Lately I have been focused on something that does not get enough attention in higher education information technology: data governance agreements with third party vendors.
We invest heavily in cybersecurity tools, multi factor authentication (MFA), endpoint protection, security information and event management (SIEM), and cyber insurance. All of that matters. But what happens after a breach, especially when the data is in a vendor’s environment, is often unclear or not contractually defined.
I recently spoke with our state security team about real incidents involving sister colleges and major vendors. What drives notification, remediation, and whether credit monitoring is provided is not just the technical event. It depends on the type of data, the scope of impact, contractual obligations, and whether cyber insurance even applies to that scenario.
Not all cyber events are cyber insurance events. Social engineering, account compromise, and poor data handling do not always trigger coverage the same way ransomware or infrastructure breaches might. Yet they can still expose sensitive data and still require notification and support for affected individuals.
This is where contracts matter more than tools. If vendors are hosting or processing student or employee data, institutions should not be guessing who is responsible for notification, who pays for remediation, or how quickly incidents must be disclosed. Those expectations should be written into the agreement before the first record is ever uploaded.
Many states already provide software as a service (SaaS) contract templates with data protection and incident response language. That is a strong starting point, but the terms still need to match the actual risk of the data being stored and processed.
Equally important is data minimization and retention. If a vendor only needs a name and student identification number (ID) to provide a service, they should not also be keeping full profiles or historical records. Contracts should clearly define data scope and require secure removal when the agreement ends.
Insurance is a financial tool, not a governance strategy. It does not replace contractual accountability and it does not cover every type of incident.
Cybersecurity tools are important. Insurance is important. But contracts and data lifecycle discipline are what determine who owns the problem when something goes wrong and how painful recovery will be for students, staff, and information technology teams.
If we are serious about protecting our communities, data protection has to be built into the business relationship from day one.