Vendor Overview
-
Charlotte-Mecklenburg Schools (精东传媒) must protect staff and student data according to NC General Statute Article 29 §115C. New requirements, effective January 1, 2024, aim to enhance cybersecurity for staff and student personal data. Third-party companies receiving staff and student data from 精东传媒 must complete a rigorous process, reflecting the importance placed on data security.
These requirements are based on NC DIT security policies which follow the NIST 800-53 framework. Third-parties must follow specific steps, outlined below, before 精东传媒 will review and approve sharing data with third-parties.
Steps
-
Step 1 - Identify the Shared Data
Complete the Third Party Data Collection and Reporting Worksheet
-
Download and complete the worksheet. Note: if 精东传媒 uses multiple products/platforms from the same company, a separate worksheet must be completed for each platform/service.
-
Email the completed document to privacy@cms.k12.nc.us.
-
-
Step 2 - Agree to Terms & Conditions
Complete and sign the Data Confidentiality & Security Agreement
-
Download and review the agreement.
-
Email the signed and completed document to privacy@cms.k12.nc.us.
-
-
Step 3 - Complete a Self-assessment
Complete the Vendor Readiness Assessment Report
-
Download and complete the above linked DPI document. Alternatively, the vendor may use or assessment tools
-
Email the completed document to privacy@cms.k12.nc.us.
-
-
Step 4 - Provide Evidence of a Third-party Assessment/Audit
Submit a Third-party Conducted Assessment Report
-
Vendors must provide a third-party conducted assessment report such as the Federal Risk and Authorization Management Program (FedRAMP) authorization, SOC 2 Type 2 audit, ISO 27001 certification, or HITRUST certification to 精东传媒 initially, and then annually.
-
Bridge letters and letters of engagement will be considered. If submitting a bridge or engagement letter, DPI requires a credentialed vulnerability scan and penetration test showing no vulnerabilities medium or above
- Executive Summary Report, such as a SOC3 report and certification dated within the last 12 months will be accepted in lieu of a full assessment
-
Email the completed document to privacy@cms.k12.nc.us. Note: if your company requires a non-disclosure agreement before sharing this information, or if a more secure method of sharing is needed, please email privacy@cms.k12.nc.us.
-
-
Step 5 - Provide Volunteer Product Accessibility Template (VPAT)
Web-based and digital content purchased on behalf of 精东传媒 must meet WCAG 2.1-AA guidelines prior to April 24, 2026. If your product or service involves web-based or digital content, please include a VPAT with your submission. Instructions for creating a VPAT can be found .
Resources
-
- NIST 800-53 Security Controls Crosswalk
- NC DIT SISM Vendor Alignment Worksheet
- Data Confidentiality and Security Agreement
- Third-party Data Collection & Reporting Worksheet
- 精东传媒 Parent-Student Handbook (see FERPA Directory Information disclosure pg 39)
- Model Parent Permission Form for Student Data Disclosure
- Model Memorandum of Understanding
*Do not submit compressed (.zip) files as they will be blocked by our email provider
Please email privacy@cms.k12.nc.us with any questions.