Software and Administration Systems

Policy

This policy defines the mandatory systems of record for student and school administration.

It explains when schools must use the School Software Panel to buy software that is in scope.

It also explains when a Safer Technologies for Schools (ST4S) risk assessment is required before schools buy or use new or existing software or administration systems.

Summary

• Schools must:
  • use department-provided systems of record for their intended purpose and functions
  • ensure that any data stored in administration systems not provided by the department is transferred to the relevant department system of record
  • use the School Software Panel when buying a software product or category that is in scope.
• Schools must use the School Software Panel to:
  • find approved suppliers
  • compare available products
  • request quotes (one quote is required for purchases up to $25,000 and 3 quotes for purchases over $25,000 – read the Procurement – Schools policy)
• complete the purchasing process.
• A separate ST4S assessment is not required for software purchased through the School Software Panel because suppliers have already completed this assessment as part of the panel approval process.
• For software and administration systems that are not provided by the department and are not available through the School Software Panel, schools must:
  • check whether the product has an ST4S assessment in the Arc Software catalogue
  • complete all actions listed in the ST4S report
  • make a service request through the DE Services Portal if no ST4S report is available. The department’s IT security team can arrange a security assessment
  • review existing non-panel products that are within the scope of the School Software Panel and move to an approved panel product when the contract is renewed. Schools have a 12-month grace period from the panel release in October 2027.

Details

Scope

This policy applies to software and administration systems that interact with or process personally identifiable, sensitive, health or important operational data. This includes systems accessed on desktop computers or mobile devices.

For the initial School Software Panel release, in-scope products are the student administration software categories listed on the School Software Panel Portal (staff login required)(opens in a new window). The department may add more software categories to the panel over time.

Adopting software and administration systems not provided by the department

Before purchasing, subscribing to, trialing or renewing software or administration systems that are not provided by the department, schools must check whether the product or software category is covered by the School Software Panel.

If the product or category is covered, schools must use the School Software Panel purchasing pathway.

School Software Panel

The School Software Panel is the department’s mandatory process for buying in-scope software used by schools. For the initial release, this applies to student administration products only.

Software categories include:

• student administration
• timetabling
• attendance
• parent/teacher communications.

For further detail about categories covered, go to SSP Supplier services at a glance (PDF) (staff login required)(opens in a new window).

Non-student administration products, including AI chatbots, are currently outside the scope of the panel.

When a product or software category is covered by the School Software Panel, schools must:

• use the panel to find approved suppliers
• compare products
• request quotes where required (read the Procurement – Schools policy)
• complete the purchase through the School Software Panel portal.

An active ST4S assessment is required for products to be included in the panel. Schools do not need to complete a separate ST4S check before purchasing panel products.

Schools must still:

• ensure the selected panel product meets their business needs
• ensure their intended use of each product meets requirements under relevant department policies
• complete any school-level implementation to ensure the product aligns to the relevant policy. These configuration actions are included in the panel guidance.

Using the department contract template

For products purchased through the School Software Panel, schools must use the approved Purchase Order Contract, which is linked to the relevant supplier Master Agreement.

Schools must not accept separate supplier terms and conditions including:

• online click-through terms
• order forms
• license terms
• contract amendments.

Managing legacy products not included in the School Software Panel

Schools will be supported to transition to panel-approved solutions over time. Schools are not required to prematurely terminate active, legally binding agreements with non-panel vendors. Existing solutions may continue to be used for the duration of the current contract term.

As existing contracts approach renewal or expiry, schools must review panel-approved alternatives as their preferred procurement pathway. Dedicated support resources are available to assist with onboarding and implementation activities, helping to minimise disruption to school operations. Contact the School Software Services team.

If schools are unsure of a software product's approval status, they can check ARC for an "SSP Approved" tag. Where an application is not listed in ARC, schools can submit a request to the School Software Panel support channel for review. The team will assess the product and provide advice regarding its compliance and suitability for use.

Arc Software Catalogue

Arc Software remains the department’s catalogue of department-provided software and other software products that are not covered by the School Software Panel.

For software or administration systems that are not covered by the School Software Panel, schools must:

• check whether the product is listed in Arc Software(opens in a new window)
• check whether the product has a current ST4S risk assessment report.

Arc Software can be filtered by software category, functionality or learning area.

Products marked ‘Department provided’ do not require an ST4S assessment. These products are covered by department-provided software guidance.

