Contractors are often responsible for data breaches, including defense contractors. How do you enforce data security standards in contracts and in practice?
That's above my pay grade to solve, but is obviously needed.
You simply engineer your services to not need contractors...
Would it take a ton of capital, intellectual, and cultural investment over the long term? Sure.
But that's the price you pay for security.
Agreed. Three years of student data leaked is pretty severe and a major FERPA violation.