Why digital resilience is becoming critical in aged care

It can sit within a chain of activities that helps staff understand a resident’s needs, coordinate services, communicate with colleagues and families, or access vital information required to deliver the appropriate care. When these systems become unavailable, the impact can move quickly from the server room to the care environment. This is why digital resilience needs to become a core operational priority for aged care providers.

Cybersecurity remains essential; however, resilience asks a broader question: can the organisation continue to deliver critical services when technology is disrupted, compromised or simply unavailable? This is also reflected in the Aged Care Quality Standards, which place responsibility on the governing body for meeting the requirements and overseeing how the organisation manages information security and responds to cyber incidents.2 Managing cyber risk is not just a matter of good practice. Instead, it forms part of the governance responsibilities that support safe, quality care.

The broader view of resilience matters because disruption does not have to begin with a sophisticated cyber attack. A software failure, cloud outage, configuration error, compromised supplier, lost credentials or network problem can interrupt access to systems. The Australian Government’s digital reform agenda also means providers are increasingly dependent on digital interfaces and systems to support service delivery, reporting, provider operations and payments.3 As aged care becomes more dependent on digital systems, resilience becomes inseparable from care continuity.

Visibility must come before resilience The first challenge is knowing what the organisation depends on. Many providers have accumulated technology over time: clinical and care applications, workforce systems, mobile devices, building systems, connected sensors, cloud services, third-party platforms and legacy infrastructure. These systems may be managed by different teams or suppliers, making it difficult to build a complete picture of the environment.

Without visibility, organisations can underestimate dependencies. A seemingly minor service may support authentication for a critical application. A third-party connection may provide access to information used during a shift handover.

A network segment that appears non-critical may carry traffic for systems used across multiple facilities. Providers should therefore map their critical services to the technology, data, identities, suppliers and network connections that support them. The objective is not to create an inventory for its own sake; it is to understand which technology failures could affect care, how quickly that impact would be felt and what alternatives exist.

This approach is consistent with the government’s aged care digital strategy, which identifies improved security and access control, secure information sharing, and stronger data and digital maturity as sector priorities.1 It also creates a more useful basis for investment because leaders can prioritise systems according to operational importance rather than treating every asset as equally critical. Governance needs to keep pace with adoption The second challenge is governance. Digital adoption can move faster than the policies used to manage it, particularly as employees experiment with AI tools and teams adopt cloud services to solve immediate operational problems.

Technology that improves productivity can still introduce risk if organisations do not know what data enters a system, where that information is stored, who can access it or how the service is supported. AI makes this especially important, and the government’s aged care digital program includes work to investigate and trial AI and other emerging technologies to improve efficiency and care.4 These initiatives point to the potential value of AI; however, providers still need clear boundaries for its use. Sensitive resident information should not be moved into unapproved tools simply because those tools are convenient.

Governance should define acceptable use, data handling requirements, access controls, accountability and approval processes, while also covering third parties. A provider can have strong internal controls and still face disruption through a supplier that supports a critical service. Contracts and risk assessments should address security responsibilities, incident notification, recovery expectations, data access and exit arrangements.

Segmentation can limit the impact of disruption As environments become more connected, providers need to consider how far a problem can travel. Flat or poorly separated networks can result in a compromised account, device or system exposing services well beyond the original point of entry. Segmentation helps reduce this risk by separating systems according to their function, sensitivity and operational importance.

Access should be limited to what people and systems genuinely need. For example, critical care systems should not automatically share the same trust relationships as guest networks, general office devices or connected building technologies. The same principle applies to identity.

Strong authentication, controlled privileges, timely removal of unnecessary access and regular review of administrative accounts reduce the chance that one compromised identity becomes a wider operational event. The Australian Signals Directorate’s Essential Eight provides a practical baseline for measures including multi-factor authentication, patching, restricting administrative privileges and regular backups.5 Recovery must be designed around care Prevention will never remove every risk, so providers need to plan for the moment when a system is unavailable. Traditional disaster recovery exercises can focus heavily on restoring infrastructure.

However, in aged care the more important question is how care continues while restoration is under way. This means identifying minimum service requirements and workable manual alternatives before an incident occurs. Staff need to know how to access essential information, communicate, escalate decisions and maintain safe operations if normal digital workflows are interrupted.

Backup arrangements must also be tested rather than assumed to work. Australian Signals Directorate guidance recommends maintaining secure and resilient backups and regularly testing restoration procedures to confirm recovery objectives can be achieved.6 Exercises should involve operational and care leaders, not only IT teams. A realistic scenario may reveal that the technical recovery plan is sound; however, staff do not know who has authority to switch to manual processes, how residents and families will be informed or which services must be restored first.

These are governance and operational questions as much as technology questions. Older Australians, their families and aged care workers increasingly rely on digital systems to support connected, coordinated services. As providers adopt technologies that support better care and reduce administrative demands, they must also consider the dependencies these systems create.

Managing these dependencies effectively is critical to maintaining trust and keeping essential services available when disruption occurs. Providers that treat resilience as part of care delivery, rather than a separate cybersecurity exercise, will be better placed to manage disruption. The priority is clear: know what matters, understand what it depends on, limit how far failures can spread and practice how the organisation will continue operating when technology does not behave as expected.

In digital aged care systems, resilience is not measured only by whether an attack can be stopped. It is measured by whether people can continue to receive the care they need when disruption occurs. *Cornelius Mare is Chief Information Security Officer, Australia at Fortinet. 1.

Australian Government Department of Health and Aged Care. About the Aged Care Data and Digital Strategy. Australian Government Department of Health and Aged Care.

Accessed October 12, 2026. https://www.health.gov.au/our-work/aged-care-data-and-digital-strategy/about-the-aged-care-data-and-digital-strategy 2. Aged Care Quality and Safety Commission. Strengthened Aged Care Quality Standards.

Aged Care Quality and Safety Commission. Accessed October 12, 2026. https://www.agedcarequality.gov.au/providers/quality-standards/strengthened-aged-care-quality-standards 3. Australian Government Department of Health and Aged Care.

Aged Care Digital Reform. Australian Government Department of Health and Aged Care. Accessed October 12, 2026. https://www.health.gov.au/our-work/aged-care-reforms/aged-care-digital-reform 4.

Australian Government Department of Health and Aged Care. Aged Care Data and Digital Strategy. Australian Government Department of Health and Aged Care.

Accessed October 12, 2026. https://www.health.gov.au/our-work/aged-care-data-and-digital-strategy 5. Australian Cyber Security Centre. Essential Eight Maturity Model and ISM Mapping.

Australian Government Department of Defence; October 2024. Accessed October 12, 2026. https://www.cyber.gov.au/sites/default/files/2024-10/PROTECT%20-%20Essential%20Eight%20Maturity%20Model%20and%20ISM%20Mapping%20%28October%202024%29.pdf 6. Australian Cyber Security Centre.

Mitigations for Network Defence. Australian Government Department of Defence; October 15, 2025.