Law / United States / 
Utah
Rule R277-487: information security program and protection duties of a third-party contractor that holds student personally identifiable information
In force since .
A sensitive categories rule binding private bodies.
- Obligation class
- Security, Governance, Disclosure
What it requires
- If you are a third-party contractor with a contract with a Utah education entity, protect student personally identifiable information against unauthorized access and redisclosure, both physical and digital (R277-487-7(1)).
- Have policies in place that follow reasonably industry best practices and adequately address the protection of student personally identifiable information (R277-487-7(2)).
- Develop and document an information security program, and make sure your contract informs the local education agency or the Superintendent of the precautions taken to maintain and protect student personally identifiable information (R277-487-7(3) and (4)).
- Meet the contractual audit right with a self-assessment, questionnaire responses, an SOC2 or SOC3 report, or an agreed onsite audit (R277-487-7(5)).
These lines are LexLint's reading of the law's text.
What this law does
A third-party contractor must protect student personally identifiable information against unauthorized access and redisclosure, both physical and digital. A third-party contractor must have policies in place that follow reasonably industry best practices and adequately address the protection of student personally identifiable information.
A third-party contractor must develop and document an information security program, and the rule provides that a third-party contract shall inform a local education agency or the Superintendent of the precautions taken regarding the maintenance and protection of student personally identifiable information.
A third-party contractor may meet the audit requirement of a contract under section 53E-9-309(2)(e) by providing a self-assessment, responses to a questionnaire, a report of an industry-recognized privacy and security audit such as an SOC2 or SOC3, or by submitting to an agreed onsite audit.
When LexLint raises it
When your app profile says your app serves K-12 schools.
Back to the example · Lint your app
Page updated .