risk asessment in edu

[reflect ocean <reflect.ocean () GMAIL COM>]

Hi.Recently I've been assigned information security responsabilities
and my first step is to determine what assets the organization wants
to protect.i'm struggling trying to come up with something else rather
than student data.
I definitely have a better understanding from the point of what
controls I have to implant (firewalls,ids,incident response
teams,etc...).the stage where i am is assets evaluation according to
some information secruity standards and after that i would continue
with risk assessment.
Has anyone conducted any of these assessments? What risks in terms of
information security do the educational organizations face?
Thank you

reflect.