Adopted: 7/28/26

History:

The Iowa City Community School District is committed to safeguarding the continuity of its instructional and operational functions through proactive planning and risk mitigation. This policy mandates the creation, maintenance, and regular review of business continuity, security, and recovery procedures to reduce disruptions, protect critical data, ensure the safety of students and staff, and maintain the integrity of physical and digital systems.

The district shall develop and maintain the following plans and procedures, with updates and reviews occurring on at least an annual basis:

Business Continuity Plan (BCP)

Ensures the continued delivery of critical educational and operational services. Reviewed annually by district administration and relevant department leaders.

Disaster Recovery Plan (DRP)

Details technical recovery steps for IT infrastructure following a disruption. Includes backup verification and data restoration procedures.

Incident Response Plan (IRP)

Defines response protocols for cybersecurity and physical security incidents. Outlines roles, communication paths, and escalation timelines.

Risk Register and Risk Committee

The district shall maintain a risk register to inventory, assess, and prioritize risks. A designated Risk Committee, composed of representatives from IT, Facilities, HR, and Administration, shall review and update the register monthly.

Vulnerability Management Program

Procedures to routinely identify, evaluate, and remediate system vulnerabilities. Regular scanning, patching, and reporting schedules shall be maintained.

Access Control and Audit Procedures

All granted physical and digital access must be formally documented and defined by role. An annual audit shall be conducted to ensure alignment with least privilege principles.

System Configuration and Maintenance Standards

All technology systems shall have documented configuration baselines and maintenance plans that include authorized roles and responsibilities. The district shall implement segregation of duties for critical system functions to minimize the risk of misuse or unauthorized actions. No individual should control all key aspects of any critical function. Changes must be authorized and tracked.

Data Classification and Handling Procedures

All data shall be inventoried, labeled, and classified according to sensitivity (e.g., public, internal, confidential). Handling procedures must be defined for each classification level, including access, transmission, and storage requirements.

Record Retention Compliance

All records, including communications and operational logs, must be retained according to board policy or other requirements. Retention schedules must be reviewed annually.

Network and Communications Security

The district shall implement and maintain controls to secure its network infrastructure, including the use of firewalls, intrusion detection/prevention systems (IDS/IPS), and network segmentation. 

Password and Authentication Requirements

Strong password protocols shall be enforced for all user accounts. Password standards shall follow best practices outlined by the National Institute of Standards and Technology (NIST).

Oversight and Responsibility

The Superintendent or designee shall ensure the development and implementation of all required plans.

Policy References:
712 - Technology and Data Security
713 - Responsible Technology Use and Social Networking
804.2 - Emergency Operations Plans
401.S - Employee Records
708 - Care, Maintenance and Disposal of School District Records

Legal References:
Iowa Code§§ 279.8, 22.720 U.S.C. § 1232g (FERPA)34 C.F.R. Part 99281 I.AC. 12.3(6). 12.3(13)