JavaScript is required

School operations

Software and Administration Systems

Policy

This policy defines the mandatory systems of record for student and school administration.

It explains when schools must use the School Software Panel to buy software that is in scope.

It also explains when a Safer Technologies for Schools (ST4S) risk assessment is required before schools buy or use new or existing software or administration systems.

Summary

  • Schools must:
    • use department-provided systems of record for their intended purpose and functions
    • ensure that any data stored in administration systems not provided by the department is transferred to the relevant department system of record
    • use the School Software Panel when buying a software product or category that is in scope.
  • Schools must use the School Software Panel to:
    • find approved suppliers
    • compare available products
    • request quotes (one quote is required for purchases up to $25,000 and 3 quotes for purchases over $25,000 – read the Procurement – Schools policy)
  • complete the purchasing process.
  • A separate ST4S assessment is not required for software purchased through the School Software Panel because suppliers have already completed this assessment as part of the panel approval process.
  • For software and administration systems that are not provided by the department and are not available through the School Software Panel, schools must:
    • check whether the product has an ST4S assessment in the Arc Software catalogue
    • complete all actions listed in the ST4S report
    • make a service request through the DE Services Portal if no ST4S report is available. The department’s IT security team can arrange a security assessment
    • review existing non-panel products that are within the scope of the School Software Panel and move to an approved panel product when the contract is renewed. Schools have a 12-month grace period from the panel release in October 2027.

Details

Scope

This policy applies to software and administration systems that interact with or process personally identifiable, sensitive, health or important operational data. This includes systems accessed on desktop computers or mobile devices.

For the initial School Software Panel release, in-scope products are the student administration software categories listed on the School Software Panel Portal (staff login required)(opens in a new window). The department may add more software categories to the panel over time.

Adopting software and administration systems not provided by the department

Before purchasing, subscribing to, trialing or renewing software or administration systems that are not provided by the department, schools must check whether the product or software category is covered by the School Software Panel.

If the product or category is covered, schools must use the School Software Panel purchasing pathway.

School Software Panel

The School Software Panel is the department’s mandatory process for buying in-scope software used by schools. For the initial release, this applies to student administration products only.

Software categories include:

  • student administration
  • timetabling
  • attendance
  • parent/teacher communications.

For further detail about categories covered, go to SSP Supplier services at a glance (PDF) (staff login required)(opens in a new window).

Non-student administration products, including AI chatbots, are currently outside the scope of the panel.

When a product or software category is covered by the School Software Panel, schools must:

  • use the panel to find approved suppliers
  • compare products
  • request quotes where required (read the Procurement – Schools policy)
  • complete the purchase through the School Software Panel portal.

An active ST4S assessment is required for products to be included in the panel. Schools do not need to complete a separate ST4S check before purchasing panel products.

Schools must still:

  • ensure the selected panel product meets their business needs
  • ensure their intended use of each product meets requirements under relevant department policies
  • complete any school-level implementation to ensure the product aligns to the relevant policy. These configuration actions are included in the panel guidance.

Using the department contract template

For products purchased through the School Software Panel, schools must use the approved Purchase Order Contract, which is linked to the relevant supplier Master Agreement.

Schools must not accept separate supplier terms and conditions including:

  • online click-through terms
  • order forms
  • license terms
  • contract amendments.

Managing legacy products not included in the School Software Panel

Schools will be supported to transition to panel-approved solutions over time. Schools are not required to prematurely terminate active, legally binding agreements with non-panel vendors. Existing solutions may continue to be used for the duration of the current contract term.

As existing contracts approach renewal or expiry, schools must review panel-approved alternatives as their preferred procurement pathway. Dedicated support resources are available to assist with onboarding and implementation activities, helping to minimise disruption to school operations. Contact the School Software Services team.

If schools are unsure of a software product's approval status, they can check ARC for an "SSP Approved" tag. Where an application is not listed in ARC, schools can submit a request to the School Software Panel support channel for review. The team will assess the product and provide advice regarding its compliance and suitability for use.

Arc Software Catalogue

Arc Software remains the department’s catalogue of department-provided software and other software products that are not covered by the School Software Panel.

For software or administration systems that are not covered by the School Software Panel, schools must:

Arc Software can be filtered by software category, functionality or learning area.

Products marked ‘Department provided’ do not require an ST4S assessment. These products are covered by department-provided software guidance.

