An audit tells you where your centre stands. That is useful, but a report on its own does not protect a single child record. The value is in what you do next, in what order, over a sensible period of time.
We have already covered where childcare centres carry cyber risk: the family and child data you hold, the management software everyone logs into, the office computer running the whole operation. This post is the follow-up. If an audit has just shown you the gaps, here is a practical 90-day plan to close them, built around the way a centre actually runs rather than a generic checklist.
You do not need to do everything at once. You need to do the right things first.
The First 30 Days: Lock the Front Doors
The first month is about stopping the easiest ways in, and these are almost always about logins.
Start with multi-factor authentication. MFA means a second step when signing in, usually a prompt or code on a phone, so a stolen or guessed password is not enough on its own. Turn it on for email first, then your childcare management software, then your cloud storage. This single control blocks most account takeovers, and it is the one insurers and the National Quality Standard expect to see. Our guide to MFA for small business walks through it in plain English.
Next, kill the shared login. Most centres run the office computer on one password that every educator knows, and that never changes when someone leaves. Give every staff member their own account, so you can see who accessed what and remove access on someone’s last day rather than months later. This is a security control and an audit requirement at the same time.
Finally, take stock of who can see what. In many centres, every staff member can open every file, including custody arrangements, Medicare numbers, and staff bank details. The fix is to restrict the most sensitive records to the people who genuinely need them.
Days 30 to 60: Protect the Data and the Money
With logins under control, the second month addresses the data itself and the payments that flow through your centre.
Backups come first. A backup that runs but has never been restored is a guess, not a safety net. Sort out a proper 3-2-1 backup: three copies of your data, on two types of storage, with one copy offsite and protected so an attacker cannot delete or encrypt it. Then test a restore so you know it actually works. For a centre, the data at stake is enrolment records, child files, and financial history that would be painful or impossible to recreate.
Then look at fee handling. Childcare centres move regular money: parent fees, Child Care Subsidy, supplier and payroll payments. An attacker who quietly sits in a mailbox can send a convincing email asking to update bank details before the next run. The defence is part technical, part habit: MFA on every mailbox, plus a firm rule that any change to payment details is confirmed by a phone call to a known number, never by replying to the email.
Staff turnover belongs here too. Educators move on, casuals come and go, and access that is never removed becomes a quiet way in. Build a simple offboarding step into your process so a departing educator’s accounts are disabled the day they leave.
Days 60 to 90: Make It Stick
The final month is about turning a one-off cleanup into something that stays fixed.
Replace consumer antivirus on the office and admin machines with managed endpoint protection that someone is actually watching, so a compromised device can be spotted and isolated before a problem spreads. Confirm patching is being managed and reported on, not just left to the “auto-update is on” assumption, because most attacks use a known flaw that already had a fix available.
Most importantly, decide who owns this going forward. Security drifts the moment nobody is watching: MFA gets switched off “just for this account”, a new risky login appears, a backup quietly fails. The centres that stay secure are the ones where someone checks the controls held, month after month.
Everything in this plan lines up with Essential Eight, the baseline published by the Australian Cyber Security Centre. You do not need to memorise the framework. You need the controls behind it working in your centre.
Where to Start
If you have not had an audit yet, that is the natural first step, because most of these gaps are invisible until someone looks. An IT Audit gives you a documented picture of your centre’s setup and a clear order of priorities for $990, with no ongoing commitment. You will know what to fix first and what can wait.
We are a Sydney-based team in Bella Vista, and we work with childcare centres across the metro area. We understand the data you hold and the obligations that come with it, and we close these gaps without getting in the way of the work you are there to do. Talk to our team when you are ready.
