FERPA protects a parent’s right to access their child’s education records. Those rights are held by the parent, and noncustodial parents are included unless a court has restricted access. In practice, this means a noncustodial parent can inspect and obtain disclosures of the student’s records without the student’s consent, provided there isn’t a court order or state law that says otherwise. If a court order limits a parent’s access, schools must follow that order. So, generally, noncustodial parents have the same access as other parents under FERPA, making the statement true.

Many attacks today rely on exploiting people as the entry point into an organization. Phishing directly targets employees by sending deceptive emails or messages designed to trick them into revealing credentials or clicking a malicious link or attachment. Password spraying focuses on employees by trying common or reused passwords across many accounts, taking advantage of weak password practices across the workforce. Malware often reaches employees’ devices because they click a malicious link or open an infected attachment, giving attackers a foothold on the network. Since each of these tactics can involve leveraging employees or their devices, all of these are ways attackers target employees today.

FERPA requires annual notification of rights to parents and eligible students, and the way that notice is delivered matters for making sure people actually know their rights. The best approach is to provide it in a place likely to be seen. Posting the information in a public, easily accessible location—such as the school or district site, a visible bulletin in the building, or in materials that families regularly read—helps ensure every family and student becomes aware without having to request it. While mailing the notice or including it in a student handbook can also work, relying only on requests or a single document isn’t as reliable for ensuring broad, ongoing awareness.

Verifying a website’s legitimacy comes from confirming a secure connection and a valid identity. When a site uses HTTPS and presents a valid certificate, with a padlock icon shown by the browser, you have visual indicators that the connection is encrypted and the site’s identity has been validated by a trusted authority. HTTPS means data between you and the site is protected from interception, while a valid certificate means the site’s certificate is issued by a trusted authority, is not expired, and matches the site’s domain. The padlock icon is a quick cue that these checks have passed, giving you more confidence before entering any sensitive information. Taking a screenshot and sharing with colleagues doesn’t verify legitimacy. Ignoring certificate warnings bypasses critical protections and can expose you to attacks. Entering sensitive information just because a site loads quickly is risky, since speed doesn’t confirm legitimacy and phishing sites can load rapidly as well.