System Security & Cybersecurity

ACSC Essential Eight-aligned. Controlled environments. No persistent data exposure.

Sapheos operates its systems as controlled academic infrastructure, designed to minimise exposure, reduce attack surface, and ensure operational integrity.

Security is not managed at the interface level. It is embedded in how data is processed, how systems are isolated, and how outputs are generated and delivered.

This is especially relevant in high-stakes evaluation workflows, where disruption, leakage, or loss of control would affect dissertation, capstone, and internship-based decisions.

Applied Security Principles

• Controlled execution environments
  All processing occurs in secured, access-controlled environments designed for institutional workloads. Execution contexts are isolated and monitored.
• No persistent data exposure
  Academic content is processed within a limited operational window. No persistent databases of student work are maintained.
• Secure transmission and delivery
  Outputs are transmitted through secure channels aligned with institutional IT protocols.
• Infrastructure-level security controls
  Security is implemented at system architecture level (access control, isolation, monitoring).

Cybersecurity Skills and Culture

Security is not only technical.

Sapheos integrates cybersecurity governance into its operations, including:

• dedicated security oversight (CISO-level),
• regular security audits,
• continuous monitoring of system activity.

Security decisions are documented and aligned with institutional requirements.

Alignment with Australian Frameworks

Our approach is consistent with established cybersecurity practices in Australian higher education, including the ACSC Essential Eight and the operational expectations associated with TEQSA HESF Domain 7.