{"resourceId":"internet2-netplus-instructure-remediation-20260916","versions":[{"version":"external-fcd3135df3daeacf245a11c231090913eb4c9e1c0ad772e990851391c9b7a6a0","resource":{"id":"internet2-netplus-instructure-remediation-20260916","title":"Internet2 NET+ reports 21 of 47 Canvas remediations complete and negotiates stronger contracts","organization":"Internet2 NET+ Program","sector":"Research and education shared services / higher education IT association","geography":"United States (186 NET+ Instructure Canvas participating institutions)","publishedAt":"September 16, 2026","publicationDate":"2026-09-16","eventDate":"2026-09-16","sourceName":"Internet2","sourceLabel":"NET+ community update on Instructure security incident follow-through","sourceUrl":"https://internet2.edu/how-the-internet2-net-community-is-driving-action-following-the-instructure-security-incident/","evidenceClass":"public-sector-association","outcomeClass":"mixed","topics":["data-security","governance-procurement","operating-model","infrastructure","developers-agents"],"finding":"On September 16, 2026, Internet2 NET+ VP Sean O'Brien described ongoing response for 186 institutions in the NET+ Instructure Canvas program after the May 2026 Instructure security incident. The program convened a Service Advisory Group and an Executive Advisory Group of CIOs/CISOs for remediation oversight and escalation. A contract amendment in negotiation would add clearer exit rights tied to remediation/performance standards, service credits when monthly availability targets are missed, and a clearer breach-notification timeframe. Of 47 security hardening items on the SAG remediation roadmap, 21 were complete at publication, including three 2026 penetration tests incorporating AI-assisted white-box and traditional methods, row-level forensic data for local risk assessment, stronger support MFA and audit logging, and a CrowdStrike connector. Instructure business continuity playbooks are available via customer success managers; a technical deep-dive webinar was scheduled for September 22.","sledRelevance":"Preferred-domain campus-operations signal on consortium leverage after a critical LMS vendor incident—contract protections, shared remediation tracking, and AI-assisted security testing. Why now: dated September 16 and not in the 2026-09-18 edition (which covered TechEX26 agenda, not this remediation status); newly relevant beside Murray State's Canvas-breach context.","evidence":"Official Internet2 HTTPS program blog. Remediation counts and contract terms are association/operator status; full tracker is subscriber-only; amendments not yet executed.","architectureImplications":"Plan LMS resilience as shared-service architecture: forensic data pipelines to campus SOCs, hardened vendor support access, endpoint monitoring connectors, and tested BCP playbooks—not only SaaS uptime dashboards.","governanceImplications":"EAG/SAG show how CIO/CISO consortia can escalate remediation and rewrite exit/availability/breach terms; campuses outside NET+ should ask what equivalent escalation paths they have.","securityPrivacyImplications":"AI-assisted pen testing and granular forensics improve assurance only if campuses can ingest row-level data and verify support-access MFA/logging; residual risk remains while 26 items are incomplete.","caveats":"Program self-report; 21/47 complete is a point-in-time claim. Contract changes are proposed. Does not measure teaching continuity outcomes from the May incident.","streamIds":["campus-operations"],"roles":{"sales":"Campuses buying critical SaaS (LMS) need post-breach remediation transparency and enforceable exit/availability/breach terms. Internet2's NET+ update is consortium leverage—not a product endorsement. Discover whether the buyer has advisory-group voice, forensic data intake, and BCP playbooks with the vendor. Unsupported: claiming 21/47 items complete equals residual-risk free.","engineering":"Integrate vendor forensic exports, support-access audit logs, Crowdstrike-like connectors, and BCP runbooks into campus SOC/ITSM. Prerequisites: NET+ or equivalent contract vehicle and data-handling capacity. Constraints: full remediation tracker may be gated. Proof of value is verifying completed controls against the published categories—not accepting a slide count alone.","delivery":"Delivery is vendor-risk operations: staff SAG/EAG participation, track remediation to local risk register, negotiate amendment language, and exercise BCP playbooks before finals-week outages. Ownership: CIO/CISO with procurement counsel. Acceptance criteria include documented local forensics use and tested continuity steps. Risks: incomplete remediations and negotiated-but-unsigned contract protections."