You're viewing Australia & New Zealand Australian owned and operated

Child Safety Policy

Effective date: 1 August 2026 · Last updated: [DD/MM/2026] · Review cycle: Annual · Next review: 1 August 2027 · Approved by: Reg Williams, Chief Executive Officer

1. Purpose

Cybernetic Shield is committed to ensuring that all children and young people are safe, supported, empowered and protected when they engage with our services. This includes our digital products, helpline, education programs, school and organisational partnerships, and communications.

This policy sets out how Cybernetic Shield upholds child safety across every part of our service delivery and technology design. It is informed by and aligned with the National Principles for Child Safe Organisations and, where applicable, gives effect to the Child Safe Organisations Act 2024 (Qld), Queensland’s Child Safe Standards and Universal Principle. It is also supported by relevant safety, privacy and technology assurance frameworks, including Safer Technologies for Schools (ST4S).

This policy is publicly available so that children, families, schools and the wider community can read it.

2. Scope

This policy applies to:

all Cybernetic Shield employees, contractors, volunteers and partners
all online and in-person interactions with children
all Cybernetic Shield digital platforms, including the 24/7 Cyber Incident Helpline, 3Cs Help and other student tools, our learning management system (LMS) and portals
school-based delivery and support services
services delivered with sporting groups, membership organisations and employers
public communications and content provided to children and parents

This policy applies to our work in Australia and New Zealand.

3. Our core beliefs

Our approach to child safety is shaped by our core beliefs:

It takes a village. Everyone contributes to online safety, and blame does not support children.
Knowledge is power. Children need practical, current support to navigate online spaces.
Everyday online impacts matter. Small harms can be as significant as major events.
Restriction alone is not enough. Effective online safety combines appropriate and lawful age restrictions with education, supervision, help-seeking, digital literacy and practical safety strategies.

These beliefs guide how we listen, respond, educate and design technology.

4. Policy statement

Cybernetic Shield:

places child safety and wellbeing above all other considerations
supports children’s right to be heard and to participate in decisions that affect them
responds promptly and appropriately to concerns, disclosures and risks
ensures all staff act ethically, respectfully and transparently
designs digital environments using safety-by-design principles
fosters cultural safety and inclusion
ensures interactions are trauma-informed and developmentally appropriate
addresses complaints through child-safe pathways and transparent processes

5. Alignment with the National Principles for Child Safe Organisations

National Principle	How Cybernetic Shield implements it
1. Leadership and governance	CEO oversight; Clinical and Technical Governance Framework; clear policies
2. Child participation	Youth-friendly materials; student surveys; opportunities for input
3. Family engagement	Parent portal; clear communication; support resources
4. Equity and diversity	Inclusive content; culturally safe practice; accessible resources
5. Upholding children’s rights	Trauma-informed support and privacy safeguards
6. Staff behaviour	Code of Conduct; child-safe training; role-based permissions
7. Complaints and concerns	Clear processes; links to our Feedback and Complaints Management Policy; escalation pathways
8. Education and training	Ongoing staff training; education for schools, parents and students
9. Safe environments	ST4S-aligned digital systems; safety-by-design methods
10. Continuous improvement	Incident review; data insights; annual policy review

6. Child safety principles embedded in our work

6.1 Child-safe digital design

Cybernetic Shield implements:

ST4S technical standards
risk-based content filtering
restricted data handling
safe onboarding and offboarding for student accounts
transparency in data use
age-appropriate content design
visible and persistent help options, warnings before sensitive content, confirmation prompts for risky actions, and clear in-product guidance on how to seek help

6.2 Accessible and inclusive digital environments

We design all child-facing content and tools to be accessible and inclusive. We apply:

WCAG 2.2 AA accessibility standards
age-appropriate, plain-language writing
culturally inclusive examples and imagery
reduced cognitive load and predictable layouts
neurodiversity-inclusive design (reduced sensory overload, clear sequencing and limited clutter)

All digital materials must be understandable, easy to navigate and suitable for diverse learning needs.

6.3 Trauma-informed practice

Our staff use:

calm, supportive, non-judgemental language
active listening
empowerment and validation
practical immediate safety and harm-minimisation steps within our scope of practice, with clinical safety planning referred to an appropriately qualified external provider where required

6.4 Privacy and confidentiality

We collect the minimum data needed about children.
Reporting is de-identified by default.
Safety overrides confidentiality when a child is at risk.
Privacy is safeguarded by our Privacy Policy and Data Governance and Handling Standard.

