Use this checklist to identify questions, evidence, and decision owners. It does not assert that any particular control, certification, policy, or agreement is in place. Begin with your organization’s own requirements.
1. Purpose and information
Define the workflows and data categories in scope. Identify necessary fields, attachment types, and approved purposes. State what information should stay outside the deployment. Use fictional examples during initial evaluation.
2. Access and organization boundaries
Identify which users can submit, view, change, export, and administer information. Request evidence for the role, record, school, and district boundaries you need. Review how accounts are added, changed, and removed, and how sensitive access is authorized.
3. Hosting and service providers
Request a current data-flow description, hosting and processing locations, provider/subprocessor list, and the relevant provider arrangements. Include email, file processing, analytics, support tools, and other services that may handle information.
4. Protection and assurance
Request relevant evidence for authentication, data protection, attachment handling, logging, vulnerability management, and security review. Distinguish configured controls, internal checks, vendor statements, and independent assessments. Record the scope and date of each item.
5. Records and the data lifecycle
Clarify retention, correction, export, deletion, and service-exit arrangements. Include backups, logs, attachments, record-preservation needs, and the responsibilities of the school and provider. Ask how relevant procedures can be verified.
6. Operational readiness
Review support access, incident response responsibilities, incident contacts and notification arrangements, backup and recovery practices, restoration evidence, and change responsibilities. Identify which commitments are written and which remain questions.
7. Agreements and approval
Have the appropriate school reviewers evaluate the proposed agreements, student-data requirements, permitted uses, service terms, and remaining risks. Record the exact scope and release being approved and the conditions that must be met before use.
Track open questions
Record the requirement, requested evidence, owner, and whether the gap blocks approval.
| Requirement / open question | Evidence needed | Owner | Blocking? |
|---|---|---|---|
Complete the decision record
Keep sales discussions, technical evidence, and contractual approval distinct. Do not interpret a product demonstration or this checklist as authorization to use real student records.
This guide helps organize an evaluation. It is not a security attestation, legal opinion or certification.
Do not include sensitive records in a public inquiry form or general inquiry email.