ECNO’s Vetting of Application Security & Privacy (VASP) service provides professional risk assessments of security and privacy concerns related to educational digital tools and applications on behalf of Ontario’s K-12 School Boards.
Our process is based on our Student Digital Privacy Standard, which embodies uncompromising standards of protection and embodies progressive privacy and security protections that align with those endorsed by regulators and experts across North America and the European Union. The goal is to shift the data protection landscape and raise the bar for student digital privacy in Ontario schools.
What it is
Developed in collaboration with the Ontario Ministry of Education and the Ontario Association of School Business Officials, VASP gives Ontario school boards a shared, consistent, and scalable approach to assessing the privacy and security risks of digital applications, reducing duplicated work, and supporting informed adoption decisions.
VASP assessments provide Boards with a risk score, incorporating information about the risks that should be considered, and any mitigating strategies that can help reduce the identified risks.
Our assessments examine the student and staff personally identifiable information (PII) being collected, weigh any privacy or security risks, verify compliance between publicly stated policies/terms and practice, and advise on mitigating strategies where required.
What it is not
A VASP assessment is not a certification, endorsement or marketing tool. It is also not an approval or disapproval of any given digital tool for use in schools and classrooms. Our assessments are a tool that School Boards utilize as part of their own independent processes for reviewing digital tools.
Ultimately, it is up to each Board to assess the identified risks against their risk tolerance, as part of their own digital tool assessment and approval process.
The VASP Process
- Staff submit a request though their School Board’s Digital Tool approval process.
- Each Board typically conducts their own internal assessment of their digital tools and applications from a pedagogical lens to establish that the Board has the infrastructure to support the software, and that they do not already have another digital tool in place that meets the needs.
- The Board then submits a VASP request for the digital tool to be assessed.
- Requests for assessment are only accepted from our member School Boards; providers need to collaborate with their client’s School Board for their tool to be assessed.
- A team of privacy and security analysts conduct an initial assessment. The Privacy Analyst vets the supporting documents and the Security Analyst ‘fuzzes’ the application. Typically, the vetting and fuzzing process results in a set of questions and recommendations for the provider.
- The team will attempt to connect and collaborate with the provider to address any questions or recommendations.
- Following provider discussions, the analysts produce School Board and Educator reports based on the initial assessment along with any changes/clarifications obtained during discussions with the provider.
- If the provider does not respond or is uncollaborative, we will publish the reports with our findings and note that the provided did not participate.
Please feel free to reach out to our team. Together, we can build a brighter and tech-savvy future for our schools.
Continuous Third-Party Risk Management
In addition to the VASP service which offers a Privacy and Security Assessment, Shuriii is an ECNO partner that operates DistrictOS, a platform that provides continuous third-party risk management and impact measurement for Ontario’s publicly funded K–12 school boards. An increasing number of boards are adopting or evaluating the platform. Through DistrictOS, vendors complete one centralized profile, provide product details, and upload security and privacy documentation for independent review and verification. Once verified, the DistrictOS profile is made available province-wide, giving participating school boards ongoing access to current risk and impact information while reducing repeated submissions.
Shuriii is a social enterprise, providing its service to School Boards at no cost. They instead ask EdTech vendors to absorb some of the costs of providing the service. Vendors choose whether to take part in Shuriii’s DistrictOS platform based on their business needs.
As part of our partnership with Shuriii, we share the contact information for vendors whose digital tools/applications that we assess to allow them to contact vendors to see if they want to participate in their service. It is important to note that participation with Shuriii is not a requirement for VASP to complete an assessment of a vendor’s digital tool/application. Information from Shuriii’s DistrictOS maybe used as input as part of a VASP assessment.