School Overview 

Hunter Valley Grammar School has built a strong reputation for educational excellence while maintaining a progressive approach to technology integration and risk management. As part of their commitment to protecting sensitive student, staff and parent information, the school has strategically aligned with industry-leading cybersecurity frameworks including ISO 27001 standards and Essential Eight Maturity Level 2.

The Cybersecurity Preparedness Challenge

While Hunter Valley Grammar School demonstrated strong crisis management capabilities for traditional incidents, leadership identified a critical gap in their preparedness framework. As part of a deliberate two-year cybersecurity maturity strategy, they recognised that effective cybersecurity extends far beyond technical controls to encompass whole-of-organisation incident response capabilities.

The School’s proactive leadership understood that effective cybersecurity extends beyond the IT department and technical solutions. They recognised the importance of ensuring all key decision-makers across the organisation could confidently navigate cyber incidents with the same expertise they demonstrate in other crisis management scenarios.

“While we’re very good at managing other types of critical incidents, the cyber element hadn’t previously been considered because it wasn’t in everyone’s mindset,” explains Adam Bird, Director of ICT. “The team here could respond but that response was based on our knowledge at that time, as opposed to having a predefined process and procedure.”

The Solution: Digipro IT Cybersecurity Tabletop Exercise

Hunter Valley Grammar School selected Digipro IT’s cybersecurity tabletop exercise after experiencing the service firsthand at an ICT in Schools conference. Digipro IT’s education sector specialisation meant they understood the complex stakeholder dynamics, operational constraints, and regulatory requirements that schools face. This expertise was particularly valuable given the School’s need for a solution that would engage non-technical leadership while delivering actionable insights.

The comprehensive tabletop exercise was delivered for approximately twelve participants, including school executives, operational leaders, and key personnel such as a school psychologist. The exercise featured:

• Customised ransomware scenarios relevant to school operations.
• Multi-stakeholder participation across executive and operational leaders.
• Gamification elements to maintain engagement and reduce tension.
• Real-world context using publicly available school information.
• Interactive decision-making with randomised outcomes to introduce realistic unpredictability.
• Comprehensive action plan with specific recommendations.

The approach prioritised creating a believable scenario with multiple escalating events that demonstrated how malicious actors might target the institution. Every participant was meaningfully engaged regardless of their technical background, ensuring the exercise delivered maximum value across all leadership levels.

“Digipro IT made sure that there was no one just sitting on the sidelines, that they all had to think about how it would impact their own individual spaces,” notes Adam Bird. “Everyone went into the exercise with a bit of trepidation about how it was going to go and how they were going to contribute. We came out with a positive energy, meaningful outcomes and proactive next steps to improve our preparedness.”

Transformative Outcomes

The tabletop exercise delivered significant improvements in cybersecurity preparedness and organisational confidence:

• Enhanced Leadership Confidence – The exercise demonstrated that Hunter Valley Grammar School’s crisis management capabilities effectively translated to cyber scenarios, transforming how leadership approached cybersecurity incidents.
• Strategic Insights and Action Planning – The exercise provided valuable strategic direction for Hunter Valley Grammar School’s cybersecurity roadmap, highlighting opportunities to strengthen business impact analysis documentation, establish clear system function ownership, and enhance data classification policies.
• Board-Level Recognition – The exercise’s success led to Digipro IT presenting outcomes directly to the school board, demonstrating the strategic importance of cybersecurity preparedness and validating investment in comprehensive security measures.

“It certainly gave the other people in the room a key understanding of some of the things we have to think about from a cybersecurity perspective,” explains Bird. “Having that critical incident response lens across cyber incidents was powerful and helpful.”

Ongoing Strategic Partnership

Following the successful tabletop exercise, Hunter Valley Grammar School is planning follow-up exercises to test implemented improvements. The School continues leveraging Digipro IT’s education sector expertise for ongoing cybersecurity initiatives, demonstrating the value of a strategic partnership approach to cybersecurity maturity.

“Running tabletop exercises are invaluable,” concludes Adam Bird. “At the end of the day, as we always say in the industry, it’s not if, it’s when. The more prepared you can be, the better off you’re going to be when that moment arises.”