Data Breaches and RTOs: A Practical RTO Data Security Guide
Updated: 5 days ago
Recent data breaches involving external service providers used widely across the VET sector are a timely reminder to review your RTO data security: the systems you use and the providers that hold your data.
This guide covers what to review, what to document and what to send your providers, so you can show that your RTO is actively managing system and data security risks.
1. Contact your service providers
Use our free template to email your external service providers, including your student management system (SMS), learning management system (LMS), finance system, cloud storage and email platform. Their responses will help you assess risk and decide whether any further action is required.
2. Review your governance
Alongside provider due diligence, check the following internal controls.
Roles and accountability
Confirm who within your RTO is responsible for data security and privacy, and make sure their role includes oversight of system risk, breach response and ongoing monitoring of critical systems.
Policies and procedures
Make sure you have current, approved policies covering:
privacy and the management of personal information
records management, including retention, storage and disposal
information security, including access controls, passwords and multi-factor authentication (MFA)
data incident response and business continuity
the management and review of your system and service providers.
Registers and monitoring
Your Compliance Risk Register (or equivalent) should capture each key system and provider, including the provider and product, the data held, hosting location (where known), risk rating and the date of the last security review.
If this is not currently documented, the provider request template will help you build that record.
Technical controls
You should be able to demonstrate that:
MFA is enforced across all critical systems
user access is approved, recorded and promptly removed when roles change or staff leave
system access is reviewed at least annually
backups are completed and restoration is tested at least annually.
Evidence management
When providers respond, retain all responses and supporting documents, update your risk and/or continuous improvement register, and record any risk decisions and review dates.
3. Keep the evidence
When these actions are documented and retained, they form a clear, auditable record that your RTO is actively managing system and data security risk.
Resources to support your review
These CWTS policy packs cover the areas above and can be adapted to your RTO:
Governance and Business Management Policy Pack for roles and accountability
Data, Privacy and Record Keeping Policy Pack for privacy, records and information security policies
RTO Quality Monitoring and Improvement Policy Pack for registers and monitoring
Continuous Improvement Management Policy Pack for recording actions and improvements
If you would like help reviewing your current arrangements or working through provider responses, Coast Wide Training Solutions is here to help.
Comments