ST4S reports expire after 2 years from the review date listed on the report. If a product has an expired, expiring, inactive or unavailable ST4S assessment report, it requires further security review. Before purchasing, renewing, implementing or continuing to use the product, the school must seek guidance from the School Software Services Team.

Safer Technologies 4 Schools assessments

Schools do not need to complete a separate Safer Technologies 4 Schools (ST4S) check for products purchased through the School Software Panel. All panel suppliers will already have a current ST4S assessment.

For software and administration systems that are not covered by the School Software Panel, where an ST4S report is available, schools must:

• review the summary ST4S risk assessment report
• complete all actions identified in the full ST4S report before using the software or administration system.

Schools must not use non-panel products with an overall ST4S rating of:

• Non-Compliant
• Non-Participating
• High Risk.

Refer to the Guidance tab for more information about ST4S assessments and how they apply to non-panel products.

Systems of record

Schools must use the department’s systems of record for their intended purpose to manage data, information, and records.

Schools may also use other administration systems that provide additional features to support student and school administration. These may include parent portals, assessment or grading tools, or financial services.

If a school uses administration systems that are not provided by the department, it must ensure that any data, information or records created or stored in those systems are exported to the relevant department system of record.

Using a product purchased through the School Software Panel does not replace a school’s responsibility to record and maintain required information in the relevant department system of record.

Security impact assessments

This section applies to software and administration systems that are not provided by the department and not covered by the School Software Panel.

If an ST4S report is not available, schools must consider an alternative product that has already been assessed or is available through the Schools Software Panel, as these products provide similar functionality and present a lower risk than unassessed products.

If no suitable assessed or panel product is available, schools must:

• submit a security impact assessment request (staff login required)(opens in a new window) through the Services Portal before using the product
• allow the department’s IT Security Team arrange an ST4S or another appropriate assessment.

While the assessment is underway:

• schools may continue to use the product
• schools will be advised of the assessment outcome
• depending on the outcome, schools may need to move to a lower-risk alternative product.

If no suitable assessed or panel product is available, schools must complete a Privacy Impact Assessment (PIA) and submit a security impact assessment request through the Services Portal before using the product. Refer to the Privacy and Information Sharing policy for more information.

Third-party risk management security

Third parties are organisations outside the department that may access school information, systems, or services. When information is shared or system access is provided, it can introduce security and privacy risks, including the possibility of unauthorised access or data breach. Managing this risk means checking that appropriate physical, personnel, and ICT security controls are in place before the third party is used by schools.

If a product or third-party provider:

• is not listed on the School Software Panel
• has not been assessed through ST4S
• has not completed the required Privacy Impact Assessment (PIA) or Security Impact Assessment (SIA)

the department may not have enough assurance that appropriate security controls of the application or system are in place.

Products that have not been assessed may increase the risk of:

• unauthorised access
• data breaches
• misuse or disclosure of information
• other security incidents.

Before purchasing, renewing, implementing, or continuing to use these products or services, schools must seek guidance from School Software Services Team.

Definitions

Administration systems
Administration systems are digital systems and processes used to collect, maintain and use records for students, staff, parents and others.

Safer Technologies 4 Schools (ST4S)
The ST4S is an independent national service managed by Education Services Australia. It provides security, privacy and child safety reports for schools.

School Software Panel
The School Software Panel is the department’s approved procurement and assurance pathway for in-scope school software products.

The panel includes suppliers and products that have been assessed through the department’s procurement, commercial, privacy, information security, child safety and ST4S assurance processes.

School Software Services Team
The School Software Services Team supports the School Software Panel.

The team:

• provides guidance to schools
• supports suppliers
• manages panel operations.

Software
Software includes digital applications that support teaching, learning and other school functions. This includes locally installed applications, web-based applications, websites, browser extensions, collaboration tools, and other platform add-ons.

Student and school administration
Student and school administration includes the processes and activities that support the day-to-day operation of a school.

This includes:

• school management, including finance, procurement, facilities and asset management, human resources, risk management ancillary services and other support services
• student administration, including enrolments and transitions, attendance, student reporting and achievement, student and family profiles, health and wellbeing, events and consent.

Systems of record
Systems of record are department-provided administration systems that store important data and records.

These systems hold information where integrity, accuracy and security are essential for required reporting and school operations.