7. Behavioural expectations for all staff

All staff must:

treat all children with dignity and respect
listen and respond sensitively to disclosures
never shame, blame, scare or moralise
maintain professional boundaries
avoid personal social media interactions with children
use organisation-approved communication channels only
protect all identifying information
comply with mandatory reporting laws
escalate concerns immediately

Breaches may result in disciplinary action, removal from duties or referral to authorities.

8. Complaints and reporting concerns

8.1 Raising concerns

Children, parents, carers and schools can raise concerns or complaints through:

our Feedback and Complaints Management Policy
the 24/7 Cyber Incident Helpline, including through 3Cs Help
their school’s wellbeing or leadership team
our website or by email to csenquiry@cyberneticshield.au
anonymous submissions, where appropriate

We make sure all complaints and concerns are managed respectfully, promptly and in a child-safe way.

Children must have simple, child-friendly ways to raise digital concerns. We provide clear reporting pathways through the helpline, 3Cs Help, website forms and school wellbeing staff. Our explanations are written in plain language, with reassurance that children will not be blamed or punished for speaking up.

8.2 Internal reporting by Cybernetic Shield staff

If a staff member becomes aware of a concern, disclosure or risk, they must:

ensure the child’s immediate safety
record the concern accurately in the approved system
escalate internally to the Chief Risk Officer (Child Safety Lead), the Director of Investigations, or the Clinical Lead / Director of Helpline
not investigate allegations of abuse themselves, other than the technical and digital forensic work described in section 8.3.1, as this is the role of statutory authorities
continue to follow internal escalation guidance and support the school or family as appropriate

Digital forensic investigations may continue where lawful and appropriate (for example, in cases of grooming, sextortion or cyber abuse), even if police are involved. These investigations focus on technical evidence and risk, not on substantiating allegations.

8.3 Mandatory reporting obligations

Mandatory reporting, police reporting, voluntary protective reporting and Reportable Conduct Scheme obligations are governed by our Mandatory Reporting and Reportable Conduct Framework.

Our school-first pathway is a coordination and assurance model only. It does not transfer, replace or discharge a statutory obligation held by a school, principal, governing body, head of entity, staff member, contractor or other statutory duty-holder.

Internal escalation, or coordination with a school, must never delay a personal statutory reporting obligation, emergency action or other time-critical protective report.

Any allegation, complaint or concern about the conduct of a Cybernetic Shield employee, contractor, volunteer or other worker towards a child must be escalated immediately and assessed under the Mandatory Reporting and Reportable Conduct Framework.

Whether Cybernetic Shield itself is a reporting entity under a jurisdiction’s Reportable Conduct Scheme must be determined under the applicable legislation, and must not be assumed solely because we provide services to children.

8.3.1 Investigations: what we do and do not do

Cybernetic Shield does not:

conduct interviews intended to substantiate abuse
attempt to determine whether allegations are “true”
replace the role of child protection services or police

We may, however, continue technical or digital forensic investigations when a police matter is active, including:

gathering digital evidence
reconstructing online timelines
identifying accounts, devices or actors
assessing ongoing risk and safety planning
providing technical reports to police or schools

This is consistent with our role as a cyber incident and digital safety partner.

8.3.2 Safety overrides confidentiality

Confidentiality and privacy never override child safety. Cybernetic Shield may disclose information to schools, police, child protection services or the eSafety Commissioner if this is needed to keep a child safe.

8.4 Relationship with schools

Cybernetic Shield:

collaborates with schools to understand concerns
provides guidance on reporting obligations
supports the school’s wellbeing and leadership teams
can prepare technical evidence or written summaries to assist school-led reporting
maintains communication until the risk is mitigated

If a school chooses not to report and a child remains at risk, Cybernetic Shield escalates independently.

8.5 What triggers a child safety escalation

The following always trigger escalation under this policy:

grooming or predatory behaviour
sexualised content involving minors
threats of violence
credible self-harm or suicide risk
coercion, blackmail or extortion
stalking or harassment
severe cyberbullying
disclosures of abuse or major safety risk

8.6 Digital harm severity levels

We categorise digital harms to support a consistent response and escalation:

Low-level harms: conflict, low-severity cyberbullying, misunderstandings, non-sexual content issues
Moderate harms: sexting incidents, exposure to harmful content, impersonation, ongoing cyberbullying
High-risk harms: grooming, extortion or sextortion, sexual content involving minors, credible self-harm risk, threats, or predatory behaviour

High-risk harms always trigger immediate escalation under this policy. Ratings can be changed at the discretion of the Chief Risk Officer, the Clinical Lead / Director of Helpline or the Director of Investigations.

