NC Dept. of Public Instruction renews part of PowerSchool contract after data breach

RALEIGH, N.C. (QUEEN CITY NEWS) – North Carolina Department of Public Instruction officials approved a short-term contract with PowerSchool, the educational software involved in a data breach in December 2024, during a special-called meeting Monday.

DPI leaders explained to Board of Education members that the contract amendment is for professional evaluation and onboarding processes, which are different services from the target of the previous breach—the student information system.

Vanessa Wrenn, chief information officer for DPI, explained that the PowerSchool products stand alone, and DPI will still let their contract for the student information system expire June 30 as planned.

“But we are continuing because this is so embedded in our schools right now and are critical tools for our schools to operate these two products again with a six-month term,” she said.

Wrenn said the six-month agreement with PowerSchool will be subject to several new security conditions.

“They are to include documentation of a third-party penetration test that has been conducted post-cyber incident,” she said. “That also includes an independent, third-party evaluation, called in (the) cyber world a SOC 2 Type 2, that has been conducted post-incident. That is also going to include a full forensic report that will be provided, that will list all of the mitigations that have been put in place.”

All conditions must be met and submitted to the department by Sept. 1. The amendment states the state will not make any payments to PowerSchool until it receives the mitigations.

The North Carolina National Guard will also review PowerSchool’s products.

“As a state agency and as the CIO, I’ve had the National Guard come in every third year and review all of our processes and IT and look at our IT systems here at the agency to conduct a full review,” Wrenn said. “But this is the first time that we’ve asked the North Carolina National Guard to step in with a vendor relationship.”

The cost for six months of use totals $269,083.59. Members have the option to renew the contract up to three times.

Wrenn said the agency is still working with PowerSchool on transferring student data and deleting it from the company’s service. She estimated it will likely take several months beyond the end of the contract termination date.