Hidden Vulnerabilities: Cyber Security and Essential Community Services in NSW

This report, developed by WorkVentures and commissioned by the NSW Council of Social Service (NCOSS), examines cyber security across 14 not-for-profit organisations in the NSW community services sector. It was funded through the NSW State Peaks Program and the Australian Government Department of Industry, Science and Resources.

Each organisation was scored across four areas: operational practices, legal and regulatory compliance, systems, and network controls. None reached the benchmark for a mature cyber security posture, with an average score of 57 out of 100. The report points to common gaps, including weak password habits, low uptake of staff training, and a heavy reliance on cyber insurance and IT providers rather than active prevention. Smaller, lower-revenue organisations tended to score worse.

It highlights the real risks facing services that hold sensitive data, such as domestic violence and disability support, and recommends targeted government funding, a tailored cyber assessment and uplift program, and a national cyber security standard built for the sector. It's most useful for NFP leaders, board members and funders looking to strengthen digital security across community services.