Technologies and ICT services
Technologies and ICT services are the infrastructure, tools and platforms that support core school operations.

These include

• hardware
• internet services
• networks
• cloud services
• identity management
• operating systems
• collaboration platforms.

Refer to the Technologies and ICT Services policy for more information.

Related policies

• CCTV in Schools – Installation and Management
• Child Safe Standards
• Digital Learning
• Digital Technologies – Responsible Use
• eduMail (employee email)
• Generative Artificial Intelligence
• Information Security
• Privacy and Information Sharing
• Procurement – Schools
• Records Management
• Schools' privacy policy
• Technologies and ICT Services

Relevant legislation

• Child Wellbeing and Safety Act 2005 (Vic)(opens in a new window)
• Freedom of Information Act 1982 (Vic)(opens in a new window)
• Health Records Act 2001 (Vic)(opens in a new window)
• Ministerial Order 1359 – Implementing the Child Safe Standards – Managing the risk of child abuse in schools (PDF)(opens in a new window)
• Privacy and Data Protection Act 2014 (Vic)(opens in a new window)
• Public Records Act 1973 (Vic)(opens in a new window)
• Victorian Protective Data Security Framework(opens in a new window)

Guidance

Systems of record

Using the department-provided systems of record helps schools ensure that:

• information is accurate, accessible, up to date and suitable for decision-making
• privacy, security and integrity of information are maintained
• authorised users can access information from a reliable and trusted source
• duplicate information is reduced.

The table below lists the department’s key systems of record and outlines their main purpose.

School Software Panel products may provide additional features for schools. However, they do not replace the department-provided systems of record unless the department advises that a system of record has changed.

Department-provided software

The department provides a range of software for schools. Refer to Arc Software(opens in a new window) for a complete list by filtering on 'Department provided'.

Each department-provided product listed in Arc Software includes information for schools, including any required risk management actions.

Schools can follow Arc Events(opens in a new window) to stay informed about training opportunities and new features.

For Microsoft 365, schools can join the department's M365 Community Team to receive updates on the latest features.

For student administration products covered by the School Software Panel, schools must use the School Software Panel portal as the main source for approved products and purchasing guidance.

Adopting software and administration systems not provided by the department

Using risk-assessed software and administration systems helps schools meet procurement, privacy and security requirements. It also supports compliance with relevant legislation and security standards.

Using risk-assessed products creates a safer environment for students, staff and the broader community.

Using the School Software Panel

Schools must use the School Software Panel to purchase in-scope student administration products.

The School Software Panel portal is the main source of information for these products. Schools can use the portal to:

• view approved suppliers and products
• compare products and pricing
• access supplier and product information
• request quotes where required
• understand the purchasing process
• access the approved Purchase Order Contract process
• seek support from the School Software Services Team.

Schools can continue to use Arc Software for software products and categories that are not covered by the panel.

Process for purchasing an in-scope panel product

Schools must complete this checklist:

1. Check the School Software Panel portal (staff login required)(opens in a new window) to confirm whether the product or category is covered by the panel
2. Review the approved suppliers and available product information
3. Compare pricing, product functionality and any school-level implementation requirements
4. Request a quote from one or more suppliers
5. Raise a purchase order using the approved Purchase Order Request Form
6. Do not accept separate supplier terms and conditions, online click-through terms, order forms, licence terms or contract amendments
7. Complete any required implementation, privacy, records management and configuration actions
8. Maintain school records and ensure required data is entered into the relevant department systems of record

Safer Technologies 4 Schools assessments for non-panel products

Safer Technologies 4 Schools (ST4S) remains an important risk assessment resource for software and administration systems that are not provided by the department and are not covered by the School Software Panel.

ST4S is an independent national service managed by Education Services Australia. It provides security, privacy and child safety reports to help schools:

• make informed decisions when selecting or reviewing a product or service
• understand key security, privacy and child safety risks, and the actions needed to manage them
• compare products using common functionality tags and identify safer alternatives where available.

The department publishes ST4S assessment reports in Arc Software, as they become available.

Each Arc Software listing includes:

• a summary ST4S risk assessment report with an overall risk rating:
  • Non-Compliant
  • Non-Participating
  • High
  • Medium
  • Low
  • Use with Caution
  • Use Responsibly (for products that do not handle personally identifiable information)
  • Not Suitable
• a full ST4S risk assessment report.

Full ST4S risk assessment reports are available for many, but not all, products used in schools.

