How leaders regained control of data risks
8
8 sensitive data categories defined and governed
14
14 Purview solutions assessed and baselined
780
780 SharePoint sites brought under sensitivity governance
At a glance
Client
Not-for-profit organization
Industry
Not-for-profit
Our role
Assess and fortify data protection
Our solution
Scalable security and capabilities
A clear and comprehensive solution
Scenario
An organization needed centralized cybersecurity to reduce data exposure and build executive confidence.
Approach
Grant Thornton helped find vulnerabilities and address comprehensive needs proactively.
Result
The organization has a scalable security model that meets the CEO’s mandate and even provides a platform for AI implementation.
Scenario
Data exposure demands executive attention
When organizations have disconnected cybersecurity solutions, critical gaps can emerge. A large not-for-profit organization had a lean staff managing multiple cybersecurity solutions, making it difficult to gather a unified view of security risks. Ultimately, a security analysis revealed that the solutions were leaving some of the organization’s data exposed. Executives were made aware, and the CEO mandated remediation.
Further analysis showed that the issues were complex and interwoven. The organization could not replace its entire cybersecurity infrastructure, so it needed to meet these complex issues with targeted solutions.
As executive concerns grew, leaders sought a practical approach to gain risk visibility, reduce exposure, protect sensitive data and shift the organization’s focus back to core mission delivery.
Approach
Prioritized protection
To clarify the best approach, a Grant Thornton team helped the organization zero in on its sensitive data exposure. The team refined data detection methods and targeted the investigation’s scope, while also uncovering vulnerabilities that were not fully visible before. With a more accurate view of data exposure, the challenge that seemed overwhelming became a more defined and manageable path forward.
The team then performed a Microsoft Purview maturity assessment, baselining all 14 Purview solutions, scoring them against a maturity model and mapping the gap between perceived and actual security posture.
Next, the team addressed the priority exposures through a structured remediation effort. This effort defined eight sensitive data categories and thresholds, developed a wave-based remediation backlog, refined auto-labeling capabilities and deployed site-level sensitivity labels. Retention frameworks were informed by prioritized remediation recommendations and exposure findings.
The existing technology environment included legacy elements that were not identified at the outset of the engagement, so the team developed tailored solutions and workarounds to avoid disrupting users.
Result
From exposure to protection
Now, the organization has a phased approach for a scalable, repeatable security model. Implementation started with finance and is extending across the enterprise to meet the mandate from the CEO.
With greater visibility into sensitive data, the organization can apply more consistent controls and stronger guardrails around data exposure. Automated detection and enforcement capabilities have replaced manual file-by-file reviews. Runbooks, guidance, training and operational support have helped build the internal capabilities needed to sustain progress over time.
What began as a response to significant data exposure has evolved into a clearer view of cybersecurity risks and the actions required. The organization has a scalable solution to protect sensitive data so that it can refocus on core mission delivery.
A better foundation for AI
This data security work also provides a stronger foundation for AI initiatives. To govern and secure AI solutions, organizations must understand the data that these solutions can access, use and share. With clearer visibility and better controls for enterprise data, the organization is positioned to successfully evaluate and adopt technologies such as Microsoft Copilot and other AI solutions.
Many of the same capabilities that protect sensitive information today will become even more essential to support future innovation. Effective data protection gives leaders greater confidence as the organization pursues new technology initiatives and emerging AI capabilities.
Connect with our team
Partner, Cyber & Privacy Advisory Services
Grant Thornton Advisors LLC
John is a Partner with Grant Thornton Cyber Risk Advisory Services. John has twenty (20) years of professional experience conducting number of large scale engagements in the following areas: security program strategy and implementation, security operations capability maturity and development, advanced intrusion analysis and cyber remediation.
Arlington, Virginia
Industries
- Insurance
- Technology
- Transportation & Distribution
- Banking
Service Experience
- Advisory Services
Content disclaimer
This Grant Thornton Advisors LLC content provides information and comments on current issues and developments. It is not a comprehensive analysis of the subject matter covered. It is not, and should not be construed as, accounting, legal, tax, or professional advice provided by Grant Thornton Advisors LLC. All relevant facts and circumstances, including the pertinent authoritative literature, need to be considered to arrive at conclusions that comply with matters addressed in this content.
Grant Thornton Advisors LLC and its subsidiary entities are not licensed CPA firms.
For additional information on topics covered in this content, contact a Grant Thornton Advisors LLC professional.
Ready to talk? We’re ready to listen.
Request a meeting and a member of our team will be in touch to see what we can do to meet your needs.
Want to submit an RFP? Please submit your request through our RFP submission page.
Trending topics
Follow us
