Technologies and ICT Services

Policy

This policy outlines the requirement for schools to transition to department-provided technologies by the end of 2028 and the support available for schools implementing technologies and Information and Communications Technology (ICT) services.

Summary

• The department provides a suite of technologies and ICT services to schools.
• Where a school has previously adopted technology now provided by the department, schools must transition to the department technologies by the end of 2028.
• Schools must not:
  • implement the same technologies where the technology is provided by the department
  • adopt different technologies where the department technology provides the same service.
• Where the technology is not provided by the department, schools may continue to adopt and use those technologies in accordance with department child safety, privacy, records management, procurement, backup and recovery, and information security requirements.

Details

By the end of 2028 schools must migrate their school-managed technologies to department-provided technologies where available.

This is because it is no longer appropriate for schools to operate separate technology environments due to:

• cyber security incidents increasing in both sophistication and frequency, resulting in privacy breaches and extended outages
• challenges with risk mitigation and responding to incidents in a diverse technology landscape
• the increased risk of harm if technology is adopted without necessary privacy, security and child safety assessments (Standard 9 of the Child Safe Standards requires schools and the department to maintain the safety of children in an online environment)
• the challenges associated with managing long-term record retention requirements including records that must be kept beyond system life.

Department-provided technologies and ICT services

The department provides a suite of technologies and services to schools. These technologies are regularly assessed for compliance with the child safety, privacy and security standards.

Department-provided technologies include:

• high speed internet access with content filtering
• collaboration platforms including Microsoft 365 and Google Workspace for Education
• video conferencing services including WebEx
• enterprise grade WiFi
• single department managed identity for staff and students (eduPass)
• access department ICT systems through Secure Remote Access Service (SRAS) when working remotely
• single email address for staff and students
• cloud-based device management solution
• server endpoint detection and response
• asset vulnerability monitoring and reporting services
• security incident logging and monitoring
• notebooks for school staff.

The department provides a range of ICT support for schools including:

• Technical Support to Schools Program (TSSP)
• ICT purchasing panels (staff login required)
• Arc Software.

For more information, refer to ICT support for schools in the guidance chapter.

Migrating to department-provided technologies and ICT services

The Securing Connected Learners (SCL) Program (staff login required) has been established to support schools to migrate to department-provided technologies by the end of 2028. Schools will have the opportunity to influence improvements to the technology and services the department provides and will be contacted to advise of the migration process.

If existing commercial agreements for equipment, services and software are due for renewal and sufficient notice is provided, the SCL Program may be able to facilitate an early transition providing a cost-avoidance opportunity for schools. Please use the Contact us page to notify the SCL Program of these arrangements.

Adopting other technologies and ICT services

Schools may continue to adopt and use technologies not provided by the department in accordance with department policies (below). These technologies may include:

• building sign-in and access systems
• printing management systems
• library systems
• specialist device management systems
• hardware such as printers, multifunction devices, projectors, hearing augmentation
• Internet of Things (IoT) devices
• curriculum-specific hardware such as STEM tools (3D printers), art tools.

When seeking to use technologies not provided by the department, schools must ensure they comply with department policies, including:

• the review and implementation of Safer Technology for Schools (ST4S) risk assessment reports, as outlined in the Software and Administration Systems policy
• managing privacy risks including conducting Privacy Impact Assessments, as outlined Privacy and Information Sharing policy
• the measures required to securely and appropriately manage and share information, as outlined in the Information Security policy
• the appropriate management of access to communication with individuals outside the school in online environments, as outlined in the Digital Technologies – Responsible Use policy
• record retention requirements as outlined in the Records Management policy.

Schools are strongly encouraged to use a department contract template when using technologies not provided by the department to ensure compliance with department requirements. For more information, refer to the system and applications section of the Records Management policy.

In addition to the above requirements, schools, supported by TSSP personnel, must define, implement and support backup and recovery procedures for school ICT infrastructure to minimise IT security and business continuity risks associated with data loss. For more information, refer to Backup and recovery of ICT infrastructure in the guidance chapter.

Contact

Securing Connected Learners Program
SCLProgram@education.vic.gov.au

Services Portal
Phone number for schools: 1800 641 943
Email: servicedesk@education.vic.gov.au

Definitions

Administration systems
Administration systems refer to digital technology-based systems and processes for collecting, maintaining and using records (including for students, staff, parents and others) – refer to Software and Administration Systems.

