Investigators said Carroll had district level access of the school board’s program. System users are required to change their password every 45 days, and Carroll’s annual training for the “Staff Responsible Use of Guidelines for Technology” was up to date, the agency said.