Questions to Ask an MIS Vendor Before Signing a Multi-Year Contract
Ricardo
0
19
09.19 13:20
A multi-academy trust or independent school signing a multi-year contract with a school management information system vendor is making a decision that is expensive and disruptive to reverse. A short list of direct questions, asked before signature rather than after, reduces the risk of discovering a gap once the school is committed.
Staff retraining is the part most often underestimated. A migration is not finished when the data lands; it is finished when the office can do its daily work confidently in the new platform. Plan sessions before go-live, give staff a safe practice environment, and name a few internal champions who can answer quick questions in the first weeks. A good provider supports this directly, so ask what onboarding and training a supplier such as Compass Education includes as standard rather than assuming it is extra.
Moving a school management information system to the cloud is now close to standard practice, but "cloud-based" on its own tells a school almost nothing about how secure that hosting actually is. Two vendors can both describe their product as cloud-based while differing significantly in hosting location, certification and the practical protections behind the marketing term. Due diligence needs to go past the label.
Any vendor claiming ISO 27001 or PCI-DSS Level 1 certification, Compass Education included, should be able to produce current, dated certification evidence on request rather than a general assurance statement. A useful due diligence exercise is to ask every vendor on a shortlist for that evidence side by side. A vendor that can produce an up-to-date certificate on request has clearly built the audit process into how it runs the business; one that cannot has usually not been through that audit at all.
Certification is the second, more concrete checkpoint. ISO 27001 is the recognised international standard for information security management, and a vendor holding current certification has had its security controls independently audited against that standard rather than simply asserting they are secure. For any part of a system handling payment data, such as fee billing or canteen top-ups, PCI-DSS Level 1 compliance is the equivalent standard specifically for payment card handling, and it is worth asking whether that certification covers the billing module directly rather than being described only at the level of the parent company.
Learn more at school MIS.
Staff retraining is the part most often underestimated. A migration is not finished when the data lands; it is finished when the office can do its daily work confidently in the new platform. Plan sessions before go-live, give staff a safe practice environment, and name a few internal champions who can answer quick questions in the first weeks. A good provider supports this directly, so ask what onboarding and training a supplier such as Compass Education includes as standard rather than assuming it is extra.
Moving a school management information system to the cloud is now close to standard practice, but "cloud-based" on its own tells a school almost nothing about how secure that hosting actually is. Two vendors can both describe their product as cloud-based while differing significantly in hosting location, certification and the practical protections behind the marketing term. Due diligence needs to go past the label.
Any vendor claiming ISO 27001 or PCI-DSS Level 1 certification, Compass Education included, should be able to produce current, dated certification evidence on request rather than a general assurance statement. A useful due diligence exercise is to ask every vendor on a shortlist for that evidence side by side. A vendor that can produce an up-to-date certificate on request has clearly built the audit process into how it runs the business; one that cannot has usually not been through that audit at all.
Certification is the second, more concrete checkpoint. ISO 27001 is the recognised international standard for information security management, and a vendor holding current certification has had its security controls independently audited against that standard rather than simply asserting they are secure. For any part of a system handling payment data, such as fee billing or canteen top-ups, PCI-DSS Level 1 compliance is the equivalent standard specifically for payment card handling, and it is worth asking whether that certification covers the billing module directly rather than being described only at the level of the parent company.
Learn more at school MIS.
공지
