Education has entered an era where technology sits at the centre of almost every school function. Learning platforms connect classrooms. Cloud systems manage administration. Digital tools support teachers. Student information moves across multiple services. Parents expect instant communication. Artificial intelligence is beginning to influence teaching, administration, assessment and decision-making.

Yet behind this digital progress sits a difficult question. Can schools govern the technology they increasingly depend on with the same confidence with which they use it?

For Andrew Hottes, Chief Executive Officer of ISO4 Pty Ltd, this question is not theoretical. It grew from years of working inside complex technology environments and became personal during his eight years at Cranbrook School. His experience showed him that schools do not simply need more technology or more security products. They need governance that works within the reality of education.

That insight now sits at the centre of his work with ISO4 Schools, an initiative built around a straightforward ambition to simplify compliance while helping schools strengthen cybersecurity, privacy, risk management and AI governance.

The need is significant. More than 350 million students globally receive their education outside the state school sector, while the world has more than 500,000 private and independent schools. Behind those numbers sit institutions with different budgets, structures, technology teams, and levels of governance maturity. The challenge is not whether schools use technology. It is whether they can understand, manage, and continually improve the risks that come with it.

From Technology Leadership to Education

Andrew did not begin his career in education. He spent more than two decades working across Australia, the UK, Hong Kong and the United States, gaining experience in transformation programs, complex environments and critical services.

Education changed how he viewed technology. In schools, technology supports more than operations. It enables learning and wellbeing, connects families with educators, and holds sensitive information about children. Identity details, medical records, family circumstances, academic results, and financial information require protection.

This environment shifted Andrew’s understanding of cybersecurity from a technical discipline to a responsibility built on trust.

A firewall matters, but its value comes from what it protects. The goal is to protect people, information, and families’ confidence in institutions.

At Cranbrook, Andrew put this philosophy into practice. The school navigated technology change, cyber uplift, privacy initiatives, managed devices, cloud services, and mature governance.

Cranbrook became the first school in Australia to achieve ISO 27001 certification and later the first school globally to achieve ISO 42001 certification for artificial intelligence management. Its journey showed that a school could meet governance standards associated with larger enterprises while preserving its educational purpose.

This experience shaped Andrew’s work in speaking, mentoring and writing. His books, Classrooms at the Crossroads and What Leaders Carry, explore leadership, responsibility, innovation and organisational capability. These lessons inform his work at ISO4.

The Governance Gap Hiding Behind Technology

Andrew does not believe schools lack security technology. Many have firewalls, endpoint protection, multifactor authentication, backups and cloud security.

The harder question is whether these controls form a genuinely governed environment.

A school needs to know which systems it relies on, who owns them, what information they contain, which suppliers can access that information and where the data sits. Leaders need to know whether contracts and privacy terms have received proper review, whether suppliers have introduced new artificial intelligence features and whether controls continue to work as intended.

Without those answers, technology can exist without governance.

Evidence may sit across spreadsheets, policies, emails, and individual knowledge. A supplier may become critical without receiving adequate assurance. A process may depend on one employee who understands how everything works. A policy may exist without anyone knowing whether people follow it.

For Andrew, the next stage of maturity does not involve endlessly adding new controls. It involves connecting existing controls to ownership, evidence, risk, supplier assurance and regular review.

The distinction matters because schools cannot transfer accountability to their technology suppliers. A school may outsource an application, but it cannot outsource responsibility for student, staff or family information.

Why Schools Need Their Own Governance Lens

Andrew does not argue that schools need weaker standards. He argues that they need standards translated into an environment that makes sense.

ISO 27001, ISO 42001 and the Australian Essential Eight provide structure and rigour. Yet schools operate differently from conventional enterprises.

Teachers move between classes and systems. Students actively use technology. Parents expect accessible communication. Technology teams may remain relatively lean while supporting a remarkably broad collection of services. Child safety, privacy and educational considerations add further layers that generic corporate examples cannot always address effectively.

The answer lies in translation.

A teacher is unlikely to engage with a control simply because a standard requires it. Explain how that same control protects student information, reduces disruption, and strengthens supplier confidence, and the reason becomes much clearer.

That is the space Andrew sees for education-specific governance. The rigour remains intact, but the language, workflows and decisions reflect how schools actually operate.

His view is especially relevant for boards. School boards do not need to become technical committees. They need information that allows them to exercise judgement.

