NDIS Cybersecurity Assessment Quiz

This Cybersecurity Assessment Quiz helps NDIS providers evaluate their cybersecurity readiness, protect participant data, and ensure compliance with NDIS Practice Standards and the Privacy Act 1988. Curated by Vivek Mahajan, founder of Careable and Cyber.Guide, it reflects Careable’s C.A.R.E. philosophy—Compassion, Accountability, Respect, Empowerment—and aligns with the Australian Cyber Security Centre’s (ACSC) Essential Eight. Use this quiz to identify gaps, strengthen practices, and prepare for NDIS audits.

Instructions:

Answer the 20 multiple-choice questions below by selecting the option that best describes your organization’s current practices.
Each question has four options; only one is correct and reflects best practices per ACSC and NDIS standards.
Tally your score using the scoring guide at the end to assess your cybersecurity maturity.
Use the results to download targeted resources from www.cyber.guide/resources.

Note: This quiz is updated quarterly to reflect NDIS and ACSC standards. For accessible formats (e.g., PDFs, audio), contact vivek@careable.com.au. Statistics are sourced from the 2024 ACSC Annual Cyber Threat Report.

How does your organization store participant data?

On unencrypted local drives or personal devices.

In encrypted cloud platforms with Two-Factor Authentication (2FA) enabled.

On paper files stored in unlocked cabinets.

In shared folders accessible to all staff.

None

How often do you conduct cybersecurity risk assessments?

Never; we haven’t identified cybersecurity risks.

Annually, with documented findings and mitigation plans.

Only after a cybersecurity incident occurs.

Every few years when updating systems.

None

What measures are in place to control access to participant data?

All staff have access to all data for convenience.

Role-based access controls (RBAC) limit data access to authorized staff.

Access is controlled by verbal agreements among staff.

Only managers have access, but passwords are shared.

None

How does your organization ensure participant consent for data sharing?

Consent is assumed unless participants opt out.

Clear, accessible digital consent forms are provided in plain language and diverse formats.

Consent is documented only in paper files.

Staff verbally confirm consent without documentation.

None

What is your organization’s password policy?

Passwords are optional and can be simple (e.g., “password123”).

Strong passwords (14+ characters, mixed case, numbers, symbols) are stored in a password manager.

Staff reuse passwords across personal and work accounts.

Passwords are written on sticky notes for easy access.

None

Is Two-Factor Authentication (2FA) enabled on critical systems?

No, 2FA is not used due to complexity.

Yes, 2FA is enabled on email, cloud storage, and NDIS portal accounts.

2FA is enabled only for managers’ accounts.

2FA is optional and rarely used.

None

How does your organization secure WiFi networks?

WiFi uses default passwords and WEP encryption.

WiFi uses WPA3 (or WPA2) encryption, unique SSIDs, and strong passwords.

WiFi is open to all staff and visitors without restrictions.

WiFi is disabled to avoid security risks.

None

What is your approach to mobile device security?

Staff use personal devices without security controls.

Work devices are managed with MDM, encryption, and PIN/biometric locks.

Devices are secured only with simple PINs.

Mobile devices are not used for work to avoid risks.

None

How frequently are critical data backups performed?

Backups are performed irregularly, if at all.

Automated daily backups follow the ACSC 3-2-1 rule (3 copies, 2 types, 1 offsite).

Backups are done manually once a month.

Backups are stored on the same device as the original data.

None

How often do you test backup restoration?

Never; we assume backups work.

Quarterly, with documented tests to verify data integrity.

Only after a data loss incident.

Annually, without formal documentation.

None

What cybersecurity training do staff receive?

No formal training is provided.

15-minute induction module and monthly refreshers using ACSC resources.

Training is provided only after incidents.

Staff are directed to online videos without follow-up.

None

How do you handle phishing awareness?

Staff are not trained on phishing detection.

Monthly phishing simulations and ACSC training modules are used.

Phishing is discussed only during annual meetings.

Staff are told to delete suspicious emails without guidance.

None

Does your organization have a written Cybersecurity Policy?

No, we rely on informal practices.

Yes, it mandates 2FA, encryption, and is reviewed annually.

A policy exists but is outdated and not enforced.

Policies are verbal and not documented.

None

How do you ensure staff acknowledge cybersecurity policies?

Staff are not required to acknowledge policies.

Staff sign policy agreements annually or during onboarding.

Policies are emailed but not tracked.

Acknowledgment is assumed after training.

None

Who is responsible for cybersecurity incident response?

No one is designated; staff handle incidents ad hoc.

A Cyber Incident Response Lead coordinates responses.

Only external IT providers handle incidents.

Managers handle incidents without a formal plan.

None

Do you have an Incident Response Plan?

No, we react to incidents as they occur.

Yes, it includes containment, recovery, and reporting steps, tested annually.

A plan exists but is not tested or updated.

We rely on external providers without a plan.

None

How quickly do you report significant data breaches?

We don’t report breaches unless forced to.

Within 72 hours to OAIC and NDIS Commission, as required.

Within a week, after internal reviews.

Only after confirming harm to participants.

None

How do you communicate with participants after a breach?

We don’t notify participants to avoid panic.

Clear, accessible communication explains the breach and offers support.

Notifications are sent only if legally required.

Staff verbally inform participants without documentation.

None

How often do you conduct internal cybersecurity audits?

Never; we rely on external audits.

Annually, using tools like Cyber.Guide’s NDIS Cyber Audit Prep Template.

Only when preparing for NDIS registration renewals.

Every few years, without a formal process.

None

Are your digital processes accessible for participants with diverse needs?

Accessibility is not considered in digital processes.

Consent forms and communications are available in plain language, audio, and large print.

Accessibility is addressed only for physical documents.

Staff handle accessibility on a case-by-case basis.

None

1 out of 5

Thank you For compelting the NDIS Cybersecurity Assessment Quiz

Additional Resources:

NDIS Cybersecurity Compliance Checklist: Comprehensive checklist for compliance (www.cyber.guide).
NDIS Cyber Audit Prep Template: Prepare for audits with this tool (www.cyber.guide).
2FA Setup Guide: Step-by-step 2FA implementation (www.cyber.guide).
Data Backup Checklist: Ensure robust backups (www.cyber.guide).
ACSC Training Modules: Free cybersecurity training (cyber.gov.au/learn).

Contact Us:
For support, accessible formats, or tailored advice, contact Vivek Mahajan at vivek@careable.com.au or linkedin.com/in/vivekmahajan.

About Cyber.Guide:
Founded by Vivek Mahajan in 2022, Cyber.Guide empowers NDIS providers with free, practical cybersecurity tools. Rooted in Careable’s compassionate mission, we protect the systems that support your participants. Data sourced from the 2024 ACSC Annual Cyber Threat Report.

Name

Phone

Time's up

NDIS Cybersecurity Assessment Quiz

Ready to Protect Your NDIS Business?

1300 DECIDE

hello@cyber.guide

104/12, Ormond Boulevard, Bundoora. Victoria. 3083

Quick Navigation

Stay Updated with Cyber.Guide

© 2025 Cyber.Guide. A free initiative by Vivek Mahajan and Careable.