EdLaw
New South Wales — Department of Education Cyber security procedures (PD-2015-0465-02)
The NSW Department of Education's mandatory procedures under its Cyber security policy. They apply to "all staff in schools and education support settings, including contractors, and any parties that access or use the department's digital devices, services and information" (audience). They set out who in the department governs cyber risk, how incidents are reported, and the controls staff apply. Two of those controls reach suppliers directly: the department's ICT contract requirements, and the rule that decides whether a school may use an online application at all, and with what consent. Implementation date 13 May 2024; the current version is V01.3.1 of 17 June 2026.
Applicability to EdTech
- Which applications a school may use, and with what consent (3.5; Table 1): core applications (Microsoft 365, Google Workspace, Adobe Creative Cloud, Zoom) and approved applications (those on the department's Online learning tools marketplace and the Administration Marketplace Panel for Schools) need no parental consent. Every other application "require[s] a cyber security assessment before being used", and all of them "require informed parental or carer consent". A product outside the marketplaces therefore meets two hurdles at every school: an assessment and a consent form. Results are published in the department's AssessedIT Application Assessments register.
- Contract terms flow down (3.3): staff managing ICT contracts "must incorporate the department's information security requirements" (the ICT contract requirements, a staff-only page, not reproduced here) in new and continuing contracts. Projects that send or receive department data must go through the Cyber Security team, which checks standards compliance, reviews design and architecture, and verifies security testing "before go-live".
- What the department will ask of a third-party provider (1.7 — third-party service provider risk): contractual obligations to notify the department of security incidents or data breaches; security and performance reviews; regular assessments through "audits, assurance reports, or other evaluations"; and enforcement of non-compliance, "such as break clauses where necessary".
- Supplier staff training (3.1 — ICT Service Providers and contract managers): outsourced ICT service providers "must also annually complete their in-house cyber awareness training" and may have to show evidence of it.
- Incidents (2.2): the department reports incidents to Cyber Security NSW "within 24 hours of detection and classification", which sets the pace a supplier's notification has to keep. Restricted applications listed under the NSW Government directive DCS-2025-01 may not be installed or used on department or personal devices used for department business (3.2). AI tools must be checked against the AssessedIT register for a do not use listing (3.4).
Contents
| Document | Covers |
|---|---|
| CYBER-SECURITY-PROCEDURES.md | The procedures as published: description, audience and change history; About the policy (policy requirements, definitions, roles and responsibilities); What needs to be done, sections 1–3 with their expanded panels (including Table 1, consent by application type); Mandatory tools and templates |
Scope note: the procedures point to staff-only material (the ICT contract requirements, the department's Cyber security standards), which is not public and not reproduced. The "Supporting tools, resources and related information" and "Policy contact" sections are not extracted. The department's Privacy standards (PD-2024-0485-07) are a separate instrument: NSW DoE Privacy standards.
Enforcement
Internal to the department. Its Cyber Security team, the Director, Cyber Security and the Chief Audit Executive check compliance (roles and responsibilities), and the department reports annually to Cyber Security NSW. Against a supplier, the procedures work through contract terms (1.7).
Licence
The NSW Department of Education's copyright statement (education.nsw.gov.au/about-us/rights-and-accountability/copyright, read 2026-10-08; linked as "Copyright" from the procedures' page) says: "Copyright material available on this website is licensed under a Creative Commons Attribution 4.0 International (CC BY 4.0) licence." and "Attribution should be given to: © State of New South Wales (Department of Education), 2023." The licence excludes logos, trademark-protected material and third-party material, none of which the corpus reproduces.
Conditions and how the corpus meets them: attribution — © State of New South Wales (Department of Education), 2023, given here and in the fact document's source line; indicate changes — the fact document's Meta section describes the only change, a reformatting of the page into Markdown with the words unchanged.
rights: open-licence.
Related
- AU Privacy Act — Commonwealth privacy law (APP 8 cross-border disclosure, APP 11 security). NSW public schools are bound by NSW privacy law, which is not yet in the corpus.
- NSW DoE Privacy standards — the department's privacy standards (collection, access, amendment, breaches, complaints)
- Vic DE Software and Administration Systems — Victoria's equivalent gate (ST4S ratings)
- Qld DoE Non-departmental ICT service providers — Queensland's procedure for engaging an outside ICT service
Sources
- NSW Department of Education — Cyber security procedures (PD-2015-0465-02)
- NSW Department of Education — Cyber security policy (PD-2015-0465), the policy these procedures implement