Managed IT for private schools under FERPA.

A FERPA-ready MSP delivers more than generic help desk coverage. It means education record access controls and audit logs mapped to FERPA expectations, continuous asset inventory and change documentation, role-based access reviews for student information systems, and evidence binders maintained for FERPA inquiries and accreditation reviews. At Mandry, these controls operate under SOC 2 Type II discipline across Managed IT, Cloud, and AI Governance.

Mandry maintains risk assessments, access control documentation, vendor oversight records, and incident response procedures aligned to GLBA Safeguards expectations for financial-aid offices. Evidence binders are updated continuously through the compliance documentation program, producing the records auditors and cyber insurance carriers request rather than a one-page checklist assembled under deadline pressure.

Yes. Co-managed IT extends internal teams rather than replacing them. Mandry can operate help desk overflow, vCIO advisory, cloud management, and compliance documentation while internal staff retain control of student information systems and vendor relationships. Scope is defined during assessment based on team size, regulatory obligations, and which functions need external depth.

vCIO advisory and technology roadmapping account for enrollment cycles, exam periods, and accreditation review schedules. Infrastructure changes, migrations, and major upgrades are planned with cutover windows that avoid peak academic periods. The business office gets a roadmap tied to budget cycles; the IT director gets a schedule that does not disrupt continuity-critical systems during the school year.

Before Copilot or any LLM rollout, Mandry maps data classes to define what student records can enter which AI tools, configures tenant boundaries aligned to FERPA minimum necessary principles, and documents approval workflows for third-party AI vendors. The goal is documented boundaries accrediting bodies and FERPA reviewers can verify, not a blanket ban that staff work around through shadow IT.

Mandry maintains continuous evidence binders: asset inventories, access reviews, incident response procedures, and security controls mapped to accreditation cybersecurity expectations. Documentation is updated through the compliance program continuously, producing the records accrediting bodies request during site visits rather than a policy packet assembled when a review is announced.