When Campus Safety Laws Meet Cybersecurity: The Digital Implications of the Jeanne Clery Act
Digital transformation has made the Clery Act's physical safety mandates a cybersecurity compliance issue.
- By Michelle Drolet
- 04/09/26
In December last year, a shooting incident at Brown University saw two students lose their lives, and left nine injured. And on March 12, an active shooter killed an ROTC instructor at Old Dominion. Tragically, it seems like such disturbing news from university campuses is becoming normalized. Federal authorities have opened an investigation into Brown, digging into the 'how' of the incident, and whether the campus violated the Cleary Act. Campus security must continuously reassess whether its safety frameworks are truly prepared for emergencies.
It's not as if a regulatory framework to ensure campus safety and transparency around incidents does not exist. The Jeanne Clery Disclosure of Campus Security Policy and Campus Statistics Act is one of them. A 1986 tragedy was the driving force behind the Clery Act. The ensuing investigation found the campus had a history of undisclosed violent incidents.
Anatomy of the Clery Framework
The need for transparency and communication around campus safety defines the compliance obligations of the Clery Act. Institutions that receive federal financial aid are required to prepare an annual security report (ASR) and submit it by Oct. 1. They must diligently record campus crime and include crime statistics covering a three-year period. The ASR must cover campus safety policies. Thorough documentation of criminal incidents in a crime log and their reporting to campus security are mandatory.
Failure to comply can result in fines up to $70,000 per violation and potential loss of federal funding — consequences no campus can afford.
It should never be 'business as usual' for an institution to regularly submit to ongoing threats against its students, faculty, and staff. A timely warning must be sent to the campus community. For any imminent danger, such as an active shooter, provisions must be in place to quickly broadcast an emergency notification to alert students and teachers.
Mobile phones didn't exist when the Cleary Act was introduced. Digital transformation changes the game.
The Clery Act's Relevance to Cybersecurity
The Clery Act is not primarily about addressing cybercrime, but an institution's ability to meet the Act's obligation also depends on its digital infrastructure. Whether it's the ability to report crimes, emergency notification systems, or the creation of an incident database with a historical record of incidents, information flows through networked software systems. The ASR is also compiled using centralized digital records.
Let's dig a little deeper into the intersection between campus safety compliance and cybersecurity.
Emergency notifications are one of the most time-sensitive obligations under the Clery Act. In the past, these would have been delivered by sirens or physical announcements. Today, such notifications are sent through mass notification platforms that can deliver alerts via text message, e-mail, campus mobile applications, and digital signage systems. A disruption or compromise of these systems means alerts might reach the campus community too late, not reach them at all, or worse, attackers could send false messages, undermining response efforts and potentially resulting in avoidable tragedies.
Security Policies Underpinned by Digitization
Under the Clery Act, institutions are required to disclose the policies they use to protect their campuses. Many of these protections rely on digitally managed security systems, e.g., electronic access card-controlled entry to classrooms and residence halls, surveillance systems monitored via networked platforms, and an overall security infrastructure integrated into campus IT environments.
The law doesn't explicitly cover cybersecurity, but the fact that these technologies are baked into the safety measures that universities describe in their annual security reports makes their reliability a strategic imperative. This plays an indirect but critical role in maintaining the security environment that the Clery Act wants institutions to build.
Campus Crimes Extending into the Digital Space
Another intersection that must be explored involves crimes committed via digital communication channels. The Clery Act requires institutions to report specific categories of crimes, including stalking and certain hate crimes. While these offenses may occur in physical settings, they increasingly manifest through online interactions such as social media messages, e-mails, or other digital communication platforms.
In such cases, the use of a digital medium does not exclude an incident from Clery reporting obligations. If the behavior meets the legal definition of the offense and occurs within the institution's reporting geography, it must still be included in campus crime statistics.
Why Risk/Gap Assessments Matter for Clery Act Compliance
By and large, the Clery Act applies to physical security, but as campuses undergo digital transformation, there is an intersection of its requirements with cyber, especially regarding emergency notifications for system-wide threats and other areas.
This is precisely where a thorough risk and gap assessment becomes essential. Without a clear picture of where your security policies, procedures, and physical controls fall short, compliance gaps go undetected until something goes wrong — and on a college campus, that can mean real harm to real people.
A well-executed risk/gap assessment helps security leaders understand their current strengths, identify vulnerabilities before they become incidents, and build a defensible, documented compliance posture that satisfies Clery Act requirements.
The 3 Must-Dos for a Comprehensive Risk/Gap Assessment
- Know what you have — and what's exposed. You can't protect what you can't see. Before you can protect your organization, you need a complete, honest picture of your environment. This means mapping your entire attack surface (inventorying systems, applications, vendors, and data) while also uncovering the hidden vulnerabilities buried in complex, layered IT infrastructure. A data classification review is equally critical, locating sensitive information across databases, files, and cloud drives and evaluating whether the right controls exist to limit exposure.
- Test, prioritize, and right-size your response. Identifying risks is only half the battle. You must also validate them and respond strategically. Running penetration tests through knowledgeable third parties reveals real-world attack paths that internal reviews alone will miss. Build a risk register and prioritize fixes based on actual business risk, not just the loudest alerts. Focus first on quick wins that reduce the greatest exposure, then plan for the heavier lifts. Evaluate your existing security tools and streamline where possible. Reducing complexity not only cuts costs but strengthens overall resilience.
- Make it routine, collaborative, and actionable. A risk/gap assessment only delivers lasting value when it becomes an ongoing, organization-wide discipline rather than a one-time exercise. Threats and technology constantly evolve, so assessments must be conducted regularly. Leadership must set priorities, staff must own their processes, and outside experts should be brought in for fresh perspective. Findings must lead to real remediation, with follow-up checks to confirm fixes.
Know your environment well enough to choose the right type of risk assessment (IT, vendor, cloud, physical, compliance-based) rather than applying a one-size-fits-all approach.
The Clery Act as a Compliance Framework for the Cyber Era
Cybersecurity falls indirectly within the ambit of the Clery Act, as modern campuses comprise complex digital ecosystems in which safety reporting, emergency communication, and security infrastructure are interconnected. The fulfilment of Clery obligations depends on the security and reliability of these digital systems.
A well-executed risk/gap assessment helps security leaders understand their current strengths, identify vulnerabilities before they become incidents, and build a defensible, documented compliance posture that satisfies Clery Act requirements.