Text · page 7 of 12
Appendix A: Profile, Criteria and Resources Profile The District serves the Towns of Brant, Collins, Concord, Eden, Evans and North Collins in Erie County. The District’s buildings are located on campuses in the Town of North Collins. The District is governed by the elected seven-member Board. The Board is responsible for managing and controlling the District’s financial and educational affairs. The Superintendent is responsible, along with other administrative staff, for managing the District’s day-to-day operations under the Board’s direction. The District Clerk is responsible for initiating requests to add, modify and revoke employee accounts and their associated badges. Department heads are responsible for initiating requests to add, modify and revoke non- employee accounts and their associated badges. The Director 2 and technology department staff are responsible for managing and monitoring accounts by utilizing the system and printing and issuing badges to individuals which are then distributed either by the technology department or other department heads. Criteria NYSED’s Safe Schools by Design Act guidance 3 provides that, as the second line of defense when protecting a building and its occupants, building entry should maintain a welcoming exterior while ensuring safety and security, such as using credentialed electronic access systems. The Cybersecurity and Infrastructure Security Agency’s (CISA) K-12 School Security Guide 4 recommends schools should have in place a layered, system- based approach to physical security in which physical security equipment and technology, site and building features, personnel and staff, policies and procedures, and training programs work together to ensure school facilities are secure. Policies and Procedures – Schools should develop and implement physical security and access control policies and procedures with roles and responsibilities defined and assigned across its organizational entities (e.g., IT, Human Resources (HR), administration, facilities etc.). Policies and procedures should be established to manage, monitor and revoke building access devices and other access credentials as necessary. The policies and procedures should be periodically reviewed and updated to reflect the current and approved access controls implemented within the system and organization. Building Access/Entry – Schools should control who can enter school buildings, where they can go, and when access is permitted. Building access systems serve as an internal control to help ensure safety and security including controlled entry points, visitor management, and monitoring building access. Internal controls over building access/entry should be designed in a way that primary entrances are controlled through device readers, security desks, or locked-door systems. Building Access Account Management – Only designated system users/administrators should be able to create, enable, modify, revoke and remove accounts in accordance with documented policies and procedures. System administrators for access management should be limited and have clearly defined roles and responsibilities. Account management processes should align with individual status changes, such as extended leave, termination or other circumstances when access is not required. Device Issuance and Authorization – Devices should only be issued with documented approval based on job role and building assignment, each device should be unique and individually assigned. Each individual should 2 The Director was hired in September 2025. 3 https://www.nysed.gov/sites/default/files/programs/facilities-planning/safeschoolsbydesign-aguidebynysed-april2025.pdf 4 https://www.cisa.gov/sites/default/files/2022-11/k12-school-security-guide-3rd-edition-022022-508.pdf 5