Skip to content

Case study · Data security

A data security program plan for a gold miner

Strong cyber maturity, but data governance had been a second priority. We assessed it against NIST CSF and delivered a two-year program to bring it into line.

Industry
Mining
Starting point
NIST CSF average 3.4
Delivered
Two-year roadmap, five change states
Framework
NIST CSF, Essential Eight

The challenge

Data governance had to catch up

After several years of cyber work against NIST CSF and the Essential Eight, the business averaged 3.4 across all CSF domains. Data governance had stayed a secondary focus.

A new Head of Data, AI and Analytics started a narrow but deep effort in business intelligence. It showed the need for a broader plan covering software auditing, data flow mapping, classification, retention and data loss prevention.

Our approach

Four controls, one program of works

The analysis of current data governance practice focused on four NIST controls.

ID.AM-2Software auditing
ID.AM-3Data flow mapping
PR.DS-3Formal management of data assets
PR.DS-5Data loss prevention

How we did it

  1. 1Discovery workshopsWith key stakeholders from the IT and data management teams.
  2. 2Gap analysisCurrent practice compared with NIST CSF maturity levels 3 to 4 for each control.
  3. 3Recommendations for each controlBusiness use cases and benefits, current state observations, steps through maturity levels 1 to 5, and technology to investigate.
  4. 4Red flags, quick wins and a program of worksPhased, practical and ready to act on.

The two-year roadmap

  1. 1Plan, commit, do now
  2. 2Discover, map, classifyplus quick wins
  3. 3Design DLPprotect data at rest
  4. 4Protect data in motion
  5. 5Finalise DLP

The results

What the miner has now

A clear path to maturity

A systematic roadmap to higher NIST CSF maturity for data.

Quick wins first

Red flags and low-cost actions to take straight away.

Cyber and data aligned

Positioned to bring data security up to the level of its cyber security.

What we learned

Lessons for other organisations

Cyber maturity isn't data maturity

A strong cyber posture doesn't make data well managed. Each needs its own structured approach.

Narrow and deep, then broad

Targeted work on classification, retention and DLP gave quick impact and a clearer path to scale.

Get everyone in the room

Workshops showed IT, data and business leaders saw data governance differently.

Quick wins build momentum

Low-cost fixes earned buy-in for the wider program.

Strong on cyber, unsure about your data?

A 45-minute governance health check shows where your real exposure sits and what to fix first.

Book a health check

More case studies

Community housingHarnessing Data to Support Growth and Strategic Goals in Community HousingAged careData Mapping and Privacy Impact Analysis for an Aged Care ProviderAll case studiesSee how we've helped other organisations