Education IT Checklist
Key IT, privacy, safety, Wi‑Fi/BYOD, and continuity checkpoints for NZ education providers
Purpose: This checklist helps schools, kura, ECE services, and tertiary providers assess their IT readiness. Use it to protect student data, harden networks and devices, meet safety expectations, and maintain operations during outages and exam periods.
Governance, Policy & Duty of Care
- Named Privacy Officer and ICT Lead; Board/SLT oversight of ICT risk
- Acceptable Use, Remote Access, and BYOD policies communicated to staff, students, and whānau
- Onboarding/offboarding checklists for staff and students (accounts, devices, keys, access)
- Netsafe incident response and student wellbeing procedures documented
- Cloud/outsourcing governance for SMS/LMS/Email with right‑to‑audit clauses
Student Data Privacy & Records (Privacy Act 2020)
- Only necessary student/whānau data collected; purposes explained at enrolment
- Consent captured/managed for photos, recordings, and publishing student work
- Parent/guardian access/correction process with identity verification and SLAs
- Retention schedules for enrolment, pastoral, and assessment records; secure disposal
- Breach‑response plan including OPC notification thresholds and communication templates
Student Management System (SMS) & Learning Platforms
- Role‑based access and MFA enabled for SMS (e.g., KAMAR/EDGE) and LMS (e.g., Google/M365)
- Shared logins eliminated; admin actions logged and reviewed
- Backups/exports of key records with periodic restore tests
- Integrations (timetabling, library, payment gateway) change‑controlled; API keys rotated
- Downtime plan for roll‑marking, reporting, and exam periods
Devices, MDM & BYOD
- Device standards for 1:1 programmes; warranty and accidental damage options
- MDM configured (Intune for Education/Apple School Manager/Google Admin) with profiles and app policies
- Web filtering and classroom management tools consistently applied on/off campus
- Lost/stolen process (remote lock/wipe) and asset reconciliation routines
- Accessibility settings and loan‑pool devices for equity and inclusion
Network, Wi‑Fi & N4L Filtering
- Separate networks/SSIDs for staff, students, guests, and IoT
- WPA2‑Enterprise/WPA3 where supported; strong passphrases rotated if PSK used
- Regular Wi‑Fi site surveys for capacity (high‑density classrooms, halls, exam rooms)
- N4L or equivalent filtering configured; SSL inspection policy considered and communicated
- DNS security and content filtering logs retained with privacy notice
Email, Identity & Cybersecurity
- SPF, DKIM, DMARC implemented; external warning banners on suspicious mail
- MFA enforced for staff/admins; conditional access for risky sign‑ins
- Phishing simulations and staff/student cyber awareness programme
- EDR/AV on endpoints; patch/vulnerability management with monthly reporting
- Centralised logging and alerting for account abuse and data exfiltration
Safety, Safeguarding & Online Conduct
- Clear reporting pathway for bullying, self‑harm concerns, and harmful digital communications
- Monitoring tools configured with privacy and proportionality; escalation playbooks defined
- Classroom recording/photography rules; storage and sharing controls in place
- Social media governance for official accounts (admins, 2FA, recovery contacts)
- Digital citizenship curriculum and parent/whānau guidance published
Assessment, Exams & Continuity
- Resilience plan for online assessments (e.g., NZQA e‑exams): spare devices, power, network paths
- Offline procedures and printed materials for outages and evacuations
- UPS/generator coverage for critical systems (core switches, servers, Wi‑Fi controllers)
- Communication trees for SLT, staff, students, parents, and transport providers
- Post‑incident reviews with lessons integrated into policies and training
Third‑Party Risk & Data Residency
- EdTech app vetting: purpose, data collected, storage location, and deletion policy
- Data Processing Agreements covering Privacy Act obligations and breach timelines
- Attestations (SOC 2/ISO 27001) reviewed; children’s data protections checked
- Right‑to‑audit clauses for major providers; periodic performance/uptime reviews
- Exit/transition plans ensuring portability and deletion of student data
Website, Communications & Reputation
- HTTPS/HSTS enforced; CMS/themes/plugins patched; WAF/CDN enabled
- Consent/cookie banners aligned to privacy rules; GA4/GTM tag governance
- Public contact channels monitored; impersonation/phishing domains watched
- Whānau communications SOP and translation/format accessibility options
- Media response templates for safety/privacy incidents
Audit, Evidence & Improvement Roadmap
- Control library mapped to Privacy Act, Netsafe guidance, and internal standards
- Evidence register with owners and refresh cadence (termly/annual)
- Leadership dashboard (KPIs, KRIs, open actions) reviewed each term
- 90‑day improvement plan prioritising high‑impact, low‑effort fixes
- Maturity model tracking: Minimum → Strong → Leading
- Local, responsive, and personalised service.
- Transparent pricing.
- Expertise across industries and platforms.
- Strategic, not just reactive.