# California Reviews ETS Security Compliance

After a September breach exposed personal and assessment information belonging to millions of current and former public school students, the California Department of Education is reviewing Educational Testing Service’s compliance with the contract and data-security requirements for California’s statewide assessment program. The review signals greater scrutiny of contractors handling student data, including their security controls, data minimization, and access management, and highlights the need for education agencies to fund cybersecurity safeguards.

- Procurement teams may need to examine how assessment contracts specify, verify, and oversee vendor security controls and data handling.
- Education agencies and contractors should evaluate data minimization and access management practices for systems containing student information.
- The review may increase attention to dedicated cybersecurity funding in education procurement; the signal provides no contract value or new deadline.

**Jurisdictions:** sled
**Industries:** Education
**Topics:** Cybersecurity
**Published:** October 30, 2026

### Government Entities
- California Department of Education (CDE)

### Vendors
- Educational Testing Service (ETS) (Statewide assessment contractor)

### Key Quotes
> You can ask a vendor so many times: Are they following these security practices? Are they following security standards? But we have no way to check and verify those
> — Laurel Nava, Executive Director, California IT in Education

### Sources
- [After ETS Breach, Experts Urge Stronger K-12 Cybersecurity](https://www.govtech.com/education/k-12/after-ets-breach-experts-urge-stronger-k-12-cybersecurity) - GovTech