Drag
loader

Contact info

Email
hello@ferressystems.com.au
Based in
Melbourne, Victoria

Follow us

Talk to the team
Talk to the team
All industries // DISABILITY SERVICES

The people you support cannot absorb a bad week

Managed security and IT for Australian disability service providers, built around participant data, NDIS Practice Standards and the systems that rosters actually run on.

Talk to us about your practice
 Free, no access needed See what you are exposing
// WHAT YOU ARE ACTUALLY UP AGAINST

The obligations and pressures, in plain English

The specific pressures on disability services in Australia, with the regulator or source named. Where a duty comes from a contract or an insurer rather than a statute, it says so.

01

The NDIS Practice Standards expect real information management

Registered providers must demonstrate that participant information is identifiable, accurately recorded, current and confidential, and that it is stored and disposed of properly. Auditors ask for evidence of this, not a description of it.

02

Participant data is sensitive information twice over

You hold health information, disability information and often financial and guardianship details for people who are, by definition, in a position of dependence. The Privacy Act treats this as sensitive information with the stricter obligations that follow.

03

Service continuity is a safeguarding issue

For most businesses, a systems outage is a lost day. For a provider, not knowing who is rostered to a participant with high support needs is a risk to that person's wellbeing. Availability is part of your duty of care.

04

Funding bodies and partners audit you

Security questionnaires arrive from funders, partner organisations and government contracts, often with short deadlines and sixty or more questions, and the answers have to be evidenced.

// WHAT ACTUALLY GOES WRONG

Four patterns we keep seeing

The spreadsheet running operations

Rostering, availability and participant details held in a spreadsheet only one person can edit is extremely common, and it is a single point of failure for both continuity and confidentiality.

A large, distributed, casual workforce

Support workers use personal devices, turn over frequently, and are onboarded quickly. Offboarding is where access quietly accumulates.

Participant data in messaging apps

Coordination happens in whatever is fastest, which often means personal phones and consumer messaging, with clinical and personal details in them.

Under-resourced back office

Not-for-profit and smaller providers rarely have dedicated IT, so systems are chosen for cost and kept until they break.

// FROM THE FIELD

The spreadsheet that ran the roster, and the feature we talked them out of

A rostering spreadsheet only one person could edit, holding clinician availability and participant details. The build took nine weeks, and the most useful thing we did was persuade them to leave a third of the wish list out of it.

Read the write-up
// WHERE TO START

What matters most for disability services, in order

01

Cybersecurity Governance and Compliance

The policies, the evidence register and the tested incident response plan that turn an audit or a funder questionnaire into a filing exercise.

 02

Managed Security

Monitoring and response across a distributed workforce, which is exactly the environment where nobody is watching after hours.

 03

Custom Software and Integrations

Replacing the spreadsheet that runs the roster with something built for the job, owned by you, with access controls designed in.

 04

Security Baseline Assessment

A fixed-price, read-only baseline of your Microsoft 365 and Entra environment, as a starting point for where you actually stand.
// ASKED BY DISABILITY SERVICES CLIENTS

Frequently asked questions

With the two free tools. The Essential Eight readiness checklist asks for nothing and gives you a view of your controls based on your own answers. The Exposure Check needs a work email at the domain being checked, because the report is sent to that inbox, and it shows what your domain reveals to the outside world. Both say plainly what they cannot see. If they surface something real, then it is worth a conversation.

The free resources

Yes, and this is a situation we have been in with an organisation before. The accurate answer to many of those questions is often "we do not know", and the fix is building the evidence so the answers become easy and true. That took six weeks the first time and forty minutes thereafter.

The questionnaire that arrived on a Thursday

They do not name technologies, which is why they are often misread as vague. What they require is that you can demonstrate participant information is accurate, current, confidential and properly stored and disposed of. In practice that means access control, retention, backups and evidence that all three work.

No, and telling a casual workforce to buy devices is not a plan. It is manageable with the right controls on the data rather than the device, so that work information is separated and can be removed when someone leaves, without touching their personal phone.

Working nationally from Melbourne, Victoria. How the national service works, or see the other sectors we write about.

Tell us what you are protecting.

Get in touch