Student records, unique student identifiers, audits, and insurance renewals that ask harder questions every year. The compliance load on a registered training organisation, or RTO, has quietly doubled since 2020. Staffing at most of the RTOs we work with has not.
Live right now · rtos and training organisations
Regulatory changes with dates already set, and what each one asks of you.
Replaced the 2015 Standards on 1 July 2025. Tighter information-management, recordkeeping, and evidence-integrity expectations the RTO IT environment has to operate against under audit.
Read the full guideWhat's being asked of you · rtos and training organisations
The 2025 Standards for RTOs moved governance out of the policy folder and into operations. Standard 8 expects you to demonstrate, with evidence, that information management, records retention, identity and access controls and information-asset risk handling work as documented. Auditors from the Australian Skills Quality Authority, ASQA, now ask to see the controls running rather than the policy describing them.
Several other rules apply at the same time. The Privacy Act covers student data the way it covers any personal information. The Notifiable Data Breaches scheme means a student-record breach is not a private matter. Unique student identifier handling rules apply, as does the security of AVETMISS submissions to the national vocational training data collection. Delivering online or hybrid adds the learning management system, the proctoring stack and every third-party integration behind them.
Insurance questionnaires for RTOs are past the polite stage. Insurers want evidence of multi-factor authentication coverage, patch cycles, offboarding discipline, backup testing and incident-response readiness. An RTO that cannot evidence them sees renewal terms harden, or cover declined outright.
What we do · Map, build, maintain
What you get is an IT environment that can substantiate what your documentation claims. Student records, unique student identifier handling, assessor credentials, trainer currency evidence. Most of it is held in the stack. Auditors under the 2025 framework ask how records are stored, who can reach them, and what happens when a trainer leaves.
In practice that means identity management matching your organisational chart. Retention rules that hold student records for the required periods without keeping everything forever. Backup discipline an auditor can verify. For online or hybrid delivery, the same controls extend to the learning management system, the assessor portals and any proctoring or integration you rely on.
The cycle is continuous rather than audit-driven. Gap analysis against the Standards and the funder obligations you hold. Monitoring across student-records systems and the learning management system. Remediation when something drifts. Evidence that produces the report an ASQA auditor or a state training authority expects. The next audit becomes a confirmation rather than a discovery.
We do not write your training and assessment strategies, your validation reports or your compliance documentation. We make sure the IT behind that documentation stands up under audit. The 2025 Standards expect outcomes the environment has to deliver, so we configure the systems until the documentation and the operational reality match.
The tools and the role · the operational toolkit
Whichever framework you are measured against, it asks for roughly the same operational set. These five we run as a service, so the framework cycle is a continuing operation rather than an annual scramble.
Security information and event management, or SIEM, collects logs from your devices, identity, network and cloud services. The alerting answers 'are we under attack right now' rather than 'were we under attack last quarter'.
Allowlisting stops unauthorised executables running on managed devices. One of the highest-impact Essential Eight controls, and one of the hardest for in-house IT to operate without breaking the business. We run it as a service, exception handling included.
Most providers run a scanner and email you a list. We run the scanner and do the labour-intensive remediation work that actually closes the vulnerabilities inside the thirty-day window most frameworks expect.
Annual training your staff actually complete, plus phishing simulations that escalate rather than scold. Your compliance officer gets the completion reporting they can show an auditor or an insurer.
Strategic IT advice, framework gap analysis, board-level reporting, risk register maintenance and vendor management oversight. That is the virtual chief information officer, or vCIO, role most firms our size cannot resource internally.
More on our vCIO serviceWhat goes wrong · for rtos and training organisations
The one that catches RTOs out starts with a confident answer pointing at a policy document rather than an operating control. The auditor or the insurer accepted it at the time. Eighteen months later a breach asks for proof the control was running in the relevant period. The proof has to come from logs nobody configured to retain. The audit finding or the declined claim is the cost of that gap, and designing the evidence in from the start avoids it.
Already included · baseline plan
The controls we require are the minimum for every CCP client, RTOs included. Audit-adjacent overlays layer on top of that. Retention schedules for student records, trainer credential tracking, access-review discipline. Where you hold funding-body obligations beyond ASQA, from state training authorities, TAFE partnerships or federal programs, we handle those per engagement.
Compliance is an overlay against the baseline, not a separate product. The Managed IT + Compliance plan exists for RTOs with continuing ASQA exposure and active state-funded scope. RTOs with simpler obligations can run the baseline plan and add overlays where a funder or an insurer requires them.
Some of it stays with you. The training-product work, the assessment validation, the trainer currency assessment, the AVETMISS data quality review. Those belong with your compliance team and your training-and-assessment leads. We provide the IT and evidence machinery the audit conversation depends on.
Common questions
Next step · start with the evidence
Ten minutes of questions gives you a PDF report on your Essential Eight maturity. Hand it to your compliance officer, your insurer or your board the same day. If you want to check we are the right shop for the work, start with the fit check.