The summary risk assessment report outlines risks across cyber security, privacy and child safety. It also includes an overall risk rating.

As the ST4S assessment framework continues to evolve, some policy areas, such as child safety, may have changed since a product was originally reviewed. Schools must check that their intended use of products meets current mandatory policy requirements.

Schools must use the overall risk rating in the summary report when deciding whether a product is suitable.

ST4S reports do not replace a school’s responsibility to:

• assess whether a product meets its business needs
• check that the product meets policy requirements
• complete a Privacy Impact Assessment (PIA), where required.

However, ST4S reports reduce the amount of work schools need to do when assessing products.

By reviewing the ST4S reports and completing the required actions, schools can reduce the risk of security, privacy and child safety incidents, such as:

• data breaches
• ransomware attacks.

For products purchased through the School Software Panel, schools must rely on the panel listing and related guidance instead of completing a separate ST4S check.

An ST4S assessment is already a requirement for panel membership and has been considered as part of the department’s assurance process.

Product risk ratings

The following guidance applies to non-panel products.

Non-Compliant, High Risk and Non-Participating products

Schools must not purchase products rated:

• Non-Compliant
• High Risk
• Not Suitable.

For Non-Participating products the department is unable to provide an assessment outcome and therefore schools must find an alternative however in some case where there is no alternative available schools need to request advice from the School Software Services Team.

Schools must use a lower-risk alternative product or service.

Schools are encouraged to search Arc Software for similar products using the available product tags, such as educational games.

Medium Risk products

Products rated Medium Risk may be purchased or renewed.

Before purchasing or renewing these products, schools must:

• review the identified risks
• complete all actions listed in the full ST4S assessment report.

Schools are also encouraged to use the template communications in Notifications for Online Services to inform parents and carers about the products used by the school.

Low Risk, Use with Caution and Use Responsibly products

Products rated Low Risk, Use with Caution or Use Responsibly may be used.

Schools must complete:

• all actions identified in the full ST4S assessment report
• any required Privacy Impact Assessment (PIA) for the rating to remain valid.

School Software Panel products

For in-scope School Software Panel products, schools do not need to separately apply the ST4S risk-rating process before purchasing.

Instead, schools must:

• use the School Software Panel purchasing pathway
• follow any panel-specific implementation or risk treatment guidance.

Resources

Arc Software Catalogue

Arc Software(opens in a new window) lists department-provided software, as well as other software and administration systems that have been assessed through Safer Technologies for Schools (ST4S).

Arc Software remains the department’s primary catalogue for software products and categories that are not covered by the School Software Panel.

For student administration products covered by the School Software Panel, schools can use the School Software Panel portal to:

• view approved suppliers and products
• compare products
• request quotes
• access purchasing guidance.

Arc Software and SSP Portal are updated to be aligned so schools can easily move between software catalogue information and School Software Panel purchasing information.

School Software Panel

The following resources are available:

• School Software Panel Portal (staff login required)(opens in a new window)
• Approved suppliers, product lists
• Pricebook
• Panel Rules of Use
• Request a Quote form
• Purchase Order Contract guidance
• School Software Services Team contact details
• Frequently Asked Questions (FAQs)
• Supplier and product comparison guidance
• Guidance for renewing or transitioning existing non-panel products.

Software inventory template

Software inventory template (DOCX)(opens in a new window) is a downloadable resource that schools can use to record:

• software currently in use
• licence details
• software version information
• product owner
• renewal date
• whether the product is covered by the School Software Panel
• whether the product needs to transition to an approved panel product.

Systems of record

Refer to the Guidance tab for information about the department’s systems of record, including:

• Computerised Administrative System Environment for Schools (CASES21)
• Victorian Assessment Software System (VASS)
• Insight Assessment Platform
• Student Activity Locator (SAL)
• eduSafe Plus
• Health Activity Reporting Tool (HART)
• Student Online Case System (SOCS)
• Program for Students with Disabilities Management System (PSDMS)
• Student Resource Package (SRP) interactive site
• Strategic Planning Online Tool (SPOT)
• Schools Targeted Funding Governance (STFG) Portal
• Camps, Sports and Excursions Fund (CSEF) system
• Asset Information Management System (AIMS)
• eduPay
• School Jobs Vic
• School Conveyance Allowance System (SCAS)
• Student Insight (online enrolment platform).