Instead of asking whether a school is secure, Andrew encourages boards to ask which risks matter most, which risks sit outside the organisation’s appetite, who owns them, what action has been taken, what evidence supports the answer, and what would happen if a critical supplier became unavailable tomorrow.

Turning Cybersecurity Into a School-Wide Responsibility

One of Andrew’s strongest beliefs is that cybersecurity cannot remain an IT responsibility.

He uses the idea of Data Guardians to describe the shared responsibility of people who handle information. Finance, teaching, human resources, administration, executives, and ICT all have different roles in protecting data.

He also sees a growing role for Technology Risk Ambassadors. These people sit across academic and operational functions and help identify emerging risks before those risks become problems for the technology team.

Culture matters just as much as process.

Andrew places particular importance on psychological safety. If someone believes they will face blame for raising a concern, they may stay silent. If they trust the organisation, they are more likely to say they think there is a problem while there is still time to address it.

That philosophy shapes his approach to leadership. He does not want schools to build security cultures around fear. Fear may create short-term compliance, but it rarely creates sound judgement.

Instead, he advocates clear ownership, escalation pathways, supplier reviews, practical training, tabletop exercises, risk reviews, and management oversight. Leaders must also follow the same rules they expect from everyone else.

AI Has Changed the Governance Conversation

Artificial intelligence has introduced a new layer of complexity because it can enter a school without anyone formally introducing a new system. A teacher can open a public AI tool, a student can create an account, or a software provider can activate an AI feature within a platform the school already uses. This can create new data flows and decision-making capabilities without a conventional procurement process.

For Andrew, the question should move beyond whether schools should allow or ban AI. The more useful question is how schools can make AI governable. Leaders need visibility into where AI operates, what data enters each tool, how suppliers handle that data, whether prompts or uploads remain stored or support training, what age restrictions apply, where human oversight remains, and who owns each use case.

Accuracy, bias, intellectual property, and academic integrity also require attention. Shadow AI creates another challenge. Blocking every tool can push usage underground, while visibility and sensible approval pathways provide a more practical approach.

AI governance extends beyond classrooms and assessment. It increasingly touches administration, human resources, finance, communications, service desks, and productivity platforms. Andrew explored this wider balance between opportunity and responsibility in Classrooms at the Crossroads, examining AI’s promise and risks in education.

His experience with ISO 42001 reinforced an important lesson: an AI policy does not equal AI governance. At Cranbrook, ISO 27001 disciplines around risk, data, suppliers, evidence, and review created a strong foundation. AI governance can build on these existing systems rather than create another structure. For Andrew, cybersecurity, privacy, and AI governance increasingly belong together.

From Frameworks to Everyday Execution

This belief led directly to ISO4 Schools.

Andrew saw a gap between the number of frameworks available to schools and schools’ ability to implement them consistently. Schools already have standards, government frameworks, privacy requirements, cybersecurity recommendations, policies, consultants, and technology products.

The challenge comes after the framework arrives.

Who owns each requirement? What evidence proves that it works? Which gaps remain open? When should someone review the requirement? What risk does it address? What should the board see?

Andrew had experienced these questions firsthand. His ISO 27001 and ISO 42001 work involved audits, evidence gathering, ownership discussions, and the practical reality of keeping a management system alive through technology changes, staff changes, and emerging risks.

ISO4 Schools aims to turn those lessons into repeatable practice.

Its guiding phrase is Simplifying Compliance. That does not mean reducing the strength of a standard. It means removing unnecessary complexity from the user experience and turning governance into practical actions.

Instead of relying on spreadsheets, Word documents, emails, meeting minutes and individual memory, ISO4 Schools brings requirements, ownership, risks, evidence, policies, suppliers, reviews, improvements and reporting into a connected governance approach.

The complexity remains in the engine while school leaders receive a clearer view of where they stand, what matters next, who owns the work, what evidence exists and how improvement is progressing.

Moving From Reaction to Readiness

Andrew wants school leadership teams to move away from governance conversations that begin only after something goes wrong.

A breach should not be the moment when a board first asks about its risk position. Neither should a supplier compromise or audit finding. ISO4 Schools is intended to support visibility before those events occur. Leadership teams should be able to see material risks, associated controls, owners, evidence, and outstanding actions.

