has organised its information security. A certificate answers that question without lengthy explanations.

Suppliers and tenders. Edtech suppliers and education service providers are increasingly asked for ISO 27001 in tenders and data processing agreements. A board that is certified itself can credibly impose that requirement on its own supply chain.

Board accountability. The board bears ultimate responsibility for protecting pupil and student data. A certified ISMS gives the board a fixed cycle of risk assessment, controls, internal audit and management review with which it demonstrably fulfils that responsibility.

One common framework. ISO 27001 is the shared foundation beneath the Normenkader IBP, SURFaudit and the GDPR obligations. One management system instead of separate lists per framework.

Implementing ISO 27001 in education: how to approach it

The route to certification is broadly the same for every organisation; we described it earlier in 10 steps to certification. For educational institutions, the following points deserve extra attention:

1.Define the scope at board level. Include the board office and all schools or locations. A scope covering only the board office says little about where pupil data is actually processed.

2.Focus the risk assessment on educational processes. Pupil tracking systems, digital assessment, grade administration, BYOD for teachers and pupils, cloud services and the transfer of files between schools.

3.Record the division of roles. The data protection officer (DPO), a security officer or IBP coordinator, the IT partner and the school leaders each have their own role. Make these explicit, even when IT is outsourced.

4.Invest in awareness for teachers. Phishing, weak passwords and unintentionally sharing files are common causes of incidents in education. Short, repeated training works better than a single annual session.

5.Organise supplier management. Keep an up-to-date register of suppliers, data processing agreements and assessments. Use the sector's model agreements where possible.

6.Set up an incident process. Who assesses a data breach, who notifies the Data Protection Authority and who informs parents or students? Rehearse this in advance, not during the incident.

How uComply helps

A school board with several schools wants one management system, but also a clean separation per school. With Business Units you set up a dedicated workspace per school for risks, incidents and assets within one uComply environment, while the board keeps the overall picture and the standards and controls remain shared.

Alongside ISO 27001 you add the Normenkader IBP as a custom standard. You manage each control once and link it to multiple requirements, so the same evidence demonstrates both the framework and ISO 27001. The gap analysis shows what is still missing.

Because almost every educational institution works in Microsoft 365, uComply fits in seamlessly: the application runs entirely within your own Microsoft 365 environment and your data never leaves your organisation. Through the Flightdeck dashboard the board sees progress per standard and open risks at a glance.

Smaller boards without their own IT capacity can start immediately with uComply SaaS and move to their own tenant later. All the work moves with them.

Summary

Education processes sensitive data on minors, works with a long chain of suppliers and is a proven target for ransomware. The sector frameworks, the Normenkader IBP and SURFaudit, are already based on ISO 27001. Certification turns a self-declaration into independently demonstrated control, towards parents, students, the inspectorate, municipalities and suppliers.

Would you like to see how uComply sets up ISO 27001 and the Normenkader IBP in one environment for your board or institution? Book a no-obligation demo or view our pricing.