Regent Education prides itself on maintaining a best-practice-driven security program, fueled by a commitment to safeguarding our client’s data and their systems. In an evolving threat landscape marked by increasingly sophisticated attacks, Regent Education continues to enhance its security posture through adaptive controls, modern frameworks, and a proactive approach to risk management.
As colleges and universities continue to adopt cloud-based applications, and remote access continues to rise, so, too, do the risks. According to IBM’s 2024 Cost of a Data Breach Report, organizations that are not well-prepared face breaches averaging $4.88 million—making investment in security programs not just prudent, but essential.
At Regent Education, our dedication extends beyond compliance—it is embedded in the culture, infrastructure, and operations that serve as the foundation for our trusted client partnerships. Let’s look at some of the many security protocols we’ve put in place to safeguard our clients, their data, and their systems.
Culture of Security
Regent Education’s security program is based on the NIST Cybersecurity Framework and is governed by our Security Committee, a cross functional team of leaders charged with developing and maintaining Regent Education’s Information Security Program. All staff are required to attend security awareness training and are exposed to phishing campaigns on a regular basis. This training is aimed at continuously raising the vigilance of our staff.
Enhanced Security for CUI and '24/'25 New FAFSA Requirements
Regent Education is also fully compliant with the Controlled Unclassified Information (CUI) requirements stipulated by the Department of Education for the implementation of ‘FAFSA Simplification’ beginning with the 2024-2025 Federal Award Year. Federal Taxpayer Information (FTI) received from student FAFSA applications is maintained separately and labeled as CUI within the database, in the user interface, and in outputs such as printed ISIR records. Regent Education offers very granular role permission configuration options to control user view and/or edit access to various types of student data in the system, including the ISIR information that includes FTI.
Configuration Management
Regent Education deploys all its systems through a standard methodology and inclusive of any changes for product, environment, and network security changes. We review and update these processes regularly to ensure they continue to conform to the latest trends and recommendations for a secure network.
Regent Education also reviews and upgrades its layered approach to network security constantly. Inclusive of additional encryption within the network based on utilization of the company’s WAF, hardened systems, and ransomware resilient backups, we work to minimize the attack surfaces that could impact client data and operations.
Continuous Improvement
Regent Education continuously evaluates the threat landscapes and evaluates its systems to ensure they remain protected and secure. We maintain our systems to the latest recommended standards and ensure that operating systems and devices are not at risk of lapsing into an unsupported version.
In addition, we recently began to upgrade our Azure application gateways and WAFs to the latest version ahead of the 2026 end of life of these devices. We also test new releases of our software on the most current Azure hardened virtual images to mitigate potential threats.
System Monitoring
Regent Education performs frequent vulnerability scanning to assess the quality of the overall control environment and takes corrective actions to address deviations. We base our system configuration on Center for Internet Security (CIS) and National Institutes of Standards and Technology (NIST) guidelines. In addition, we refine alerting based on industry trends and analysis. We monitor all systems in a centralized SIEM that is supervised 24/7. And, we perform scans on operating systems, cloud services, applications, and API’s regularly. All identified discrepancies are put through the company’s change management process and mitigated.
Compliance Efforts
Regent Education maintains several certifications and meets rigorous regulatory standards. The organization holds AICPA SOC 1 and SOC 2 certifications and complies with key frameworks including TX-RAMP, SCHEV, and other state and local security requirements.
Cloud Security and Testing Practices
Recognizing the unique challenges of cloud-native environments, Regent Education has embedded extensive testing procedures into our security program to provide visibility and assurance across both internal and external threat surfaces. Annual penetration testing simulates real-world attack scenarios to identify exploitable weaknesses in externally exposed assets and internal systems alike. These assessments reflect the shifting dynamics of the cloud, where perimeter security is no longer sufficient.
Beyond traditional penetration testing, we also conduct Cloud Security Posture Assessments (CSPAs) to evaluate configuration hygiene, IAM roles, and the potential for privilege escalation. These audits are critical in a landscape where misconfigurations account for the majority of cloud breaches.
At Regent Education, we‘ve established the right internal teams, processes, and structures to give our customers peace-of-mind that their financial aid and fund management solutions—and the data within them—are protected and secure. For more detailed information about our security and privacy procedures, protocols, and certifications, please view our privacy policy.
