What category of obligation this is
FERPA, the Family Educational Rights and Privacy Act, is a U.S. federal privacy law about education records: who may see them, and the rights students or parents have in that disclosure framework. Security staff meet it when a school shares, logs, or asks a vendor to host student data.
It is not a cybersecurity certification. A control list, a scanner report, or a vendor badge does not finish the obligation. This page does not teach exception lists as homework, and it does not award a badge to any named product.
Funding and relationship decide the frame
The Department of Education's Student Privacy Policy Office says FERPA applies to educational agencies or institutions that receive funds from programs administered by the U.S. Department of Education. By educational agencies or institutions, that FAQ means public schools, school districts (local educational agencies), and postsecondary institutions such as colleges and universities.
The same FAQ says private and parochial schools at the elementary and secondary level generally do not receive such funding and are therefore not subject to FERPA. Read the "generally." The question is funding and relationship, not the vibe of a campus. A university research dataset is not automatically inside FERPA, and it is not automatically outside, just because someone called the file research.
Education records are not the whole network
Student-related data on a school network is a wide set. An education record is a narrower care category: identifiable student information the institution maintains as part of the educational relationship. A public syllabus, a lab safety poster, and a named gradebook export are not the same object.
Removing a name column does not, by itself, make a spreadsheet fine to forward. Other fields and combinations can still identify a student. The education path already practices that point in "classify before sharing."
Security habits next to the rule, without a verdict
Classify before you share. The education module with that name separates approved public teaching material from identifiable records. Joiner and leaver cycles matter because class groups and vendor accounts outlive the term. Vendor access to education records needs an owner and a review date. None of those habits is a determination that FERPA applies, or that a vendor badge settles it.
Monitoring and minimization can pull apart: a security log may want detail that a privacy limit does not want copied. That tension is the privacy-versus-security lesson. Follow it for the boundary habit. Do not look there for a FERPA dump.
The CISA K-12 report on the education standards panel is guidance for prioritization. Following it is not a FERPA certification.
Who to ask
Ask the records owner, the privacy officer, and qualified counsel whether a file is an education record and whether this institution receives Department of Education funds. Atlas can repeat the FAQ's coverage sentence. It cannot elect directory information, list exceptions, or bless a vendor.
Claims to retire
All student-related data, everywhere, is FERPA.
FERPA is about education records at agencies and institutions that receive Department of Education program funds. A file that mentions a student is not automatically that category, and a private elementary school is not automatically in the FAQ's funded set.
Delete the name column and the spreadsheet is fine to share.
Dropping one identifier does not show the remaining fields are safe to publish. The education path's workshop exercise already treats that as a failed release decision.
The CISA K-12 report certifies FERPA.
The education standards panel labels that report as guidance. It is not a FERPA certification.
A university research dataset is automatically FERPA, or automatically not.
Research is not a magic label. Whether student education records are in the file, and whether the institution is in the funded set, are questions for the records owner and counsel.
Sort three synthetic files
Teaching sort only. It does not decide that a real campus is covered, and it does not elect directory information.
| File | Care category | Why this page stops there |
|---|---|---|
| Identifiable gradebook export | Likely education-record care needed | Names tied to assessment results are the file you do not publish from a shared folder. Care is not the same sentence as "the institution is covered" or "the export is compliant." |
| Public syllabus | Public teaching material | A syllabus written for the course site is teaching material, not a student record. Confirm the copy in front of you is the public one. |
| Directory-style public flyer | Ask the records owner | A flyer of student names looks public and may still be an education-record question. This page does not teach directory-information elections. The records owner answers. |
CHECK THE CATEGORY
A workshop folder holds three synthetic files. Which sorting matches the care categories on this page?
Glossary and nearby pages
Use the agency page in the sources for the authoritative text. This page has no figure.