Compliance matrix
Family Educational Rights and Privacy Act
United States · Updated 2026-07-19
Applies to: Schools and educational service providers handling student education records.
Requirements mapped to CIAM
Controlled access to education records
Access to records must be limited to those with a legitimate educational interest, by role.
CIAM controls
- Role-based access (student, parent, staff)
- Least-privilege grants to records
Evidence
- Role definitions
- Access review records
Ask the vendor
- Can we model student, parent, and staff roles with least-privilege access?
Parent and eligible-student rights
Parents (and students over 18) can access and request correction of records, so the identity system must support delegated and transitioning access.
CIAM controls
- Parent-to-student delegated access
- Access transition at the age of majority
Evidence
- Delegation configuration
Ask the vendor
- Does the platform support delegated parent access that transitions to the student?
Disclosure logging and directory opt-out
Disclosures must be logged, and families can opt out of directory information sharing.
CIAM controls
- Audit log of record access and disclosure
- Directory-information opt-out flag
Evidence
- Disclosure logs
Ask the vendor
- Are record accesses logged, and can we honor a directory opt-out preference?
Take this into procurement
Turn these requirements into vendor questions.
The vendor questions above map directly into an RFP or an evaluation checklist you can share with security and procurement.
Go deeper
Where it bites hardest
FAQ
- How does FERPA shape CIAM for an edtech product?
- You need distinct student, parent, and staff roles with least-privilege access to records, delegated parent access that transitions to the student at the age of majority, disclosure logging, and support for directory-information opt-out.
Source
U.S. Department of Education, FERPA
This matrix is practitioner guidance, not legal advice, and does not establish an attorney-client relationship. Confirm your obligations with qualified counsel. See our disclaimer.