Internet of Things (IoT)
The physical objects that are connected to, and share data, with technologies and ICT services and software over the internet, including some: printers, multifunction devices, projectors, hearing augmentation devices, air filters, air conditioners, solar panel arrays, door locks, lights, security sensors, clocks.

Software
The digital applications that support teaching, learning and other functions in a school, and which complement Administration Systems and Technologies and ICT Services including: locally installed applications, web-based applications, websites, web browser extensions, collaboration platform add-ons – refer to Software and Administration Systems.

Technologies and ICT services
Technologies and ICT services refer to infrastructure and platforms that enable core school functions including: hardware, internet, network, cloud services, identity management, operating systems and collaboration platforms.

Related policies

• Acceptable Use Policy for ICT Resources
• CCTV in Schools – Installation and Management
• Digital Learning
• Digital Technologies – Responsible Use
• eduMail (employee email)
• Information Security
• Notebooks for School Staff Program
• Privacy and Information Sharing
• Procurement – Schools
• Records Management
• Software and Administration Systems

Relevant legislation

• Child Wellbeing and Safety Act 2005 (Vic)
• Health Records Act 2001 (Vic)
• Ministerial Order 1359 – Implementing the Child Safe Standards – Managing the risk of child abuse in schools (PDF)
• Privacy and Data Protection Act 2014 (Vic)
• Public Records Act 1973 (Vic)
• Victorian Protective Data Security Framework

Guidance

Supporting transition to department-provided technologies

The Securing Connected Learners (SCL) Program includes several projects to support schools in the transition to department-provided technologies including the decommissioning of school-managed technologies and identities. The transition will be incremental and designed to support schools and minimise disruption.

The approach and sequence of transition will be based on a balanced assessment of risk, need and benefit. The SCL Program works with each school to understand their ICT landscape and develop an individual transition plan.

Schools can register their interest by visiting the SCL Program information site (staff login required) for early transition to department technologies with the SCL Program. Additionally, if existing commercial agreements for equipment, services and software are due for renewal and sufficient notice is provided, the SCL Program may be able to facilitate an early transition providing a cost-avoidance opportunity for schools.

The SCL Program also seeks school input to further evolve and expand the suite of department-provided technologies.

ICT support for schools

Technical Support to Schools Program

The Technical Support to Schools Program (TSSP) provides Specialist Technicians (ST) to all schools. STs deliver onsite scheduled support for both school and department ICT initiatives. Each school is also assigned a Regional Service Delivery Manager (SDM). SDMs are a point of contact for schools regarding the TSSP and ICT in general. SDM contact information is available via the TSSP Workforce Management System (WMS) (staff login required) and the TSSP Specialist Technician intranet page (staff login required).

A weekly allocation of technical support hours is calculated annually for each school using the February enrolment census data. STs follow a visitation schedule which is available in the WMS once approved by the Regional SDM.

Schools must select STs from the TSSP supplier panel. This selection process is managed by the TSSP WMS and coordinated by the Regional SDM.

STs are expected to sign in and out for each school visit using any system nominated by the school. It is recommended that the ST has a single point of contact on staff who coordinates their day-to-day activities.

STs log their support times on a weekly basis using a central timesheet module in the online TSSP WMS (staff login required). Schools must provide electronic approval of ST timesheet entries as soon as requested. If a timesheet entry is marked as ‘not approved’, the SDM will be automatically notified and will contact the school to resolve any issue. By default, principals have access to approve timesheet entries and may delegate access to any appropriate staff member.

If schools require guidance on any ICT programs and services provided by the department or third-party applications, devices or ICT services, then they can consult with their TSSP ST, Regional SDM or contact the department’s Services Portal (staff login required).

ICT purchasing panels

Schools must comply with the Procurement – Schools policy when purchasing ICT equipment and services.

The department has contractual agreements with suppliers across a selection of ICT products, services and applications on behalf of schools to:

• obtain all necessary purchasing approvals
• ensure that the suppliers are contracted to supply at agreed pricing with fit-for-purpose warranty provisions
• provide competitive pricing and choice of supplier where possible
• deliver an effective mix of technology options, including entry-level, standard and enhanced product categories, including choice of supplier product, customised warranty and support and upgrade options.

Further information is available on the Information and communications technology panels section (staff login required) of the department managed procurement categories page – providing ‘Rules of Use’ and more information on how to use each purchasing panel.

