District tightens Skyward access and limits student SSN exposure after repeated audit findings

Miss France and IT staff told the board that findings 10
2 identified repeated gaps in user-access controls for Skyward, including places where student Social Security numbers were accessible. Staff described several technical and procedural fixes intended to prevent further exposure of sensitive student information.

Staff said they removed the SSN field from most Skyward pathways and defined a small, documented group that retains SSN access for necessary duties. That group will be reviewed monthly to ensure only authorized people are included. IT is also cleaning up the security-group structure: the team found approximately 90 empty or redundant security groups and has deleted many.

To improve oversight, the district rolled out a PowerBI tool developed by NEP staff that enumerates each named user's access by pathway and module, enabling administrators to see whether a person who changed jobs was accidentally cloned into a prior role
nd thereby retained excessive permissions. "If I pull up her name, I can see every pathway that she can see," an NEP presenter said of the tool. Staff said the tool prevents bulk export to protect data and is intended for internal review.

The district also outlined a scheduled deactivation process tied to personnel-action forms so IT receives advance notice of transfers and separations and can schedule credential removals on appropriate payroll- or separation-related dates.

Staff told the board the work is time-consuming and will continue, but that they believe the SSN exposure finding is resolved and that monthly and procedural controls will reduce recurrence of these issues.