The measurements also need to remain useful. Boards do not need endless technical metrics. They need signals that help them judge whether governance is improving. Are high risks declining? Are overdue actions increasing? Have critical suppliers undergone review? Are privacy assessments taking place? Are AI use cases following the agreed process? Do internal reviews keep discovering the same weakness?

Continual improvement then turns events into organisational learning. An incident should lead to change. An audit finding should lead to change. A new AI feature from a supplier should trigger a review.  That creates a governance system rather than a quarterly dashboard.

Building Practical and Quiet Security

Over the next three to five years, Andrew wants schools to focus on five practical priorities. First, institutions need visibility into their systems, suppliers, data, and AI use cases because organisations cannot govern what they cannot see. Second, they must strengthen identity and data protection by understanding where sensitive information sits, who can access it, and how identity connects people to digital services.

Third, suppliers must become part of the control environment. As schools depend more heavily on EdTech software-as-a-service platforms, supplier assurance must continue beyond procurement. Fourth, AI governance needs to become operational now. Schools can start with an inventory, assessment process, clear ownership, and human oversight rather than waiting for perfect regulation or policy.

Finally, schools need to rehearse failure. Tabletop exercises can test how they would respond if a management system went offline, a critical supplier suffered a breach, sensitive data became exposed, or communications stopped working. Across these priorities, Andrew returns to one question boards should become comfortable asking: show me the evidence.

For Andrew, mature security should also become almost invisible. Teachers should teach, students should learn, and staff should understand which tools they can use. Identity and device controls should work quietly, suppliers should receive proper assessment, data should have clear ownership, and AI should have accountable owners. Incident plans should undergo regular rehearsal, while boards should understand material risks without becoming technical specialists.

Andrew believes ISO4 Schools can help institutions reach this maturity without creating a large compliance bureaucracy, making strong governance practical even for schools with limited resources.

A Practical Leadership Philosophy

Andrew’s advice to school principals, CIOs, technology leaders and board members begins with a simple instruction. Start with what you already have, not with a shopping list.

Before purchasing another product, understand the environment. Identify important systems and information. Determine which suppliers could seriously affect the school if they failed. Find obvious gaps. Assign ownership. Identify existing evidence.

He developed his Hierarchy of Cyber Needs after repeatedly seeing organisations pursue sophisticated initiatives while basic controls still required attention.

Identity, devices, patching, backup, access, awareness and resilience matter. Those foundations then need to connect with governance, risk and continual improvement. He also sees value in combining the Essential Eight with ISO 27001. One provides a practical operational baseline while the other establishes the management disciplines around ownership, risk, evidence, audit and continual improvement.

His advice to boards is not to become technical experts. Learn enough to ask good questions. His advice to technology leaders is equally direct. Explain risk without hiding behind technical language. And above all, do not try to become mature overnight. Choose the important areas, assign owners, build evidence, review what happened and improve.

That is how sustainable capability develops.

Building Capability That Remains

The deeper ambition behind Andrew’s work extends far beyond certification. He wants to change how education understands good governance, showing that strong cybersecurity and responsible AI governance can fit within the realities of school life. Schools hold sensitive information, depend heavily on digital services and carry a unique responsibility because children sit at the centre of their mission. Their governance frameworks should reflect that responsibility while remaining practical and achievable.

Andrew also wants to move education away from fear. Cybersecurity should not exist only as a story about ransomware and breaches, while AI should not become a choice between excitement and panic. Good leadership sits between these extremes. It recognises opportunity, understands risk, makes informed decisions, records the reasoning behind them and continues to review whether those decisions remain appropriate.

This philosophy connects with a central idea in What Leaders Carry: leadership should leave people and organisations more capable. If everything depends on one person, that person may have created activity without building lasting organisational capability.

The same principle shapes Andrew’s vision for ISO4 Schools. Its legacy should go beyond helping schools pass audits or achieve certification. It should help institutions embed governance into daily operations, protect students, support responsible innovation and give boards, educators, leaders and families greater confidence in digital environments.

Andrew’s experience at Cranbrook demonstrated that schools can meet demanding standards without losing sight of their educational mission. Now, he wants to make that maturity more accessible worldwide.

His vision rests on five beliefs: governance must operate, evidence must outweigh intention, good governance should enable safe decisions, raising concerns should be treated as an act of trust, and leadership should leave capability behind.

Ultimately, the future of school cybersecurity depends not only on stronger technology, but on responsibility, evidence, ownership and sound judgement.