Cybersecurity Governance in Aged Care: What Boards Should Ask to See
Boards need clear evidence that digital risks are understood, responsibilities are assigned and essential care can continue through disruption. The strongest assurance connects cybersecurity with the services and people it protects.
Consider a roster platform becoming unavailable at the start of a shift. A residential care home needs to confirm staff allocations; a home care team needs to coordinate visits. Both need current information about staffing and care priorities. A cyber incident, supplier outage or precautionary shutdown could create this situation.
Care managers need workable arrangements for that morning. Boards need confidence that the organisation has prepared for such disruption, understands its consequences and acts on gaps. That requires evidence that digital dependencies are governed well enough to protect people and sustain essential care.
Connect cyber risk with care quality
For providers subject to Standard 2, the Aged Care Quality and Safety Commission’s governance guidance connects governing body oversight with the systems supporting safe, quality care. Its information management guidance also addresses access to critical information when digital systems are offline. These expectations give boards a practical reason to examine digital resilience alongside care quality.
The AICD and Cyber Security Cooperative Research Centre’s Cyber Security Governance Principles provide a complementary foundation for board oversight. They cover accountability, strategy, risk management, culture and incident preparedness. Three questions can help translate that guidance into a focused board discussion.
1. Which digital failures could put people and care at risk?
Ask management to identify essential services and the digital dependencies supporting them. A care platform may rely on a shared login service, telecommunications and suppliers outside the organisation. Several applications can share one point of failure, so the assessment needs to follow how care is delivered across those connections.
The discussion should include the consequences of exposed personal information, unreliable care records and unavailable systems. For home care, disruption may affect visit coordination; in residential care, it may affect handovers or access to medication information. Ask which failures could have the greatest consequences, how quickly those consequences could emerge and what arrangements reduce the risk. This establishes a service-based basis for priorities and investment.
2. Who owns the decisions and the remaining risk?
Management should identify the executive accountable for coordinating cybersecurity and resilience across technology, care and operations. Clinical and operational leaders define the requirements for safe service delivery, while technical specialists assess the safeguards and recovery options. Supplier arrangements need an internal owner who can obtain information and require action.
The board should set risk expectations, specify the matters requiring its approval and understand how risks remaining after safeguards are applied are accepted and reviewed. A broad statement of low risk appetite becomes useful when linked to service tolerances, escalation thresholds and approval authority. If a critical system cannot meet an agreed recovery requirement, management should explain the care implications, temporary safeguards and proposed resolution. Material exceptions need an accountable owner and a review date.
3. What evidence shows that preparedness works?
Ask for findings from exercises, recovery tests and control reviews, including their scope and date. The Australian Signals Directorate’s incident response guidance recommends testing plans and connecting cyber response with business continuity arrangements. For a board, the useful evidence includes what staff could do, what failed and whether corrective actions were completed.
A concise assurance report could include:
Area | Evidence worth asking to see |
Information protection | Control review findings for sensitive data and critical accounts, including significant exceptions |
Essential care | Exercise results showing how priority services continued under disruption |
Recovery | Tested restoration times and data loss compared with agreed service requirements |
Critical suppliers | Relevant assurance and evidence supporting their incident and recovery commitments |
Improvement | Unresolved gaps, accountable owners, completion dates and decisions required |
Evidence also needs interpretation. An overall control coverage percentage can conceal a small number of highly privileged accounts without protection. A successful recovery test on one application may leave other essential services untested. Independent specialist review can help the board assess material uncertainties and challenge management’s confidence.
Use assurance to guide decisions
Frameworks such as COBIT 2019 can help connect governance with the management of risk, security and continuity. Their value becomes visible when responsibilities, evidence and improvement priorities are clear.
For the next board discussion, select one essential care service and ask management to demonstrate its dependencies, accountable owners and tested response to disruption. Then identify the decisions needed to close significant gaps. This creates a practical connection between board oversight and the organisation’s ability to sustain care.
eHomeCare’s Digital Governance advisory helps providers strengthen decision rights, accountability and meaningful oversight across care, operations and technology. Start a conversation about the evidence your board needs to make informed digital decisions.
Hubert van Dalen is the founder of eHomeCare, providing independent digital strategy, governance, technology and transformation advisory services to Australian aged care and disability providers.
Comments