EdTech Top of Mind for 2022: Certifications, Security Compliance and Student Privacy
Why skills certifications, security compliance and student data privacy are expected to be the main edtech priorities for schools in 2022.
Edtech security and student data privacy since 2022: what GAO, CISA, the PowerSchool breach and the new COPPA rule mean for school leaders.
In January 2022, Robert Iskander named skills certifications, security compliance and student data privacy as the three priorities in education technology. A new section below, written in 2026, checks that forecast against later reports and offers decisions for school leaders.
When they close the book on this era, 2020 will be remembered as the year of COVID.
2021 was the year that the world learned to live remotely, the year that everything was on the table, and the phrase, “That’s the way we’ve always done it,” was generally removed from educators’ vocabularies.
And 2022 will be remembered for an increased focus on three crucial areas:
- Skills Certifications
- Security Compliance and
- Student Data Privacy.
Think of them as the Big Three; these are the areas that will identify education in 2022.
The rise of certifications
For those students who are headed for a career, or for those of you who would like to reskill for additional opportunities, skills certifications in the areas of Cybersecurity, Software Engineering, Artificial Intelligence, Machine Learning and Data Science may prove to be more lucrative than a four-year college or graduate school degree as employers seek very specific certification programs offered by larger tech companies such as Google, AWS, IBM and Microsoft.
Companies like Coursera administer certification programs from these companies, offering popular programs like Cloud computing—using the internet to store data and services instead of a computer hard drive. The business advisory firm Gartner predicts that Cloud will make up 14 percent of all global enterprise IT spending in 2024, up from nine percent in 2020. In-demand certifications like this lead to richly rewarding comp packages. And cloud computing is a heavily in-demand skill. The average salary for cloud computing professionals in North America is $153,655, according to a report by Global Knowledge. And perhaps the most surprising aspect, the cost of the top ten certification courses from the top companies, offered by Coursera, range from $99 to $2499, with most certifications under $500.
Although this is an opportunity that has been coming for several years, 2022 may be the year in which to cash in. According to experts, areas like cybersecurity have more than a million-person deficit, and that number isn’t going to wane anytime soon. In addition, artificial intelligence is coming into its own for education. Expect AI to employ real Socratic teaching methods over the next three years, as knowledge libraries become sophisticated enough to allow machine learning to really take over classic subject areas and write their own scripts, progressing beyond simple decision engine courseware to real conversational learning and teaching.
The widening skills gap
As this year bears witness to a widening skills gap, there is a shortage of available skilled individuals in the technology sector – and that shortage is continuing to grow at an alarming rate, creating multiple concerns about this scarcity and what it might mean for the future workforce:
- Without a qualified workforce, it’s difficult to compete globally and our country’s economic future could be threatened
- As ransomware and phishing attacks grow more sophisticated and severe, the need for technically capable workers becomes paramount to thwart the threats to our schools, infrastructure, and business
- As student data privacy takes center stage for schools, the need for more high-tech professionals becomes apparent
- AI, AR, and VR are already becoming commonplace in retail, education, healthcare, and other industries, driving demand for technically proficient workers
- Many companies are dropping the college degree requirement and seeking skilled workers who are recent high school graduates
Security is essential
As you may be aware, in 2021 , education was the number one industry attacked by ransomware. According to an article in K-12 Dive, “a whopping 44% of schools experienced a ransomware attack in the last year, with more than half of these victims saying their data had been encrypted in the most significant attacks. Another one-third of schools say that they haven’t yet been attacked by ransomware but expect to be in the near future. The most recent guidance from the FBI indicates that K-12 schools actually made up a majority of all ransomware attacks (57 percent) during last year’s back to school season.” The cost to schools is high. According to Sophos, “The typical school, district or university pays an average $112,435 ransom payment to get data back and networks running again.” In addition, cyber criminals will generally encrypt the personal identities and financial data of the institution’s students, their parents, and the institution’s staff, all to put pressure on the institution to comply.
Because of this, security compliance of the IT infrastructure and processes used with schools and colleges will be mandated by multiple state and federal government agencies to ensure there is a better defense against ransomware.
As such, more school districts will start migrating their on-premise IT infrastructure to better protected Cloud Infrastructure services such as AWS, Google Cloud and Azure. It is simply uncanny the way cybercrime has grown over the past several years.
Though it should have been all along, data privacy compliance is no longer a nice to have … but an essential requirement for EdTech SaaS vendors. In addition to federal regulations that we are all familiar with, almost every state is getting into the action. And increasingly, personal liability is being attached to the penalties. What was once a slap on the wrist, at least for larger companies that could afford it, is becoming a situation where someone is going to pay with personal assets. In many cases, that someone could be the de facto risk-manager of a school district, such as the superintendent. The days of lax compliance are in the past; carelessly treating student data will not be tolerated in 2022.
