The EdTech marketplace has a problem that everyone in the sector knows about, complains about, and has somehow tolerated for far too long: there is no common security bar. No shared expectations. No single target for providers to aim at. And while we have spent years discussing frameworks and requirements across jurisdictions, the breaches have kept coming — bigger, more frequent, and more damaging to the students whose data sits at the center of every incident.
It is past time to fix this. The fix already exists. It is called the Global Educational Security Standard (GESS), published by the Access 4 Learning (A4L) Community two years ago. And as of May 2026, GESS finally has what it has always needed to move the market: an independent, third-party audit and certification scheme, delivered in partnership with the EDDS Institute.
If you are a vendor, a district CIO, a state procurement lead, or a privacy officer, this is your moment to act.
The Crisis Hiding in Plain Sight
The numbers tell a story that should embarrass the entire sector. The 2025 CIS MS-ISAC K-12 Cybersecurity Report found that 82% of reporting K-12 schools experienced cyber threat impacts between July 2023 and December 2024 — more than 9,300 confirmed incidents across roughly 5,000 organizations. RAND’s October 2024 survey of school principals put it at 60% experiencing at least one incident in a single school year. Ransomware against education rose 23% in the first half of 2025 alone. Average ransom demands cleared half a million dollars.
And then there is the vendor problem. The Illuminate Education breach of 2021, the PowerSchool breach in late 2024, and now the Instructure Canvas breach of 2026, and numerous smaller incidents, all exposing student data to unnecessary risk. The pattern is unmistakable: when an EdTech vendor falls, hundreds of districts fall with it.
Why the Marketplace Keeps Failing
The diagnosis is not that vendors do not care. Most do. The diagnosis is that we have built a marketplace where the complexity and opaqueness of security requirements makes it extremely difficult to implement, assess and confirm adequate compliance.
A mid-sized EdTech provider serving districts across the United States, Canada, the UK, Australia, New Zealand and the EU is staring down a patchwork: state-by-state student data privacy laws, sector frameworks like NIST CSF and CIS controls, enterprise certifications like SOC 2 and ISO 27001, and a growing list of country-specific requirements. Each district sends its own questionnaire. Each questionnaire asks the same questions in different words. Vendors spend enormous time answering surveys instead of hardening systems. Districts spend enormous time reading answers they have no efficient way to verify.
The result is exactly what you would expect: a market that rewards paperwork over posture, where threat actors find the soft underbelly because no one ever agreed on what “secure enough” actually means.
This is the gap GESS was built to close.
What GESS Actually Is — And What It Isn’t
GESS is not a new framework competing with NIST, ISO, or CIS. That is the most important thing to understand about it. GESS is a crosswalk — a single, education-tailored set of controls that maps to the frameworks and jurisdictional requirements that already exist, scoped to the realities of PK-20 data, PK-20 budgets, and PK-20 operations.
For a vendor, that means one set of controls to implement instead of a dozen overlapping checklists. For a district, that means one credible signal of trust instead of a stack of vendor-supplied PDFs. For a state or ministry of education, that means a comparable benchmark that travels across borders.
Until now, GESS lived as a self-assessment. Useful, but ultimately a question of whether you trust the person filling out the form. That era is over.
The Audit Scheme Changes the Game
In May 2026, A4L and the EDDS Institute launched the GESS auditing scheme: an independent, evidence-based, paid audit and certification service delivered by qualified third-party assessors. Each audit includes structured evidence review, a transparent traffic-light scoring model, a versioned assessment report, and 12-month certification with a clear remediation pathway for closing gaps.
Crucially, the scheme is designed to be proportionate. Unlike enterprise-grade audits that price small and mid-size EdTech providers out entirely, GESS uses a tiered, risk-based approach that lets a 10-person startup and a global platform both demonstrate credible assurance without one of them carrying enterprise audit overhead they cannot afford.
This is what the market has been missing: a verified, comparable, education-specific signal of trust that smaller vendors can actually achieve and that districts can actually rely on.
The Call to Action
Pointing at the problem is the easy part. Here is what each stakeholder group should do — now, not next budget cycle.
EdTech vendors: Get into the first wave. A4L and EDDS Institute will soon be opening early certification, and the providers who move first will not only achieve first-mover status — they will help shape what the global standard looks like as it matures. The reputational and procurement benefits of being certified before your competitors are real, and they compound. If you have been waiting for a credible, education-specific alternative to enterprise audits, the wait is over. Email David Sallay, A4L’s Director of Data Privacy, at dsallay@a4l.org. They have committed to responding within 48 hours.
Districts and state education agencies: Start asking for GESS certification in your procurement processes. Every RFP and/or DPA that requires it shifts the market. You do not need to wait for a federal mandate, a state law, or a national framework — you have purchasing power, and how you use it sets the bar. Begin building GESS into your vendor evaluation rubrics this procurement cycle.
Ministries of education and policy makers: Recognize GESS as the harmonization layer it is. A common, education-specific standard reduces compliance friction for vendors operating across your jurisdiction and gives your schools a defensible, comparable basis for vendor risk decisions. Endorse it. Reference it. Align your own guidance with it.
Privacy officers, CIOs, and CISOs in K-12: Make GESS part of your vendor risk program now. Use it as a triage tool, a procurement filter, and a baseline for the contractual security terms you negotiate.
The Choice in Front of Us
We can keep doing what we have been doing: every district reinventing its own questionnaire, every vendor drowning in duplicative surveys, every breach met with the same head-shaking and the same promises that next time will be different. Or we can do the thing that every mature sector eventually does — agree on a common bar, verify it independently, and raise it together.
GESS has been on the table for two years. The audit scheme is here. The infrastructure is built. What remains is adoption.
Students do not get to choose which vendors handle their data. The adults in this system — the vendors, the districts, the policy makers, the procurement officers — make that choice for them every day. We owe them better than the status quo.
The time for GESS is now.
Learn more about the GESS auditing scheme in A4L’s press release. Vendors interested in early certification can contact David Sallay, Director of Data Privacy at A4L, at dsallay@a4l.org.