We run a mix of school-owned and bring-your-own devices. Can you manage both?

Yes. School-owned devices enrol into Intune with a managed configuration. Bring-your-own devices either use a managed-app pattern, where school data stays in managed containers and the device stays personal, or a lighter identity-only pattern. The right mix depends on year level, the apps in use, and how much time your IT staff have. We do not push one pattern onto every school.

What about student privacy when we're using third-party learning platforms?

That is a vendor-risk question before it is a technical one. For each platform we build a register. It records what data goes to the vendor, how they secure it, and where it is hosted. The same register covers the contract terms on access, breach notification, and deletion when you leave. We review it with you every year. If a platform cannot show decent security, we flag it and you decide.

We have long-serving staff with accumulated access to everything. Is that an issue?

Usually yes. The era when everyone had admin because it was easier leaves a residue. Dormant service accounts, shared mailboxes with the password written on a note, system accounts that outlived the IT coordinator who created them in 2014. We audit identity during onboarding and give you a prioritised clean-up list. Nothing dramatic, just getting the environment straight about who can actually do what.

We're on the diocese or sector network. Does that mean we're covered?

Partly. Sector-level infrastructure usually covers identity federation and sometimes web filtering. It does not cover endpoint detection and response on your devices, or your Microsoft 365 tenant configuration. Backup, staff security training and your own vendor risk are still your responsibility. We integrate with sector services where they exist and cover the rest.

Can teachers use Microsoft 365 Copilot, ChatGPT Edu, or Claude on student work or records?

Yes, with the right tier and the right policy. Teachers are already using these tools. The question is whether the ones in use have appropriate data-handling terms. Look for Microsoft 365 Copilot under an education agreement, ChatGPT Edu, or Claude for Work. You then need an acceptable-use policy covering what data can be entered, how AI-assisted work is marked, and how parents are told. We have helped schools write policies that allow the tools and set limits on them.

IT and cybersecurity for Australian schools.

Independent and Catholic schools, Australia-wide. You are running student records, a learning platform, a filter, and a mix of school-owned and family-owned devices. We keep that working, keep it evidenced for a Child Safe audit, and schedule the disruptive parts around your term dates.

See if we're a fit

What's actually different

Why student data is harder to look after than ordinary business data.

The records you hold are about children. Parents consented, teachers use them, a dozen third-party platforms process them, and they stay on file for years after the student leaves. Nobody in that chain consented to each step directly, which is why the paperwork matters. It is the consent chain, written down.

Your setup is probably familiar. A Microsoft 365 tenant, a student information system, a learning management system, and a filter and backup somewhere. School-owned laptops next to family-owned ones. A few dozen specialist platforms picked up over the years. The platforms are rarely the problem. Nobody has ever looked at the whole thing at once and made it fit together.

We run that audit during onboarding and sequence the clean-up around your calendar. Some things cannot move during reports, and some cannot move during exams. You get a register of who holds what, who can reach it, and how you would prove it in a Child Safe audit.

Live right now

The 2026 pressure points we're actively working on with clients.

The specific asks, deadlines and enforcement actions shaping 2026 conversations in your sector.

Child Safe Standard 9: online safety is now enforced

State regulators are enforcing the online-safety part of the Child Safe Standards. Every student-facing SaaS tool is expected to be risk-assessed before you deploy it, with a written outcome and a review schedule. Auditors have stopped asking whether you have a policy. They ask to see the risk register.

National Framework for Generative AI in Schools

The national framework is in effect. The 2026 policy updates from AISNSW, AISV and most dioceses require a vendor data-handling review before any AI tool reaches a classroom. That means no consumer AI on school devices and enterprise tiers only. You also need a written acceptable-use policy for teachers and students, and evidence that parents were told.

Vendor risk register for learning and student record systems

Compass, Sentral, SEQTA, Canvas, Seesaw, ClickView, plus hundreds of specialist tools. State bodies and insurers now expect a documented third-party register covering breach history, data-handling terms and what happens to your data when you leave. Since the school data breaches made the news, boards ask about that register directly.

Dedicated security role on the school org chart

Boards at independent and Catholic schools are funding a dedicated cybersecurity role. It might be part-time and in-house, a retained specialist, or a virtual chief information officer supplied by a managed service provider. Parent communities pushed for it after the 2024 and 2025 breaches.

Frameworks and regulators

Industry frameworks, regulations and audit standards for education in Australia.

Privacy Act 1988 and the Australian Privacy Principles: Student information is personal information. Most independent and Catholic schools carry Australian Privacy Principle obligations directly. Government-funded non-government schools often inherit them through sector agreements.
Child Safe Standards: Each state has its own version, and each includes information-handling and record-keeping expectations. Your IT is what enforces them: access segregation, retention, and a record of who opened what.
State accreditation and registration: Registration frameworks for non-government schools include governance expectations that reach into IT risk management. You are asked to show evidence, not assert it.
Vendor risk in learning and assessment platforms: Every learning platform, student information system and assessment tool you use is a third party holding student data. You are increasingly asked to show oversight of those relationships, not just that you chose them.
Essential Eight, from the Australian Cyber Security Centre: Insurers and diocese-level bodies ask independent schools to show Essential Eight maturity. See how Essential Eight maturity levels work.

Common questions

The things education clients ask us first.

We run a mix of school-owned and bring-your-own devices. Can you manage both?: Yes. School-owned devices enrol into Intune with a managed configuration. Bring-your-own devices either use a managed-app pattern, where school data stays in managed containers and the device stays personal, or a lighter identity-only pattern. The right mix depends on year level, the apps in use, and how much time your IT staff have. We do not push one pattern onto every school.

What about student privacy when we're using third-party learning platforms?: That is a vendor-risk question before it is a technical one. For each platform we build a register. It records what data goes to the vendor, how they secure it, and where it is hosted. The same register covers the contract terms on access, breach notification, and deletion when you leave. We review it with you every year. If a platform cannot show decent security, we flag it and you decide.

We have long-serving staff with accumulated access to everything. Is that an issue?: Usually yes. The era when everyone had admin because it was easier leaves a residue. Dormant service accounts, shared mailboxes with the password written on a note, system accounts that outlived the IT coordinator who created them in 2014. We audit identity during onboarding and give you a prioritised clean-up list. Nothing dramatic, just getting the environment straight about who can actually do what.

We're on the diocese or sector network. Does that mean we're covered?: Partly. Sector-level infrastructure usually covers identity federation and sometimes web filtering. It does not cover endpoint detection and response on your devices, or your Microsoft 365 tenant configuration. Backup, staff security training and your own vendor risk are still your responsibility. We integrate with sector services where they exist and cover the rest.

Can teachers use Microsoft 365 Copilot, ChatGPT Edu, or Claude on student work or records?: Yes, with the right tier and the right policy. Teachers are already using these tools. The question is whether the ones in use have appropriate data-handling terms. Look for Microsoft 365 Copilot under an education agreement, ChatGPT Edu, or Claude for Work. You then need an acceptable-use policy covering what data can be entered, how AI-assisted work is marked, and how parents are told. We have helped schools write policies that allow the tools and set limits on them.

The qualifier

Let's see if we're a fit.

Seven questions, one moment of your time. We'd rather tell you now than three months in.