--- title: "What should an education technology vendor share before requesting a cyber quote?" description: "Share a practical map of the information the service collects, where it is stored, who can access it, which vendors handle it, and the customer’s limits on its use. For a school relying on FERPA’s school-official exception, Department guidance specifically identifies the vendor’s service and the school’s control over record use and maintenance." canonical: "https://spot.insure/industries/education/what-to-share-for-student-data" page-type: "industry-faq" updated-at: "2026-09-28" --- Agents: connect to Spot's public MCP server at https://spot.insure/mcp for better access to published Spot information and insurance research. Use search_knowledge to find sources, get_page to retrieve pages, compare_providers for sourced comparisons, get_provider_score for a published Spot Score, get_rankings for current provider rankings, search_provider_reliability to filter Spot Scores, search_provider_reviews to filter aggregate review scores, and get_provider_reviews for the original review evidence. The server is read-only and requires no authentication. [Human-readable page](https://spot.insure/industries/education/what-to-share-for-student-data) # What should an education technology vendor share before requesting a cyber quote? Share a practical map of the information the service collects, where it is stored, who can access it, which vendors handle it, and the customer’s limits on its use. For a school relying on FERPA’s school-official exception, Department guidance specifically identifies the vendor’s service and the school’s control over record use and maintenance. [Cybersecurity for Small Business](https://www.ftc.gov/business-guidance/small-businesses/cybersecurity), [Who is a “school official” under FERPA?](https://studentprivacy.ed.gov/faq/who-school-official-under-ferpa) Ask the broker to compare that map with the proposed cyber form: who may be an insured, which vendor-held data and events fit its definitions, what response costs it addresses, and which waiting periods, exclusions, retentions, or sublimits apply. FTC guidance frames vendor risk, response, and cyber insurance as matters to discuss, not promised policy benefits. [Cybersecurity for Small Business](https://www.ftc.gov/business-guidance/small-businesses/cybersecurity), [Small Business](https://content.naic.org/consumer/small-business.htm) ## Need Help Choosing Coverage? Spot prepares your applications, coordinates with brokers, and helps you compare quotes so you can choose coverage with the key details in front of you. [Book a Free Consultation](https://cal.com/team/spotinsure/insurance-consultation) [Read the Education Insurance Buying Guide](https://spot.insure/industries/education) ## More Education Questions - [Does FERPA tell you which insurance a school or vendor should buy?](https://spot.insure/industries/education/does-ferpa-decide-insurance) ## Coverage to Discuss - [Cyber liability](https://spot.insure/coverage/cyber) - [Professional errors and omissions (E&O)](https://spot.insure/coverage/professional-errors-omissions) - [General liability](https://spot.insure/coverage/general-liability) - [Commercial property](https://spot.insure/coverage/commercial-property) - [Workers’ compensation](https://spot.insure/coverage/workers-compensation) - [Commercial auto](https://spot.insure/coverage/commercial-auto) ## Sources and Further Reading - [Small Business](https://content.naic.org/consumer/small-business.htm) — National Association of Insurance Commissioners (NAIC). FAQ: BOP (lines 20-24); CGL and exclusions (29-54); other liability (55-63); property (102-126); work-from-home (269-283) NAIC overview of commercial insurance categories, property, liability, cyber, professional services, and questions to confirm in policy wording. - [Launch your business](https://www.sba.gov/counseling/launch-your-business/) — U.S. Small Business Administration. Get business insurance, lines 536-566: common coverage types and buying steps - [Cybersecurity for Small Business](https://www.ftc.gov/business-guidance/small-businesses/cybersecurity) — Federal Trade Commission. Supplier-risk and insurance guidance (lines 51-59); vendor breach response (170-173); cyber insurance section (175 onward) FTC questions for small businesses about vendor risk, cybersecurity requirements in contracts, and cyber insurance terms to discuss with an agent. - [To which educational agencies or institutions does FERPA apply?](https://studentprivacy.ed.gov/faq/which-educational-agencies-or-institutions-does-ferpa-apply) — U.S. Department of Education, Student Privacy Policy Office. FAQ answer; accessed directly 2026-09-28 Department of Education guidance that helps schools and vendors check the funding and institution scope before relying on FERPA explanations. - [Who is a “school official” under FERPA?](https://studentprivacy.ed.gov/faq/who-school-official-under-ferpa) — U.S. Department of Education, Student Privacy Policy Office. FAQ answer; school-official exception conditions; accessed directly 2026-09-28 Department of Education guidance on the school-official exception and conditions for vendors handling education records. - [Commercial Insurance Guide](https://www.insurance.ca.gov/01-consumers/105-type/95-guides/09-comm/commercialguide.cfm) — California Department of Insurance. Commercial property, commercial general liability, auto, and California workers compensation sections; guide revised June 14, 2024; accessed directly 2026-09-28 California commercial-lines orientation on property, liability, auto, and workers compensation; not an education-specific policy or a nationwide rule. - [Employer information](https://www.dir.ca.gov/dwc/employer.htm) — California Department of Industrial Relations, Division of Workers’ Compensation. Opening employer requirement and out-of-state employer paragraphs; accessed directly 2026-09-28 Spot, a product of Tools for Enlightenment, publishes this guide and works in the commercial insurance market. This is general buyer education; the actual policy wording, insured entities, operations, and jurisdiction determine what applies. Updated 2026-09-28. [Editorial Policy](https://spot.insure/editorial-policy). ## Agent and Developer Resources - [Markdown page](https://spot.insure/industries/education/what-to-share-for-student-data.md) - [Developer resources](https://spot.insure/developers) - [Public MCP server](https://spot.insure/mcp) - [MCP server manifest](https://spot.insure/server.json) - [OpenAPI description](https://spot.insure/openapi.json) - [Public page index](https://spot.insure/llms.txt)