ST4S reports expire after 2 years from the review date listed on the report. If a product has an expired, expiring, inactive or unavailable ST4S assessment report, it requires further security review. Before purchasing, renewing, implementing or continuing to use the product, the school must seek guidance from the School Software Services Team.

Safer Technologies 4 Schools assessments

Schools do not need to complete a separate Safer Technologies 4 Schools (ST4S) check for products purchased through the School Software Panel. All panel suppliers will already have a current ST4S assessment.

For software and administration systems that are not covered by the School Software Panel, where an ST4S report is available, schools must:

  • review the summary ST4S risk assessment report
  • complete all actions identified in the full ST4S report before using the software or administration system.

Schools must not use non-panel products with an overall ST4S rating of:

  • Non-Compliant
  • Non-Participating
  • High Risk.

Refer to the Guidance tab for more information about ST4S assessments and how they apply to non-panel products.

Systems of record

Schools must use the department’s systems of record for their intended purpose to manage data, information, and records.

Schools may also use other administration systems that provide additional features to support student and school administration. These may include parent portals, assessment or grading tools, or financial services.

If a school uses administration systems that are not provided by the department, it must ensure that any data, information or records created or stored in those systems are exported to the relevant department system of record.

Using a product purchased through the School Software Panel does not replace a school’s responsibility to record and maintain required information in the relevant department system of record.

Security impact assessments

This section applies to software and administration systems that are not provided by the department and not covered by the School Software Panel.

If an ST4S report is not available, schools must consider an alternative product that has already been assessed or is available through the Schools Software Panel, as these products provide similar functionality and present a lower risk than unassessed products.

If no suitable assessed or panel product is available, schools must:

While the assessment is underway:

  • schools may continue to use the product
  • schools will be advised of the assessment outcome
  • depending on the outcome, schools may need to move to a lower-risk alternative product.

If no suitable assessed or panel product is available, schools must complete a Privacy Impact Assessment (PIA) and submit a security impact assessment request through the Services Portal before using the product. Refer to the Privacy and Information Sharing policy for more information.

Third-party risk management security

Third parties are organisations outside the department that may access school information, systems, or services. When information is shared or system access is provided, it can introduce security and privacy risks, including the possibility of unauthorised access or data breach. Managing this risk means checking that appropriate physical, personnel, and ICT security controls are in place before the third party is used by schools.

If a product or third-party provider:

  • is not listed on the School Software Panel
  • has not been assessed through ST4S
  • has not completed the required Privacy Impact Assessment (PIA) or Security Impact Assessment (SIA)

the department may not have enough assurance that appropriate security controls of the application or system are in place.

Products that have not been assessed may increase the risk of:

  • unauthorised access
  • data breaches
  • misuse or disclosure of information
  • other security incidents.

Before purchasing, renewing, implementing, or continuing to use these products or services, schools must seek guidance from School Software Services Team.

Definitions

Administration systems
Administration systems are digital systems and processes used to collect, maintain and use records for students, staff, parents and others.

Safer Technologies 4 Schools (ST4S)
The ST4S is an independent national service managed by Education Services Australia. It provides security, privacy and child safety reports for schools.

School Software Panel
The School Software Panel is the department’s approved procurement and assurance pathway for in-scope school software products.

The panel includes suppliers and products that have been assessed through the department’s procurement, commercial, privacy, information security, child safety and ST4S assurance processes.

School Software Services Team
The School Software Services Team supports the School Software Panel.

The team:

  • provides guidance to schools
  • supports suppliers
  • manages panel operations.

Software
Software includes digital applications that support teaching, learning and other school functions. This includes locally installed applications, web-based applications, websites, browser extensions, collaboration tools, and other platform add-ons.

Student and school administration
Student and school administration includes the processes and activities that support the day-to-day operation of a school.

This includes:

  • school management, including finance, procurement, facilities and asset management, human resources, risk management ancillary services and other support services
  • student administration, including enrolments and transitions, attendance, student reporting and achievement, student and family profiles, health and wellbeing, events and consent.

Systems of record
Systems of record are department-provided administration systems that store important data and records.

These systems hold information where integrity, accuracy and security are essential for required reporting and school operations.

Technologies and ICT services
Technologies and ICT services are the infrastructure, tools and platforms that support core school operations.

These include

  • hardware
  • internet services
  • networks
  • cloud services
  • identity management
  • operating systems
  • collaboration platforms.

Refer to the Technologies and ICT Services policy for more information.

Relevant legislation

Department policy defining the mandatory systems of record for student and school administration.

Updated

Back to top