Arc platform

Arc is the Department of Education's digital platform that provides Victorian teachers with access to curriculum-aligned resources, professional learning opportunities, and safe and reliable software and technologies. The Arc platform includes:

• Arc Learning – a digital content repository that provides teachers with easier access to high-quality learning and teaching resources. The content featured on Arc Learning has been comprehensively mapped to the Victorian curriculum frameworks and the Victorian Teaching and Learning Model so teachers can feel confident when selecting resources for their students
• Arc Events – offering a variety of in-person and virtual student and professional learning opportunities. These experiences are led by experts from Victorian providers, including museums, zoos, sports organisations, and art facilitators
• Arc Software – providing safe and reliable access to major suppliers’ software, such as Webex, Microsoft 365, Google Workspace for Education and Minecraft. School leaders and teachers can browse the Safer Technologies for Schools (ST4S) reports to review the safety and security of a wide range of education software and technologies. For more information refer to the Software and Administration Systems policy.

Backup and recovery of ICT infrastructure

To minimise IT security and business continuity risks associated with data loss, there is a requirement to implement backup and recovery procedures for ICT infrastructure in schools.

Backup procedures involve copying data to another medium so that in the event the data is lost, it can be recovered in a recent, if not completely current, version. Backup is not intended for archiving data for future reference or maintaining a versioned history of data. Data backups are not intended to serve as archival copies of data or to meet the departmental record keeping or retention requirements.

Data archiving requirements are not included in this policy, as the technical requirements and user expectations of data archive are different to data backup. Data archiving involves storing older information that is not needed for everyday operations (that is, moving these older files to a separate, long-term storage device). For more information about retention requirements, refer to Records Management.

This policy also excludes backup and recovery of data residing on school systems hosted by external service providers or centrally by the department.

Classification of ICT infrastructure

The ICT infrastructure classification guide on the Resources tab lists the different types of ICT infrastructure in schools and who is responsible for backup and recovery. Where a particular type of ICT infrastructure in a school does not appear in this document, schools are responsible for backup and recovery procedures.

Department backup and recovery

Where the department is responsible for backup and recovery procedures, the standard operational backup frequency will be daily, with backups to be retained for a period of 31 days.

The department’s School Administration Server backup service takes a copy of the data within the school user’s folder. The user’s folder is located on the D: Drive of the administration server. A school user can see this folder on their workstations as the U:\Users Folder.

Recovery of this data outside of a declared disaster is to be requested by a school through logging a service request via the Services Portal (staff login required).

The P: Drive directory supports the generation of reports and the usage of other files within the CASES21 environment. P: Drive is a temporary storage location with a limited capacity and not part of the School Administration Server backup process. Business managers ensure that data that requires long-term retention is copied from P: Drive to the U: Drive to ensure the data is backed up and the storage capacity limit is not reached. For more information refer to the CASES21 Administration User Guide (PDF) (staff log-in required).

When storing files on the school administration server, schools must store files in accordance with the Acceptable Use Policy for ICT Resources.

School backup and recovery

Where the school is responsible for backup and recovery procedures schools must determine if each item of school ICT infrastructure requires back up procedures. TSSP school technicians assist schools to determine this and put in place backup procedures.

Where backup procedures are required for an item of school ICT infrastructure, schools must:

• determine the method for backup
• determine the backup frequency and retention period to meet operational needs for business continuity, both for recovery from declared disasters and from data loss through other causes
• successfully test recovery of data from each different type of backup at a minimum of once per year
• implement automated processes to execute backups
• implement procedures to monitor and report on the success or failure of backups.

Where backups of school ICT infrastructure are transmitted or stored offsite, they must be encrypted. Schools must implement suitable processes to manage certificates used for encrypting backups. Certificates must be available for recovery purposes in the event of declared disasters, including total loss of a school site.

Where technically possible, backup processes should be configured to minimise their use of computing and network resources during normal school hours.
Schools can backup data stored on staff and student devices by configuring cloud-based data storage services such as Google Drive and Microsoft OneDrive.

Resources

Securing Connected Learners

Further information about the Securing Connected Learners (SCL) Program can be found on the SCL Program information site (staff login required).

For further enquiries, contact the Securing Connected Learners Program: Contact us (staff login required).

ICT support for schools

• Technical Support to Schools Program intranet site (staff login required)
• Arc platform

Backup and recovery of ICT infrastructure

The ICT infrastructure classification guide outlines the backup and recovery classifications for the base types of ICT infrastructure in schools to define responsibility for backup and recovery.