Framework
What It Legally Requires
Seceon Capability (per CMX360 docs - vendor claim)
FERPA (1974 federal law)
Restricts disclosure of student education records without consent; requires access controls and audit trails on who viewed/changed a record
Monitors access to student-record systems (registrar, LMS, grading) and flags anomalous or unauthorized access; generates access logs for audit
GLBA Safeguards Rule (FTC, covers colleges since 2023)
Requires a written information-security program protecting financial-aid/financial data: risk assessment, access controls, encryption, incident response
Continuous monitoring of financial-aid systems; CMX360 maps detected events to Safeguards Rule control categories for audit evidence
COPPA (FTC, under-13 users)
Requires verifiable parental consent and data-minimization for services collecting data from children under 13 - relevant to dual-enrollment/K-12 partnership systems
Data-classification tagging on systems touching minor-linked records; access-control monitoring on shared K-12/dual-enrollment platforms
NIST CSF / NIST SP 800-171
Voluntary risk-management framework (CSF) and mandatory control set (800-171) for institutions handling Controlled Unclassified Information in federal research grants
Maps detected telemetry to CSF/800-171 control families; supports (not certifies) a path toward CMMC readiness for federally funded research
ISO/IEC 27001
International standard for an Information Security Management System - requires documented risk treatment, controls, and continual improvement, independently certified by an accredited body
CMX360 activates ISO 27001 control mapping natively; certification itself still requires an accredited external auditor - Seceon supports evidence, doesn’t certify
HIPAA
Protects Protected Health Information at student health centers, counseling services, or affiliated teaching hospitals
PHI-specific access monitoring and breach-detection playbooks where campus health systems are in scope
State breach-notification laws (all 50 states)
Requires notifying affected residents (and often a state) within a statutory window after a confirmed breach of PII - windows vary 30-90 days by state
Per-jurisdiction event mapping intended to track notification-clock deadlines once a breach is confirmed
