Domain 5 - Digital Citizenship, Ethics, Safety, and Security
This domain tests compliance and incident handling: filtering obligations, acceptable use, authentication, backup, breach response, copyright, and student privacy. Items often present a staff request that would weaken a control and ask for the correct response.
Core rules and concepts
- CIPA requires a technology protection measure that blocks or filters visual depictions that are obscene, child pornography, or harmful to minors, plus an AUP and instruction on appropriate online behavior, including cyberbullying and social networking.
- Security baseline: multifactor authentication on administrative and email accounts, prompt patching, least privilege, phishing reporting, and 3-2-1 backups (three copies, two media, one offsite).
- Incident response follows a repeatable sequence: identify, contain, eradicate, recover, then document lessons learned. Preserve logs before rebuilding.
- Copyright: the four fair-use factors are purpose and character, nature of the work, amount used, and effect on the market. Creative Commons licenses grant permissions in advance.
Worked example
A chemistry teacher asks that a simulation site be unblocked; the filter tags it as games. Reasoning: category-wide unblocking would remove protection for minors and jeopardize CIPA compliance. Correct steps: verify the specific URL and reputation, confirm the vendor's data privacy terms, apply a scoped allow for that teacher's organizational unit, record the approval, and leave the category blocked. Filtering stays in force for everything else.
Traps that cost marks
Turning off the filter for convenience; treating filtering as the only security layer; assuming the AUP alone satisfies CIPA; rebuilding a compromised machine before capturing logs.