Education IPL Playbook: Information Governance
Variable data governance, chain of custody on regulated content work, where regulated jobs actually get printed, and the vendor case. The information governance work the in-plant leader owns, and translates for the coalition.
Transcript runs. Accommodation packets. Admissions files, donor mailing data, financial aid updates, benefits enrollment materials. When work like that comes through the shop, it arrives as institutional data and it leaves as a record, or it leaves as a gap.
What the institution needs is not a completed job. It is an answer: what came in, who touched it, how it was produced, where it went, and what happened to the source files afterward. That answer is in your hands while the work is in your shop. When the work goes outside, it is the vendor's agreement that decides whether the answer continues, and that agreement is not usually the in-plant's to write.
This playbook builds that answer one module at a time, and helps you say it to the people who judge the institution's governance posture from five different chairs.
Stage 1 of 6 · See the Need
These five are stages in the life of a regulated job rather than services a shop either offers or does not. Mark the ones that run cleanly where you are, and the ones that do not. Nothing is saved and nothing is sent. What you mark points you at the module that fits. One answer per row, and clicking it again clears it.
Knowing which jobs touch sensitive data
An inventory anyone can check, or a general sense of which work counts as regulated.
Coalition Compliance Officer · Audit Committee
Receiving source files from a department
How a donor list, an applicant file or a student data extract reaches the shop, and what happens to it once the job has run.
Coalition General Counsel · Compliance Officer
Knowing where regulated jobs actually get printed
Regulated work runs on devices across the campus or district. Whether anyone has mapped which ones.
Coalition IT Director · Compliance Officer
Answering a records question later
Someone asks what happened to a job from last term. Where the answer comes from, and how long it takes to produce.
Coalition Compliance Officer · General Counsel
Sensitive work handled outside the shop
Recurring jobs an outside provider produces with institutional data attached, including paper records sent out for scanning.
Coalition CFO · General Counsel
When one of these does not run cleanly, nothing visibly breaks. That is what makes it a governance problem rather than an operations one: the job still goes out on time, and the exposure simply goes unrecorded. Unrecorded is not the same as safe, and that belongs in the conversation.
Stage 2 of 6 · Select the Module
Each module is one governance discipline you can learn and work on your own. Each one produces a proof point you post to your Outcomes Scorecard, at stage 5. You do not need all four.
Most of the fix starts before production, at the moment a file arrives. A job whose source system nobody wrote down, or whose retention nobody set, is a documentation gap before it is a technology gap, and that is where every one of these starts.
What you do: License a variable data composition platform inside the shop, connect it to the institution's systems over secure channels, apply role-based access, and log six fields on every job: source file, source system, template, access, verification, disposition.
Proof points
Already know you need variable data composition in house?
Compare variable data software at SumnerOne.comWhat you do: Pick one sensitive workflow already moving through the shop and define the ten-field record the shop will keep on it, from the requestor through to the retention or destruction action. Then sample ten jobs a quarter and score them.
Proof points
What you do: Walk one sensitive workflow with IT and Compliance and answer three questions together: which devices the work touches, which of those nobody has inventoried, and whether the in-plant could absorb the work instead. The shop brings the workflow picture; the fleet decision stays with IT.
Proof points
What you do: List the recurring print jobs that leave the institution with source data attached, and for each one capture the owning office, the provider, what data goes with it, the agreement status, and whether the shop could produce it today.
Proof points
Costing out bringing records digitization home?
Compare scanning and capture solutions at SumnerOne.comStage 3 of 6 · Build the Coalition
Up to five people judge the institution's information governance posture, each from a different chair, and each tends to want a different proof point from the shop. Rarely do all five matter at once. Mark the ones that do where you are, starting with whoever feels the gap you just picked. One answer per row, and clicking it again clears it.
General Counsel
Cares where institutional data leaves institutional control, and whether the in-plant can be the alternative that keeps it inside.
Compliance Officer
Usually the FERPA owner. Cares whether the shop can show what happened to a regulated job from documentation rather than from reconstruction.
CFO
The business manager in a district, the CFO in a college. Cares about cost visibility, and about whether the vendor case would hold up if the board or the auditor asked.
IT Director
Or the CISO. Cares whether print workflows are visible enough to be governed, and what a network scan on its own cannot show.
Audit Committee
Or the board IT subcommittee. Cares whether print has been brought into the institution's governance posture at all.
Stage 4 of 6 · Run the Test
A test is not an audit of the whole shop. It is one change, on one sensitive workflow, measured against what that workflow was doing before you touched it. The method runs on roughly a quarterly rhythm, in two parts.
First, the baseline
Take the workflow your module touches and write down what it does today: who owns it, what source data it uses, how the file reached the shop, who had access, what was produced and how that was verified, how delivery or mailing was confirmed, what happened to the file afterward, whether an outside provider was involved, and what documentation is missing. A transcript run, an accommodation packet cycle, an admissions or donor mailing, a benefits enrollment kit and a financial aid communication all make good candidates. If your system already reports that, this is an afternoon. If you have to collect it by hand, give it a few weeks.
Then, the change
Make the one change your module describes, on that one workflow, and hold it long enough for the same record to mean something.
One sensitive workflow. One change. A reading before and after. The completed test is the difference between the two readings.