},"roleDetails":{"sales":{"customerProblem":"After a major LMS vendor incident, campuses need collective remediation transparency and stronger contractual exit, availability, and breach-notification rights.","stakeholders":["CIO","CISO","Procurement / counsel","LMS administrators","Academic continuity owners"],"discoveryQuestions":["Do you participate in a consortium advisory group with the LMS vendor?","Can you ingest row-level forensic exports into the campus SOC?","What exit and availability credits exist in the current contract?","Have BCP playbooks been exercised for LMS outage during peak academic periods?"],"valueHypothesis":"Consortium escalation plus hardened contracts can improve vendor accountability after shared incidents—without proving teaching-continuity outcomes in this update.","potentialEngagement":"Three-week LMS vendor-risk readiness review mapping local forensics, support-access controls, and contract gap analysis to NET+-style protections.","unsupportedClaims":["Guaranteed completion of all 47 remediations","Signed contract amendment already in force","Measured reduction in future breach likelihood"]},"engineering":{"fit":"Campus LMS and edtech SaaS under consortium shared-service security and continuity requirements.","architectureIntegration":"Forensic data intake, MFA-gated vendor support paths with audit logs, endpoint monitoring connectors, and BCP playbook integration with ITSM.","prerequisites":["SOC/data lake capacity for forensic rows","Identity controls for support sessions","Named continuity owners for teaching peaks"],"constraints":["Subscriber-only full tracker","26 remediations still in progress","Amendment still negotiating"],"security":"Verify AI-assisted and traditional pen-test findings are remediated; monitor vendor support actions; segment LMS-adjacent identity and data flows.","proofOfValue":["Local confirmation of completed control categories","Successful forensic sample ingest","Tabletop of BCP playbook with academic owners"]},"delivery":{"work":"Track remediation items locally, participate in advisory channels, advance contract amendment language, and run continuity exercises.","dependencies":["Vendor CSMs","Procurement counsel","SOC analysts","Registrar/academic affairs for BCP"],"ownership":"CISO owns remediation verification; CIO owns advisory escalation; counsel owns contract terms.","skillsAdoption":"Train LMS admins and SOC on new support-access logging and forensic workflows.","governanceCheckpoints":["Monthly remediation status to EAG/SAG equivalents","Counsel review of exit/availability/breach clauses","Pre-term BCP exercise"],"acceptanceCriteria":["Risk register updated with open remediation items","Draft or executed stronger notification/exit terms","Documented BCP exercise results"],"risks":["False assurance from partial completion counts","Unsigned amendments during next incident","Playbooks unused during finals week"]}},"retrievedAt":"2026-09-20T03:12:56Z","enrichedAt":"2026-09-20T03:14:53Z","enrichmentBasis":"retrieved source","accessibilityWorkforceImplications":"BCP focus on academic calendar disruptions implies staff/faculty continuity needs; the update does not detail accessibility of alternate teaching channels or labor load of remediation work.","procurementImplications":"Illustrates consortium-scale negotiation of exit rights, availability credits, and breach-notification timing—templates other campuses can demand even outside NET+.","operatingModelImplications":"Moves vendor incident response from one-off campus tickets to standing CIO/CISO advisory governance with shared remediation roadmaps.","sourceVerification":{"openedUrl":"https://internet2.edu/how-the-internet2-net-community-is-driving-action-following-the-instructure-security-incident/","referenceExcerpt":"Of the 47 security hardening items on the SAG remediation roadmap, 21 are complete","promptVersion":"sled-research-v4.0","model":null,"basis":"agent-reported inspection"}}}]}