Key concepts
The guide covers service agreements, benefits and drawbacks of public cloud, key issues (governance, compliance, trust, architecture, identity, isolation, data protection, availability, incident response) and activities before, during and at the end of a cloud contract.
How it is organized
- Public cloud services and service agreements
- Key security and privacy issues
- Outsourcing activities: preliminary, during and concluding
What a school district should take from it
- Plan the exit before signing: how will data be returned or deleted?
- The district remains accountable for student data held by a cloud provider.
How to use it in your district
- Use its issue list as interview questions for new software-as-a-service vendors.
- Check that contracts address breach notification, data location and data return.
- Pair with the student data privacy agreement process.
Common misconceptions
- Moving to the cloud transfers responsibility to the provider.
- Responsibility is shared; the district still owns its data and its obligations.
Rubric categories and K12 Cyber Forward tools
Cybersecurity Rubric 2.0 categories
- GV.SCCybersecurity Supply Chain Risk Management
- PR.DSData Security
Tools in the program portal
- Student data privacy agreementsTrack a signed agreement for every vendor that receives student data
- Vendor RegistryKnow which vendors hold district data
- Guide: Vendor data privacy agreementsPublic guide
Related publications
- SP 800-210Access control in cloud systems
- SP 1305Supply chain risk quick-start
Citation and source
SP 800-144, Guidelines on Security and Privacy in Public Cloud Computing. National Institute of Standards and Technology. 2011. https://doi.org/10.6028/NIST.SP.800-144.
Topics: Cloud and connected devices, Vendors and supply chain, Privacy and student data. This summary was written by the K12 Cyber Forward program team in its own words. NIST is not affiliated with the program and has not reviewed it. The official publication on csrc.nist.gov controls.