9. Digital safety and online interaction rules

We moderate any user-generated content in line with child-safe principles. Harmful or inappropriate material is removed promptly, and reports are escalated according to severity. Content reviews are carried out by trained staff, with urgent matters escalated to the Chief Risk Officer or the Investigations team.

Cybernetic Shield ensures:

no unsafe or inappropriate contact
no use of personal accounts for interaction
safe moderation of any user-generated content
strict protection of student identity
approved communication channels only
no screenshots, images or case details are shared externally

10. Technology safety and ST4S compliance

We meet or exceed ST4S requirements by ensuring:

strong authentication
minimal data collection
clear data flows
Australian hosting for sensitive student data
secure content delivery
no advertising or tracking on child-facing platforms
safe deletion and retention practices

Cybernetic Shield does not use AI to profile children, analyse their behaviour or make automated decisions about them. Any AI-supported tools must meet strict privacy, safety and transparency requirements and must not influence or manipulate children.

All third-party platforms we use (such as our LMS or website membership systems) must meet equivalent child safety, privacy and security standards. Vendors are reviewed annually under our Vendor Management Policy and must uphold the principles in this policy.

11. Working with schools and families

We ensure:

child-friendly explanations of our tools
appropriate consent processes
transparent communication
shared responsibility for escalating safety concerns
support for parents through accessible information

12. Cultural safety

We commit to:

cultural respect and responsiveness
creating safe, inclusive environments for First Nations children
supporting children with disability
LGBTQIA+ inclusivity
accessibility in digital and written content

13. Continuous improvement

We strengthen child safety through:

annual review of policies
audits of digital safety controls
analysis of incidents and disclosures
community and school feedback
updated staff training
learning from new research and regulatory guidance

14. Roles and responsibilities

Role	Responsibilities
Chief Executive Officer	Ensures organisation-wide commitment to child safety
Chief Risk Officer (Child Safety Lead)	Owns this policy; manages escalations and mandatory reporting
Director of Investigations	Manages escalations and mandatory reporting
Clinical Lead / Director of Helpline	Oversees triage, safety plans and trauma-informed practice
Chief Information Security Officer (CISO)	Ensures ST4S, privacy and security compliance in digital environments
System owners	Embed safety in product design and reviews
All staff and volunteers	Follow this policy, uphold child-safe behaviour and report concerns immediately

15. Related documents

Privacy Policy (external)
Privacy Management Policy
Feedback and Complaints Management Policy
Mandatory Reporting and Reportable Conduct Framework
Code of Conduct
Social Media and Public Communications Policy
Information Security Policy
Data Governance and Handling Standard
Vendor Management Policy
Clinical and Technical Governance Framework
Incident Response Plan
Data Breach Response Plan
Workforce Capability and Credentialing Framework

16. Review

This policy is reviewed annually, or sooner if:

legislation changes
a serious incident requires review
better practice emerges
feedback indicates improvements are needed

Appendix A: Mandatory reporting by jurisdiction (summary)

Cybernetic Shield operates across Australia and New Zealand and follows a single, precautionary rule: if there is a reasonable belief that a child is unsafe, we report.

Below is a high-level outline of the key authorities we contact, depending on where the child or incident is located. In an emergency, always call 000 in Australia or 111 in New Zealand.

eSafety Commissioner

We make reports to the eSafety Commissioner for:

illegal or harmful online content
image-based abuse
cyberbullying of Australian children
serious online harms where platforms fail to act

Netsafe (New Zealand)

For children in New Zealand, we report harmful digital communications, image-based abuse and other online harms to Netsafe, New Zealand’s approved agency under the Harmful Digital Communications Act 2015.

Our internal Child Safety Leads determine the correct reporting pathway.

