# data[].attributes.headline
Knowledge of delegation of authority is unclear in schools (CESA)

# data[].attributes.subject
Knowledge of delegation of authority is unclear in schools (CESA)

# data[].attributes.body
Principals occasionally sign off agreements that they shouldn't

# data[].attributes.headline
Where possible, shift the workload to the requestor

# data[].attributes.subject
Where possible, shift the workload to the requestor

# data[].attributes.headline
Include 'Have I used this app before?' in the assessment request

# data[].attributes.subject
Include 'Have I used this app before?' in the assessment request

# data[].attributes.body
Make sure requestors do the due diligence first

# data[].attributes.headline
Usage of technologies that already exist and are approved

# data[].attributes.subject
Usage of technologies that already exist and are approved

# data[].attributes.headline
Vendors are going direct to schools, bypassing centralised channels

# data[].attributes.subject
Vendors are going direct to schools, bypassing centralised channels

# data[].attributes.headline
Conflicting recommendations of applications from certain teams within schools that haven't been assessed

# data[].attributes.subject
Conflicting recommendations of applications from certain teams within schools that haven't been assessed

# data[].attributes.headline
Everyone from the top to the bottom within the organisation needs to be along for the journey

# data[].attributes.subject
Everyone from the top to the bottom within the organisation needs to be along for the journey

# data[].attributes.headline
Principals are too busy to be responsible for deciding about technology risk

# data[].attributes.subject
Principals are too busy to be responsible for deciding about technology risk

# data[].attributes.headline
Monitoring adherence to an approved list

# data[].attributes.subject
Monitoring adherence to an approved list

# data[].attributes.body
How do you ensure that individuals are correctly using an approved technology list?

# data[].attributes.headline
Assisting the principal to say yes or no

# data[].attributes.subject
Assisting the principal to say yes or no

# data[].attributes.body
Principals want to be able to consistently use their range of apps that are used by teachers

# data[].attributes.headline
Technologists need to be able to easily categorise apps

# data[].attributes.subject
Technologists need to be able to easily categorise apps

# data[].attributes.body
When technologists can't categorise today, how are educators meant to

# data[].attributes.headline
Can assessments be completed in a 'reasonable' time?

# data[].attributes.subject
Can assessments be completed in a 'reasonable' time?

# data[].attributes.headline
IT Due Diligence is for everyone - includes BCE (Head) Office staff

# data[].attributes.subject
IT Due Diligence is for everyone - includes BCE (Head) Office staff

# data[].attributes.body
Great diversity of applications amongst Office staff using individual third-party apps for their work, without due diligence

# data[].attributes.body
Problem: BCE has to assess every third-party app & service that is requested, unless totally unsutable. That is unsustainable, need more discernment & selection processes about the selction before apps are requested by schools.

Improved BCE online Request submission form to provide better information to assist triaging of request

Developing templates to streamline & get consistency in Reviews

Creating ways to easily assess ‘potato apps’ low risk but still maintain appropriate mitigatin strategies

Reusability of templates & reviews

# data[].attributes.body
2023 IT Due Diligence Procedure (policy) published. Helps to support compliance.

Extended responsibility: “IT due diligence is everyone’s responsibility & brought BCE Office into Due diligence requirements.

# data[].attributes.headline
Recurring training and security initiatives helps encourage the culture of understanding and planning for security risk

# data[].attributes.subject
Recurring training and security initiatives helps encourage the culture of understanding and planning for security risk

# data[].attributes.headline
What about educational effectiveness to compliment security effectiveness?

# data[].attributes.subject
What about educational effectiveness to compliment security effectiveness?

# data[].attributes.body
Arrow

# data[].attributes.body
Arrow, AusCert, ST4S and others

# data[].attributes.body
Look here first (safe, embedded, endorsed)

# data[].attributes.headline
Right now there's a buy culture to combat (CEWA)

# data[].attributes.subject
Right now there's a buy culture to combat (CEWA)

# data[].attributes.body
There's a risk that people are gravitating towards shiny things

# data[].attributes.headline
Capture what schools are using different applications

# data[].attributes.subject
Capture what schools are using different applications

# data[].attributes.headline
Educator ratings around the use of tools would be helpful

# data[].attributes.subject
Educator ratings around the use of tools would be helpful

# data[].attributes.body
Add in reviews and ratings around pedagogical use (MACS). Tripadvisor style reviews

# data[].attributes.headline
Principals are invited to accept or not accept the risk (BCE)

# data[].attributes.subject
Principals are invited to accept or not accept the risk (BCE)

# data[].attributes.body
We use a scaling system (Extreme, High, Low). It's all risk related.

It's not our job to approve

# data[].attributes.headline
We don't assess from a T&L context, we're looking at security and child-safety (CEWA)

# data[].attributes.subject
We don't assess from a T&L context, we're looking at security and child-safety (CEWA)

# data[].attributes.body
Making sure the security perspective is embedded throughout every process. We should all be asking the same thing from vendors

# data[].attributes.body
As an example, there's no shame in being the victim of a security event

# data[].attributes.body
If there's an element of fear, no one will do it.

# data[].attributes.headline
How often are we changing people's opinions around existing apps that are approved and have been purchased?

# data[].attributes.subject
How often are we changing people's opinions around existing apps that are approved and have been purchased?

# data[].attributes.headline
Despite an approved technology list existing and an ED, teachers still don't know about it after 18 months  (CEWA)

# data[].attributes.subject
Despite an approved technology list existing and an ED, teachers still don't know about it after 18 months  (CEWA)

# data[].attributes.body
The reasons for the risk mitigation are clear

# data[].attributes.headline
Developing a relationship between tech and education is a big challenge (L)

# data[].attributes.subject
Developing a relationship between tech and education is a big challenge (L)

# data[].attributes.headline
Building an approved technology list now (L)

# data[].attributes.subject
Building an approved technology list now (L)

# data[].attributes.headline
An approved technology list exists (in Confluence) but I can't see it (CG)

# data[].attributes.subject
An approved technology list exists (in Confluence) but I can't see it (CG)

# data[].attributes.headline
Siloed in different departments with limited visibility (CG/L)

# data[].attributes.subject
Siloed in different departments with limited visibility (CG/L)

# data[].attributes.headline
No documented process for approval until this year (CG)

# data[].attributes.subject
No documented process for approval until this year (CG)

# data[].attributes.headline
Templates are needed to simplify the request process (CEWA)

# data[].attributes.subject
Templates are needed to simplify the request process (CEWA)

# data[].attributes.headline
Principal makes the final decision. IT provides a risk rating. (BCE)

# data[].attributes.subject
Principal makes the final decision. IT provides a risk rating. (BCE)

# data[].attributes.headline
Volume of app requests has overwhelmed the process (BCE)

# data[].attributes.subject
Volume of app requests has overwhelmed the process (BCE)

# data[].attributes.headline
IT due diligence procedure published (BCE)

# data[].attributes.subject
IT due diligence procedure published (BCE)