TriVigil started in education, and education is still most of what we do: colleges and universities are the larger part of the practice, K-12 districts the rest, and the same team serves both. We know what a cabinet or a school board needs to hear, what an auditor will ask for, and how to run a program alongside your existing IT staff without getting in their way.
A campus runs a clinic, a financial aid office, student housing, and a research operation, and each one answers to different rules. We take on the parts your security team does not have the hours for, and we report to the people who have to sign.
Title IV institutions have to designate a Qualified Individual, keep a written risk assessment current, and report to the board every year. Our vCISO serves as the Qualified Individual and owns that calendar, including the report your auditors look for.
Federal awards increasingly carry NIST SP 800-171 language, and DoD work brings CMMC. We scope the research enclave with the PI and the research office, then write the system security plan before the sponsor asks for it.
Every department buys software, and every purchase arrives with a HECVAT to review. We take the inbound assessments off your desk, maintain the vendor risk register, and turn the one-off reviews around in days instead of weeks.
Student health and counseling records sit on the boundary between the two laws, and the answer changes by office. We map which records fall under which rule and write policy the registrar, the clinic, and the counseling center can all follow.
Academic units run their own systems and hire their own vendors, and central IT finds out later. We build governance that fits that reality: a standard baseline, and a practical way for units to meet it.
Round-the-clock detection across endpoints, identity, and cloud, with people reviewing what the tooling raises. For a two-person security office, it means someone is reading the overnight alerts and calling you when one matters.
A district holds Social Security numbers, health records, family financial data, and years of behavioral history on minors, and the team defending it is usually smaller than the front office. We have worked with districts since the company started, and the superintendent's board packet is a document we know well.
A student's identity stays clean until they apply for their first loan, which is why student records sell at a premium. We review how student data moves through your SIS, your assessment platforms, and your vendors, and we write the policy that keeps FERPA and CIPA obligations in one place.
MS-ISAC moved to paid membership in October 2025 when its federal funding ended, and federal grant dollars can't be used to pay the dues. Many districts lost round-the-clock monitoring as a result. We provide it, priced for a district budget, with people reviewing the alerts.
A risk assessment a superintendent can take to the board, controls documented the way a cyber insurer wants to see them at renewal, and Google Workspace or Microsoft 365 hardened before the next audit finds what was left on default.
We work alongside your existing IT organization. The retainer covers a named security leader, the compliance calendar, board and cabinet reporting, and a tabletop exercise with the people who would be in the room during an incident.
A named security leader on call for the superintendent and the technology director, policy that survives an audit, staff training that fits in a professional development day, and monitoring that replaces what MS-ISAC used to provide.
Two moments bring most institutions to us: the security leader just left, or something has already happened. We hold the seat while you hire. In an incident, we stay through disclosure, the insurance process, and the rebuild.
A public institution needs a number it can put on a requisition and a path through procurement. Here is how that works with us.
The unexpected loss of our IT Director was more than just a vacancy; it felt like losing a friend and a vital member of our community. In those moments of vulnerability, we realized we needed more than just a service provider; we needed a trusted partner. That's when we turned to TriVigil.
Whether it is an auditor asking who your Qualified Individual is or a board asking about ransomware, start there. The first conversation is free and takes about half an hour.