Stage 5 of 6 · Capture the Evidence
These six are the information governance rows of your Outcomes Scorecard, and each is written the way you would say it out loud, because that is the form it has to survive in. A metric nobody can pronounce in a meeting is not evidence yet. If you only start with three, start with the first three.
Ask us what happened to any regulated job this quarter and we can answer from records, not memory.
The number that travels furthest here. It is built from the shop's own records rather than from a fleet report, which is why it is the one to start with.
Your donor file never left the building. Here is the access log that proves it.
Whether personalized work stayed inside the institution's data handling envelope, or went out with the source file attached to it.
Here is every outside provider holding institutional data, and what their agreement actually says about holding it.
The exposure that usually has no owner, counted. It is a General Counsel number and a CFO number at once, and it is assembled from a list rather than from a system.
You asked for the March transcript run's records. Here they are, same day.
Whether the record is usable under pressure. Completeness says the record exists; this says it can be found when someone is waiting.
Here is the printer nobody inventoried, and here is what it has been producing.
Regulated work happening outside the governed path. A network scan finds the device; the workflow picture is what says whether it matters, and that picture is the shop's to supply.
Here is what we spend with each outside provider, and what moving it in house would save.
The money half of the vendor question, tied to offices and functions rather than sitting as one line in a budget.
These six are the recurring core, and the first three sit closest to the in-plant's own authority: they can be built from shop records without waiting for anyone else's system. Each module adds its own proof points on top, so the board grows as the shop does.
Stage 6 of 6 · Share the Story
The people who judge the institution's governance posture are unlikely to want the playbook. What travels is one number, in their own language, about the thing that changed. So this is the message, already written, with one blank in it for the number your test produced.
Your marks in stages 1 and 3 are what this uses. A note is about one part of the flow and one person, so if you mark more than one you choose which. We start you on what you said needs work, ahead of what is already running well, because the thing worth telling someone is the thing that changed.
Eyes on the prize, not a cost center
Cost Center and Consulted are both documentation gaps rather than technology gaps. Crossing from Consulted to Trusted Producer is what turns a good habit into auditable practice, and it is what gives Compliance and General Counsel something to work from. Working one module all the way to a posted proof point is how you cross it.
You do not have to climb all four levels this year. One module, carried to a number you can post, is the foothold. That is the prize this playbook is built to reach.
For your coalition partner
Need to bring your IT director, CFO, compliance officer, general counsel or audit committee up to speed on why this matters?
The Education Information Governance and Compliance pillar page is written for them rather than for you. It explains why print belongs in the institution's information governance posture, how sensitive information moves through print and scan workflows, and where documentation, vendor exposure and device governance need attention.
Use this playbook to prepare the proof. Send them the pillar page so the meeting can start somewhere past the explanation. See the Education Information Governance and Compliance pillar page →
Frequently asked questions
Four disciplines can sit with the shop rather than with IT: variable data governance, which keeps donor, applicant and recruit data inside the institution's data handling envelope; chain of custody on regulated content work; visibility into where regulated jobs are produced across a fleet the shop does not own; and the vendor analysis that shows how much sensitive data goes to outside providers today. Fleet security configuration itself typically belongs to IT. What the shop brings to that conversation is the workflow picture behind the devices, which no network scan produces.
Variable data governance means keeping the source data for personalized print work, including donor PII, applicant data, recruit data and financial aid information, inside the institution's data handling envelope rather than handing it to a commercial vendor. What that agreement says about how the file is held, by whom, and for how long is the question worth asking before the file goes. The in-plant is the alternative: the same cultivation, recruitment and enrollment work produced inside the institution's domain, governed by institutional access controls, with a record that does not break at a vendor boundary.
For a regulated content job, whether that is accommodation print produced under the institution's IDEA or Section 504 obligations, student records print, advancement data print or admissions data print, the record to maintain runs to ten fields: requestor, source file name, source system, date received, record count where it applies, access by role or operator, production method, output verification, delivery or mail confirmation, and the retention or destruction action the institution's own schedule requires. Then build a quarterly practice: pull a sample of ten regulated jobs per category, score each one for traceability, fix the gaps, and write the audit down. The aim is that a compliance officer's question is answered from shop records rather than reconstructed from memory.
The in-plant is not deploying the fleet security platform. That is IT's domain, which is also why fleet security posture is not one of this playbook's scorecard rows. The in-plant's role is to carry the print workflow half of the conversation: which regulated work moves through which devices, why an unclaimed job in an output tray is a different exposure than a routine print job, and where a device nobody inventoried is producing sensitive work. Securing the fleet is not the in-plant's to do and not its budget to spend. Knowing which regulated jobs run on it is, and raising that with IT and Compliance is influence rather than ownership.
The analysis runs on two dimensions: unit economics against in-plant production at the institution's actual volume, and data handling posture, meaning what the agreement contains, whether the provider holds SOC 2 or ISO 27001, how files are transmitted, and what the retention and destruction terms say. The savings argument follows the same inventory: what is visible can be held to account, what is accounted for can be right-sized, and right-sizing is where a cost case comes from. A projection built on the institution's own volumes is the one that survives review.
When you are ready
The In-Plant Outcomes Program is this same work, self-guided, with SumnerOne available alongside it. You run the module and you own the outcome. Bring us in when you want another set of eyes on the right sensitive workflow, on getting a baseline worth measuring against, or on translating the result into the language your institution's coalition can use.
One sensitive workflow. One module. One quarter. That is enough to begin.