Is your transport software still meeting today's standards?
Cybersecurity expectations have evolved. Has your transport platform kept pace?
Schools reassess insurance, banking, payroll and child safety on a defined cycle. Transport software often sits outside that cycle, sometimes for years. This checklist gives you a structured way to find out where yours stands.
Written for Business Managers, Directors of ICT, Risk & Compliance, Operations Managers and School Executives.
Why this matters
Cybersecurity is not a one-time procurement decision. It is an ongoing risk and compliance responsibility.
Most schools already run a periodic review over their major suppliers. Insurance is renewed and tested against current exposure. Banking and payroll are reviewed for control weaknesses. Child safety practices are audited against the National Principles.
Transport software is different in one important respect: it holds the location and attendance records of children, accessed daily by staff, drivers and parents. That makes it one of the more sensitive systems a school operates. If yours has been in place for several years, it is worth confirming that the standards it was originally chosen against are still the standards you would apply today.
The purpose of this checklist is not to change your supplier. It is to give you evidence, on the record, about the platform you already run.
What has changed
The baseline a school should expect from any software supplier has moved considerably in recent years.
Independent certification is now the benchmark
A supplier describing itself as secure is no longer sufficient. Accredited certification against a recognised standard, with a verifiable certificate and a defined scope, has become the expectation.
Data residency is a governance question
Where student data physically lives, and who can reach it from where, is now something schools are expected to know and document rather than assume.
Breach notification carries legal obligations
The Notifiable Data Breaches scheme sets requirements for how quickly incidents are reported. Your contract should reflect that, with a committed notification window.
Child safety extends to your suppliers
Working with Children Checks, child safety training and limits on how location data may be used now apply to the people who support your systems, not only to those on site.
What's inside the checklist
Fourteen domains covering the areas a school should be able to get clear answers on. Each domain explains what good looks like, then gives you questions a supplier can answer directly.
Data Security
How student and family information is separated, retained and disposed of across its life in the platform.
5 checks
Hosting & Data Location
Where the data physically resides, who operates those facilities, and whether anyone offshore can reach it.
5 checks
Encryption
Whether data is protected both while moving between systems and while stored, including on mobile devices.
5 checks
Identity Management
How accounts are created, authenticated and removed, and whether that can be driven from the school's own directory.
5 checks
Access Controls
Who can see which students, and on what basis supplier staff can reach the school's live data.
5 checks
Incident Response
What happens, and how quickly the school hears about it, when something goes wrong.
5 checks
Disaster Recovery & Continuity
How quickly the service and the data come back after a failure, and whether that has actually been proven.
5 checks
ISO 27001 & Certification
Whether the supplier's information security management system has been certified by an accredited third party, and what that certificate actually covers.
5 checks
Penetration Testing
Whether an independent party has actively tried to break the platform, how often, and what happened to what they found.
5 checks
Vendor Reviews & Roadmap
How the supplier governs its own supply chain, since the school's data is only as protected as the weakest party handling it.
5 checks
Audit History & Logging
The evidence trail. What has been audited, when, by whom, and what remains open.
5 checks
Privacy
The legal basis on which student and family personal information is handled, and the limits on what it may be used for.
5 checks
Child Safety
The controls that apply because the data describes children, which go beyond ordinary information security.
5 checks
Supplier Risk & Compliance
The ongoing arrangement. Whether security is a contractual obligation with a review cycle, or a one-off procurement conversation.
5 checks
Each domain sets out what good looks like, then gives you specific questions to put to a supplier.
Get your copy
Send it to your current supplier, or use it alongside a procurement process. It is vendor-neutral by design: every question is one you could put to any transport platform, including ours.
- Data Security
- Hosting & Data Location
- Encryption
- Identity Management
- Access Controls
- and 9 more sections
About RollCall
RollCall has provided school transport management software to independent schools for 10+ years, and today supports 300+ schools across Australia and internationally. We published this checklist because supplier due diligence is easier when there is a common set of questions to work from.
We hold ISO/IEC 27001:2022 certification, commission independent penetration testing, and publish our own completed version of a checklist of this kind. Our credentials, certificate details and security documentation are all available for review.
Book a complimentary platform review
A 30-minute benchmarking session. We work through the checklist against your current platform and give you a written summary of where it sits. This is a benchmarking exercise, not a sales demonstration, and there is no obligation attached to it.
Book a platform reviewPrefer to run the review yourself? The checklist is designed to be used without us.