How should schools address data privacy and cybersecurity risks when using cloud-based solutions?

• A. Open access for all staff
• B. Deactivate backups
• C. Enforce strong access controls, encryption, vendor risk assessments, data governance policies, and staff training
• D. Encrypt only on weekends

Answer: (C)

The main idea is protecting data in cloud environments through layered, proactive controls and clear governance. Strong access controls ensure only the right people can reach sensitive information, using principles like least privilege and multi-factor authentication. Encryption should be applied both in transit and at rest so data stays unreadable even if a breach occurs. Vendor risk assessments are essential to understand the security measures of cloud providers and how responsibilities are shared. Data governance policies set how data is classified, stored, retained, and securely handled, providing a consistent framework for risk management. Staff training addresses human error and phishing, which are common attack vectors.

Open access exposes data to unnecessary risk and undermines security fundamentals. Deactivating backups eliminates recoverability and disrupts availability during incidents. Encrypting only on weekends is impractical and leaves data unprotected at all other times.