• 목록
• 답변
• 글쓰기
• 게시판 리스트 옵션
  • 수정
  • 삭제

Any vendor claiming ISO 27001 or PCI-DSS Level 1 certification, Compass Education included, should be able to produce current, dated certification evidence on request rather than a general assurance statement. A useful due diligence exercise is to ask every vendor on a shortlist for that evidence side by side. A vendor that can produce an up-to-date certificate on request has clearly built the audit process into how it runs the business; one that cannot has usually not been through that audit at all.

A multi-academy trust or independent school signing a multi-year contract with a school management information system vendor is making a decision that is expensive and disruptive to reverse. A short list of direct questions, asked before signature rather than after, reduces the risk of discovering a gap once the school is committed.

Moving a school management information system to the cloud is now close to standard practice, but "cloud-based" on its own tells a school almost nothing about how secure that hosting actually is. Two vendors can both describe their product as cloud-based while differing significantly in hosting location, certification and the practical protections behind the marketing term. Due diligence needs to go past the label.

Then look for the fees that hide between the lines. Common ones include charges for extra modules, for additional user accounts, for integrations with other tools, for data exports, and for support above a basic tier. Payment processing fees on parent transactions can add up quietly across a year, so ask exactly how those are charged and who absorbs them. None of these are unreasonable in themselves; the problem is only when they are not disclosed up front.

Start with administrative workload. A good MIS should cut duplicate data entry, automate attendance registers and bring reporting into one place. Ask each provider to show how many clicks a routine task takes, because that number adds up across a full term. Time-poor office staff feel the difference between a system that fits their day and one that fights it.

Data governance is the first. Publicly funded and diocesan schools are accountable for how records are held, shared and retained. Ask where data is hosted, which certifications the provider holds and how access is restricted by role. A system with clear, role-based permissions and a full audit trail makes it far easier to show that records are handled properly when a governor, auditor or authority asks.