CyberSafeCheck Free · No sign-up · Instant score, action plan and PDF report · Mapped to Essential Eight, ISO 27001, Privacy Act, SMB1001
Why schools and training providers are targeted
Schools and training providers have lots of users, lots of devices and lots of cloud platforms, usually looked after by a small team. Phishing, reused passwords and weak sharing settings on learning platforms are the common ways in.
A breach of student information is particularly serious because it often involves minors, and families expect their information to be handled with care.
What the education & training check asks about
The quick check has 20 questions and the full assessment 43. Both cover the fundamentals every business needs (access and passwords, devices and updates, email and phishing, backups, governance and data protection), plus questions specific to your sector:
- Student data & minors' privacy
- Learning platform / portal security
- BYOD & shared-device management
- Online safety / safeguarding
- Staff & HR data
You get a score out of 100, a breakdown by area and a prioritised action plan that shows which framework each recommendation relates to.
Obligations that may apply to you
- Privacy law. Non-government schools, RTOs and training providers with annual turnover above $3 million must comply with the Privacy Act and the Notifiable Data Breaches scheme. Government schools are covered by their state's privacy laws.
- Student identifiers. RTOs that collect Unique Student Identifiers must protect them under the Student Identifiers Act.
- Child safety. Child safe standards and online safety expectations mean filtering, supervision and careful handling of children's information.
- Ransomware payments. Organisations with turnover above $3 million must report a ransomware payment to the Australian Signals Directorate within 72 hours.
Four things to do first
- Turn on multi-factor authentication for staff email, the learning platform and student management system
- Restrict access to student records to the staff who need them
- Keep student and guest devices on a separate network from administration systems
- Store staff HR and working-with-children records with tight access controls
Start the free education & training check
Frequently asked questions
Does the Privacy Act apply to schools and RTOs?
Non-government schools, RTOs and private training providers with annual turnover above $3 million are covered by the Privacy Act. Government schools fall under state privacy laws instead. Either way, student information should be treated as sensitive.
What are the biggest cyber risks for schools?
Compromised staff accounts through phishing, poorly configured sharing on cloud and learning platforms, and unmanaged devices on the same network as administrative systems. Multi-factor authentication and network separation address much of this.
Is this check an audit?
No. It is a free self-assessment with an instant score and action plan. It is not a formal audit, certification or legal advice.
This page and the assessment are general information and an educational guide to your security posture. They are not a formal audit, certification or legal advice.