The organisation
A not-for-profit delivering disability support services. About ninety staff, a lot of them part-time and in the field, holding participant records that are about as sensitive as records get.
Their major funding body sent a security questionnaire. Sixty-eight questions, two-week deadline, and a line at the bottom noting that funding decisions took the response into account.
The first pass
The operations manager filled in what she could and then rang us, because roughly forty of the sixty-eight answers were some version of “I believe so” and she was not willing to sign her name to a document full of beliefs.
That instinct was the right one. A questionnaire is a representation. Answering “yes” to something you have not verified is not optimism, it is a statement you may later have to defend.
What we found in week one
We assessed against the Essential Eight and against what the questionnaire actually asked for, which overlapped but were not the same document.
The picture was better than she feared and worse than the questionnaire wanted. Multi-factor authentication was on and had been for a year. Backups ran, and had never once been restored from as a test. Policies existed, downloaded from a template site in 2023, referring to a “server room” the organisation had not had since it moved to the cloud.
The genuinely uncomfortable finding was administrative access. Eleven accounts had administrative rights in the tenant. Four belonged to people who had left. One belonged to an IT contractor whose engagement ended in 2024.
The access risk, handled that afternoon
Administrative access held by people who have left is not a governance question to schedule. It is an open door. The same afternoon we found them, the operations manager confirmed that none of the five were still needed, and all five accounts were disabled, their sessions revoked and their credentials reset. Nothing was deleted, so the audit trail stayed intact, and the sign-in history for each account was checked for any use after the person left.
The part that was not about technology
Disabling the accounts fixed that day. It did not explain how they had been missed. Nobody could tell us who was supposed to approve administrative access, or how anyone would have known those accounts should have been removed, and the questionnaire was not really asking whether the accounts were closed. It was asking whether the organisation was the sort of organisation where that could happen unnoticed.
So the governance work ran alongside the fix rather than in front of it. In week two a one-page access policy was written naming who approves, who reviews and how often. One page. Their previous access policy was fourteen pages and no one had read it.
The tabletop
In week six we ran a scenario in a room with the executive team: a participant’s records appear in an email sent to the wrong recipient.
The plan they had said the “IT Manager” would assess whether it was notifiable. They do not have an IT Manager. They have an operations manager who also runs the vehicle fleet.
That is the sort of thing that only ever surfaces when you test a plan, and it is why we test them. Every incident response plan we read has at least one role in it that does not exist, or one decision assigned to someone with no authority to make it.
The plan got rewritten with real names. It also got a decision tree for the notifiable breach assessment, because the thirty days the Privacy Act allows sounds generous right up until you spend eleven of them working out who decides.
Six weeks later
The questionnaire was answered in about forty minutes, from an evidence register with one row per control, each pointing at a dated artefact.
Two answers were still “no”. A “no” with a documented remediation date is a perfectly respectable answer, and it is considerably better than a “yes” you cannot evidence. The funding body’s follow-up asked about one of them and accepted the plan.
The point of the story
The work was not really about passing a questionnaire. The questionnaire was the thing that made the organisation look, and what it found was five administrative accounts belonging to people who had gone, in a system holding disability participant records. Those were disabled the day they were found. The policy that stops it happening again took longer, and that is the right order.
The evidence register is the deliverable people underrate. It is not exciting. It is the reason the next questionnaire, and there is always a next questionnaire, is a forwarding job.
The details above are a composite and the identifying details are changed. The evidence checklist is the artefact-by-artefact version of what that register holds, and the GRC page walks through how an engagement runs.
