My question involves education law in the State of: Suffolk county, Long Island, New York

Like most schools, our district also has a "parent portal". It is only accessible by registered guardians who have a child currently attending in the district.
Student bus schedules are located on the portal. Years ago they used to be mailed to parents. I don't know exactly when they stopped being mailed.

A few days ago someone posted the bus schedules on our local parent's page (which is closed--not public) and quite a few thought it shouldn't be posted due to "security". The person that
posted them said they had been posting them for years without incident. I never saw them so I don't know. I've been speaking with someone about this
and they said the bus company said it was a "direct violation of school security. It is deemed a danger to the students and parents of the district.". It was also
stated that the superintendent and other higher ups " sees this as an extreme violation to school , student , and parent security".

I'm trying to find out where this lies in terms of the law. There is no law that states these schedules cannot be posted outside of the portal. It's a "policy".
My understanding (ok... opinion.. and possibly fact, that's why I'm asking) is that a policy and a law are two different things. How can a policy be enforceable by law?
Just because someone "sees" it as a danger doesn't mean it is. That's opinion. Not fact. Opinions are not covered by law.

I've asked the person who told me this info to find out where it's written that it's a danger to students to post schedules.

Subsequently the schedules were taken down by the admins. I personally think she has every right to post them. If the admin wants to take them down that's fine since
they run the page.

Any input would be greatly appreciated. Thank you.