Managed IT Services for Schools & Educational Institutions
IT for private schools, tutoring centres, training providers and early-learning programs: student records, shared devices, and parents who get targeted by phishing. This page covers which privacy rules apply, how to run shared and lab devices, and what to ask of a provider.
Student records and which privacy law applies
Student records include names, dates of birth, grades, health and accommodation notes, and family contact details. Which law governs them depends on who you are. Ontario school boards are institutions under the Municipal Freedom of Information and Protection of Privacy Act (MFIPPA), overseen by the Information and Privacy Commissioner of Ontario. Private schools, tutoring companies and training businesses are generally assessed under PIPEDA for their commercial activity.
Either way the practical duties look alike: collect only what you need, limit who can see it, protect it properly, and know what to do if it leaks. Health information about a student can bring in further obligations. This page is practical guidance, not legal advice; confirm how the law applies to your organization with counsel.
Shared, lab and classroom devices
Shared devices are where school IT goes wrong. Students sign in to a lab PC and stay signed in to email; a teacher's laptop holds a spreadsheet of grades; nobody knows which tablets still get updates.
Use device management so every school-owned laptop, tablet and lab PC is enrolled, encrypted, patched and wipeable. Lab and library PCs should reset to a clean state between sessions and never store student files locally. Staff devices that hold records need encryption, a short screen lock and multi-factor sign-in. Our device compliance baseline lists the settings.
Phishing aimed at parents and staff
Schools send parents a lot of email about fees, trips and forms, which trains parents to click. Attackers copy that: a fake "fee overdue" notice with a payment link, or a spoofed message from the principal asking a staff member to buy gift cards.
Publish DMARC at enforcement so nobody can send mail as your domain, tell parents once a term that you never change payment details by email, and send payment links only through your parent portal. Protect the portal's admin accounts with multi-factor sign-in, because a taken-over portal account reaches every family at once.
Accounts for students, staff and contractors
Student accounts should be created and removed from the enrolment list, not by hand. Teachers on contract, coaches and tutors get accounts with an end date. Admin rights stay with a small number of separate administrator accounts, never a teacher's everyday login (privileged admin accounts).
Review once a term who can open student records and who still has an account after leaving. It takes an hour and catches most problems.
What parents, accreditors and insurers ask
Expect questions on where student data is stored, who can access it, whether backups are tested, and what happens in a breach. Cyber insurers add multi-factor sign-in and endpoint protection.
A one-page written answer, backed by what is configured, covers most requests. The Cyber Centre's baseline controls are a sensible framework to report against. Before you talk to any provider, test your domain with our email spoofing check and work through the printable IT risk self-check.
Where to start this month
If you only do four things this month, do these, in this order. Each is cheap and each closes a gap we see often in this sector.
1.
Turn on multi-factor sign-in for every staff account and the parent-portal admins.
2.
Enrol every school-owned device in management and confirm encryption is on.
3.
Move DMARC to enforcement and tell parents how you will (and will not) ask for payment.
4.
Restore one student-records file from backup and time it.
Questions schools ask
MFIPPA covers school boards and other municipal institutions. Private schools are usually looked at under PIPEDA for commercial activity. Ask counsel how the rules apply to your school.
Enrol them in device management, reset them between sessions, block local file storage and keep them patched. Treat them as untrusted.
Either can work. What matters is that accounts come from the enrolment list, are removed on departure and are protected by sensible sharing settings.
If it was encrypted and managed, wipe it remotely and record the incident. If not, treat it as a possible privacy breach and get advice on notification.
Yes. Upgrades, re-imaging and network work are usually scheduled for breaks, agreed in writing.
Related work.
- Case studyLocking Down Email for a Mississauga Development CompanyHow IT Rapid Support moved a Mississauga development company's DMARC policy from monitor-only to enforcement and put a warning banner on every external email.
- Case studyRecovering a Total ERP Database Outage in a Single MorningHow IT Rapid Support traced a total Spire database outage to a changed server network profile and had every affected workstation back the same morning.
Related pages.
- ArticleIT and Cybersecurity Checklist for Schools: Accounts, Devices, Wi-Fi and Student DataThe IT and security controls a private or independent school needs: student and staff accounts with MFA, Chromebook and laptop fleets, separate student, staff and guest…
- HubServicesManaged IT, security, incident response and forensics for businesses and private clients, from our offices in Vaughan, Toronto and Vancouver. Pick the practice below, or call the 24/7 incident line at (289) 582-9930 if something is happening now.
- ToolWhat is missing from your managed IT quote?Two managed IT proposals can carry the same monthly price and cover completely different things.
Want this handled for your business?
Tell us your users, devices and sites. We are staffed 24/7 and reply with next steps. Quotes are built from your environment, not a price list. Active incident? Call (289) 582-9930, 24/7.