Does FFIEC Cybersecurity Assessment Tool (CAT) cover Family Educational Rights and Privacy Act (FERPA)?

40% of Family Educational Rights and Privacy Act (FERPA) you already have

FFIEC Cybersecurity Assessment Tool (CAT) already covers about 40% of Family Educational Rights and Privacy Act (FERPA), leaving 9 of 15 controls as genuinely new work.

Already covered 1 Likely covered 5 New work 9

What is genuinely new work

Nothing in FFIEC Cybersecurity Assessment Tool (CAT) reaches these. This is the list to scope.

FERPA-99.31a3-Audit-99.31a6-Studies

Audit and Evaluation Exception + Studies Exception (34 CFR 99.31(a)(3), 99.31(a)(6), 99.35)

FERPA-99.31a9-Judicial-99.31a10-Emergency-99.31a13-14

Judicial Disclosure + Health and Safety Emergency + Sex Offense Disclosures (34 CFR 99.31(a)(9), (10), (13), (14), 99.36)

FERPA-99.60-99.67-Enforcement

Enforcement and Complaint Procedures (34 CFR 99.60 to 99.67)

FERPA-Part99.10_11_12

Right to Inspect and Review (34 CFR 99.10, 99.11, 99.12)

FERPA-Part99.1_3

Applicability and Definitions (34 CFR 99.1, 99.3)

FERPA-Part99.32-Recordkeeping-99.33-Redisclosure

Recordkeeping of Disclosures + Limitations on Redisclosure (34 CFR 99.32, 99.33)

FERPA-Part99.37-Directory

Directory Information (34 CFR 99.31(a)(11), 99.37)

FERPA-Part99.4_5

Rights Transfer (34 CFR 99.4, 99.5)

FERPA-Status

FERPA Implementation Status, 2024-2025 Guidance and AI/Cloud Trends

Show the 6 you already have

FERPA-Safeguards-PTAC

Data Security Safeguards for PII in Education Records (PTAC Best Practices, SPPO Guidance)

FERPA-99.31a1-School-Officials

School Officials with Legitimate Educational Interest (34 CFR 99.31(a)(1))

FERPA-Coord-COPPA-PPRA-State

Coordination with COPPA, PPRA, State Student Privacy Laws and Sectoral Laws

FERPA-Part99.20_21_22

Right to Request Amendment + Hearing (34 CFR 99.20, 99.21, 99.22)

FERPA-Part99.30_31

Prior Consent Required for Disclosure + Exceptions (34 CFR 99.30, 99.31)

FERPA-Part99.7

Annual Notification of Rights (34 CFR 99.7)

How this is calculated

Already covered means a mapping runs from a control in FFIEC Cybersecurity Assessment Tool (CAT) to that control. Likely covered means no direct mapping exists but both frameworks map to the same control in a third standard. New work means neither. We keep those separate rather than adding them into one friendlier number, because blending them would present a two-hop inference as a verified fact.

Coverage is not symmetric. Run it the other way and you will get a different number; both are correct.

From 332,959 cross-framework control mappings across 723 frameworks, 531 of them verified against their source documents. It does not tell you that you are compliant: a mapped control means the two standards ask for the same thing, not that you have done it.

Try another pair · Today's edition