Skip to main content
HackFirstAidEducation
All vendors

Productivity / Identity

Google Workspace for Education

Identity, email, Drive, Classroom for most US K-12 districts.

Escalation path

  1. File a P1 case in the Google Workspace Admin Console (Support → Cases).
  2. If account compromise is suspected, suspend the user, revoke OAuth tokens, and rotate.
  3. Pull the Login and Drive audit logs immediately — Workspace for Education retains them, but export early.

Contract clauses to pull up

  • Google's K-12 Data Processing Amendment covers FERPA. Confirm the COPPA addendum is signed for under-13s.

Pair with these playbooks

Student Google Workspace / Microsoft 365 takeover

Compromised student account — and the triage 'is this a real compromise or a student prank?' decision tree.

Teacher email / BEC

Compromised teacher mailbox — gradebook variant (transcripts) and the payroll-redirect variant (paycheck reroute).

Family communication after a breach

Templates by severity tier — SIS down one day, vendor PII breach, ransomware affecting operations, sextortion involving a student.