An emphasis on Skills Certifications, Security Compliance and Student Data Privacy in 2022 gives everyone in our industry something to build on and promises to offer considerable opportunity for all. And though we may not be out of the COVID woods yet, we are certainly learning how to navigate the forest.
Edtech security and student data privacy in 2026: what has happened since Iskander’s 2022 forecast
Robert Iskander wrote in January 2022 that three areas would define the year in education technology: skills certifications, security compliance and student data privacy. Edtech security has since become a practical concern for every district that depends on cloud vendors. This section checks the forecast against government reports, a large breach and a new federal privacy rule, and then turns to what school leaders can decide.
What federal reviewers found about school cyberattacks
In October 2022 the U.S. Government Accountability Office published a report on K-12 cybersecurity. State and local officials told GAO that a cyber incident, ransomware in particular, can cost students between three days and three weeks of learning, and that recovery can take two to nine months. GAO also reported that attacks bring monetary losses from downtime and from the resources needed to recover. The report said the national scale was unknown. Iskander cited ransomware rates and ransom payments from 2021 sources, and those figures should be read as a snapshot of that year, since they were not rechecked for this update.
In January 2023 the Cybersecurity and Infrastructure Security Agency (CISA) released Protecting Our Future, a report with a threat overview and recommendations for school leaders. CISA’s K-12 page lists a foundations resource package, guidance for buying technology that is secure by design, ransomware resources for districts, and regional cybersecurity advisors who work on risk management and response. It also invites K-12 education technology vendors to join a Secure by Design pledge.
The PowerSchool breach and what it shows about vendors
Iskander wrote that data privacy compliance had become an essential requirement for edtech software vendors. The December 2024 breach of PowerSchool, a provider of school software, showed why districts care. As reported by The Record on September 4, 2025, the breach exposed data on 62.4 million students and 9.5 million teachers, and about 6,500 of PowerSchool’s clients were affected; the company says it serves 18,000 school districts or individual schools. The exposed information included names, addresses, Social Security numbers, and disability and special education records, along with bus stops. The Texas attorney general sued the company that month, alleging it misled customers about its security. According to the same report, PowerSchool acknowledged that it did not have multifactor authentication in place before the breach. The Texas claims are allegations that a court has not decided, and the company did not respond to the reporter’s request for comment.
The lesson for districts does not depend on how the lawsuit ends. One vendor held records for thousands of districts, so a weakness at the vendor became an exposure for each customer. Contract language and routine questions about multifactor authentication, encryption and breach notification belong in every renewal.
A new federal rule on children’s data
On January 16, 2025 the Federal Trade Commission finalized changes to the Children’s Online Privacy Protection (COPPA) Rule. Operators must obtain separate verifiable parental consent before disclosing a child’s personal information to third parties for targeted advertising and similar purposes, and they may keep that information only as long as needed for the purpose it was collected. The definition of personal information now includes biometric and government-issued identifiers. The FTC did not adopt proposed changes aimed specifically at education technology companies. Entities have one year from publication in the Federal Register to comply with amendments that do not set an earlier date, so districts should expect vendors to update their policies and should ask when.
What a certification can and cannot tell a district
Iskander wrote about skills certifications for people, such as cloud and cybersecurity credentials. Edtech certifications now also describe vendor products. The 1EdTech consortium offers a Data Privacy Certification for which it vets a supplier’s privacy policy and terms of service using its TrustEd Apps Data Privacy Rubric, and the supplier must provide public documentation to validate the result. Only 1EdTech members can earn it, and districts may require it in procurement. The review covers documents a supplier makes public, so it works well as a first screen. It does not replace a district’s own questions about how a system is secured and how incidents are handled.
Decisions for school leaders
- List every system that holds student records, who runs it, and what happens to the data when a contract ends. COPPA’s retention limits make the last question a reasonable one to ask.
- Ask each vendor whether multifactor authentication and encryption are in place and how quickly the district would be told of a breach.
- Use the public resources: CISA lists regional cybersecurity advisors for risk management and response, and K-12 guides on ransomware and secure technology purchasing.
- Plan for downtime. GAO’s three days to three weeks of lost learning is a reason to practice paper and offline lessons before they are needed.
- Treat certifications as a screen. Combine them with the district’s own questions.
For related work on students’ online lives, see edCircuit’s digital citizenship guide. The three areas Iskander named in 2022 are still the right ones to watch, and the evidence since then suggests that edtech security depends as much on contracts and routine questions as on technology.
Related reading
More on EdTech
