Public school board adopts new data and cybersecurity policy

To adapt to a changing landscape of artifical intelligence, and cyber risks, the public school board approved a new policy to strengthen its digital technology security.

At Tuesday’s board meeting, the new data governance and security policy was approved.

The policy acts as a framework to follow for cyber security, data use, and AI when it comes to education. Now that the policy is in place, a set of procedures outlining roles, responsibilities, and guidelines is under development.

The point of the policy is for the board to provide safe and secure digital technologies to support students and maintain efficient board business operations, according to the policy . It applies to anyone, including students, who access board data.

There are consequences for those who are found in violation of the policy.

Account access could partially or fully, be suspended for those involved during an investigation. Hardware or access to data could be confiscated to preserve any files and materials related to the investigation. There could be disciplinary measures, up to, and including dismissal. Criminal activities will be turned over to police for further investigation and action, as deemed necessary.

The Upper Grand District School Board’s chief information and security officer is responsible for adopting AI technologies, implementing a digital resource vetting program and a cyber security program.

Under cybersecurity it's up to everyone to be cyber safe. UGDSB does realize even with training and security controls, “a cyber incident is still possible when faced with a determined well-funded adversary,” stated in the policy.

This is why it created a cyber incident response plan to prepare for a cyber incident. It has the roles and responsibilities for everyone involved in the board's response to a cyber incident.

AI also has its risks but also the possibilities of supporting student and staff learning. Risk assessments of all digital technologies , including AI, identify risks and mitigation controls before the tools are approved. The board also must clearly communicate how and where it uses AI.