Mandatory reporting requirements by jurisdiction

Jurisdiction	Who must report	What must be reported	Reporting authority and contact
Australian Capital Territory (ACT)	Doctors, nurses, teachers, police, childcare workers and others in prescribed roles	Physical, sexual and emotional abuse, and neglect	Child and Youth Protection Services, ACT Government: 1300 556 729
New South Wales (NSW)	Mandatory reporters include teachers, counsellors, and health and welfare professionals	Physical or sexual abuse, serious psychological harm, or neglect	Department of Communities and Justice: 132 111 (use the ChildStory Mandatory Reporter Guide)
Northern Territory (NT)	Every adult is a mandatory reporter	Any belief on reasonable grounds that a child has suffered, or is likely to suffer, harm or exploitation	Territory Families, NT Child Protection: 1800 700 250
Queensland (QLD)	Teachers, early childhood workers, doctors, registered nurses, police, and certain religious and counselling staff	Sexual or physical abuse, or risk of significant harm	Department of Child Safety: 1800 177 135 (use the Queensland Child Protection Guide)
South Australia (SA)	Broad categories, including educators, healthcare workers, police and clergy	Any reasonable suspicion of physical, sexual or emotional abuse, or neglect	Department for Child Protection: 13 14 78
Tasmania (TAS)	Teachers, childcare, medical, police, psychologists and welfare workers	Physical or sexual abuse, or risk of significant harm	Strong Families, Safe Kids Advice and Referral Line: 1800 000 123
Victoria (VIC)	Teachers, school staff, medical practitioners, nurses, police and early childhood staff	Physical or sexual abuse; emotional abuse and neglect if significant	Department of Families, Fairness and Housing, Child Protection: 1300 664 977
Western Australia (WA)	Teachers, doctors, nurses, midwives and police officers	Sexual abuse, or a reasonable belief of sexual abuse	Department of Communities, Child Protection: 1800 273 889
New Zealand	There is no general mandatory reporting law. Anyone may report under section 15 of the Oranga Tamariki Act 1989, and people who report in good faith are protected from civil, criminal and disciplinary liability. Under this policy, Cybernetic Shield always reports.	A belief that a child or young person has been, or is likely to be, harmed, ill-treated, abused, neglected or deprived	Oranga Tamariki: 0508 326 459 (free, 24/7), or contact@ot.govt.nz. If a child is in immediate danger, New Zealand Police: 111

Contact details are checked as part of each annual review.

Appendix B: Child-safe design standard

Cybernetic Shield designs all digital products, platforms and user experiences in line with Safety by Design, TEP, ST4S and child-safe organisation principles. This standard applies to 3Cs Help, our LMS, student portals, helpline interfaces and any future digital tools.

1. Purpose of the standard

This standard ensures that all Cybernetic Shield digital environments are designed to:

protect children and young people from online harm
avoid manipulation, coercion or dark patterns
make navigation, understanding and help-seeking easy
reduce cognitive load and prioritise safety
support cultural safety, inclusion and accessibility
uphold privacy and data minimisation

2. Child-safe design principles

2.1 No dark patterns

Digital environments must:

avoid pressure tactics (such as timers, or “are you sure you want to leave?” loops)
avoid reward mechanics that encourage risk-taking
avoid infinite scroll, autoplay and other engagement-maximising patterns
present choices in a neutral, unforced way

2.2 Accessible, inclusive and age-appropriate design

Products must:

use plain, developmentally appropriate language
meet WCAG 2.2 AA accessibility guidelines
offer high-contrast text and a simple visual layout
avoid excessive text and complex navigation paths
consider neurodivergent accessibility (reduced overload and predictable structure)
include culturally inclusive examples and visuals

2.3 Safe defaults

All Cybernetic Shield digital experiences must:

default to the safest option for children
require explicit confirmation for unsafe actions
limit optional features until safety is assured
restrict exposure to inappropriate content or contact

2.4 Embedded safety signals

Products must include:

visible, persistent “Get help” or “Contact support” access
clear reporting pathways
warnings before exposure to sensitive content
reassuring wording (for example, “You’re not in trouble” and “You can ask for help anytime”)

2.5 Transparent data practices

Digital experiences must:

clearly state when and why data is collected
use child-friendly privacy explanations
allow children to understand and control their data where possible
never collect data that is not needed for safety or function

2.6 Risk assessment of new features

Before new features are released:

a Child Safety Impact Review must be completed
the Chief Risk Officer and CISO must approve the new functionality
risks, mitigations and privacy impacts must be documented
testing must include a child-safe user experience evaluation

2.7 No advertising, tracking or behavioural profiling

Cybernetic Shield’s child-facing digital platforms must not include:

advertising
behavioural profiling
third-party behavioural trackers
influencer-style persuasive design

3Cs Help and all student platforms must remain free from commercial influence.

3. Responsibilities

Chief Executive Officer: ensures child-safe digital design is embedded across all products
Chief Risk Officer (Child Safety Lead): conducts child safety impact reviews
CISO: ensures ST4S-aligned technical controls
Product owners: build child-safe design into development
Design and user experience teams: ensure accessible, age-appropriate design
All staff: report any digital safety concerns

4. Continuous improvement

Cybernetic Shield will:

review digital safety measures annually
update content and features based on student feedback
incorporate learnings from digital safety incidents
monitor emerging online risks and design best practice