A fixed-fee independent Cyber Health Check for Australian Independent and Catholic K-12 schools. Aligned to the Essential Eight, NIST CSF, ISO 27001, the Privacy Act and ACSC guidance. Plain English. Board-ready. Works alongside your existing IT provider — not a replacement.
A data breach in a school isn't an IT incident — it's a child-safety, parent-trust and regulatory event. Your Board, your families, your insurer and the OAIC will all be looking for the same thing: evidence that you took it seriously, before it happened.
Ten business days. One honest scorecard against the ten non-negotiables. One prioritised plan. One debrief your Board, your Business Manager and your IT provider can all sit in on. No 200-page doorstop. No offshore audit team who've never set foot in a Queensland school.
A holistic assessment against the ten critical areas every school cyber program should cover — Essential Eight, NIST CSF, ISO 27001, Privacy Act, third-party risk, incident response, AI governance and more. You'll know your score before the debrief ends.
The top ten things to fix, sequenced by risk and effort, mapped to a 12–24 month roadmap and indicative budget. Something your Business Manager can take to Finance on Monday and your IT provider can start on Tuesday.
Written for your Board, School Council, Finance & Risk Committee and Diocesan oversight — not for a Security Operations Centre. Plain English. Evidence-linked. Defensible. Insurance-ready.
Independent advisory, not a competing service. Your MSP or internal IT team is welcome in every interview and debrief. Most of them thank me afterwards — the ones who don't, that's useful information on its own.
Ten critical areas every Australian K-12 school cyber program should cover. We assess each one holistically during the Health Check — not a deep audit, a clear view of "do you have this, do you have it working, or is this a gap".
If you can confidently say yes to fewer than five, the Health Check is step one — and a monthly advisory retainer is almost certainly step two.
Most schools score between three and six the first time through. That's not a failure — it's a starting point. The Health Check tells you which of the ten to fix first, in what order, and roughly what it'll cost.
One clear outcome: a Board-ready picture of where your service sits on cyber, and a prioritised plan for what to do next.
We check fit. If Coastal Cyber isn't right for your school, I'll tell you — and point you somewhere that is. No sales pitch. No deck. Your IT provider is welcome on the call.
Structured interviews with the Principal, Business Manager, IT provider and key operational staff. Evidence review across policies, contracts, MSP reports and insurance documentation. Holistic assessment against the ten non-negotiables, mapped to Essential Eight, NIST CSF, ISO 27001 and the Privacy Act.
A written report you can hand to your Board, School Council or Diocesan oversight. A 60-minute debrief with your leadership team — MSP and IT manager welcome to attend. Questions encouraged. Defensive posturing optional.
If, at the end of your debrief, you don't feel the Health Check gave you a clear picture of where you stand and what to do next, we'll refund your fee in full. No questions, no forms, no "but".
A free 20-minute call to talk about your school, your current cyber position, and whether a Health Check is the right next step. Your IT provider is welcome on the call. If the Health Check isn't the right fit, I'll tell you — and point you somewhere that is.