Information Security and Data Governance

Know what your organisation is holding

A legacy file share can hold identity documents from a completed project, a temporary spreadsheet of bank details or an export from an old system migration. If ownership is unclear and access is too wide, perimeter controls alone will not resolve the information risk.

WyldLynx has worked with government agencies, councils, universities, health services and regulated organisations since 2009. We help you understand what you hold, protect what you need and dispose of information when retention requirements and approvals allow it. WyldLynx is ISO 27001 certified in its own right.

Why information governance matters to security

The consequences of an incident depend partly on the sensitivity and volume of information exposed, the access people have and how long information has been retained. Keeping access and retention under review can reduce avoidable exposure.

Privacy and recordkeeping obligations need to work together. Where Australian Privacy Principle 11 applies, organisations must take reasonable steps to protect personal information. Information no longer needed must be destroyed or de-identified where required, subject to exceptions including Commonwealth records and legal retention requirements. Retention periods, legal holds and authorised disposal need to be assessed together. See the privacy regulator’s security guidance.

Security frameworks need evidence. An information security management system connects information ownership, classification, access controls and review. The requirements that apply depend on your organisation and jurisdiction.

New tools make existing access more consequential. Microsoft 365 Copilot respects existing user permissions and applicable protections. Broad or outdated permissions can still expose information to people who should not have that access. Discovery, access review and appropriate classification support a controlled introduction of new tools; they do not replace product-specific security design and testing.

Make information architecture work in everyday systems

Information architecture is how your information is organised, classified, connected, accessed and governed. It gives people a clearer way to find what they need and helps your team apply ownership, access and retention decisions consistently.

WyldLynx brings experience implementing, integrating and supporting information systems. We work with your records, business and technical teams to turn governance requirements into workable controls: classification and metadata, permissions, capture rules and connections between systems. The design needs to fit both your responsibilities and the way people work.

OpenText Voltage Data Security Platform can support discovery and classification of information across connected repositories, helping identify sensitivity and risk. Those findings inform the wider controls and processes your organisation needs.

Talk to us about your information architecture and security priorities.

1. Find what you hold and who can reach it

Start with the places information actually lives: network file shares, SharePoint and Microsoft 365, email and your records system. Look for personal information, identity documents, financial and health data, credentials and security-classified material. Assess that sensitivity alongside access.

Tools such as OpenText Voltage Data Security Platform can support discovery and analysis across connected repositories. Confirm the connectors, classification capabilities and actions available in your deployment. The aim is a prioritised risk register that your team can act on, rather than an undifferentiated file list.

2. Keep only what you need, for as long as you must

Retention and disposal can reduce avoidable exposure, but a date alone is not permission to delete. Check the applicable retention authority or schedule, continuing business needs, legal holds and disposal approvals.

Defensible disposal needs approved rules and evidence of what was destroyed, when and under whose authority. OpenText Content Manager supports retention and disposal processes with records controls and audit evidence. Discovery findings can help identify information for controlled capture, review or approved disposal. Moving or deleting information should follow the agreed rules and permissions.

3. Govern what you keep

What remains needs classification, access matched to need and a record of relevant actions. Protective markings, security levels, access reviews when people change roles and audit trails all contribute.

Content Manager and Microsoft 365 need to work together through designed and tested controls. Our Content Manager integration work can support that connection. Do not assume a classification or protective marking transfers automatically between products: confirm the mapping, permissions and behaviour for the tools in use.

Keep an information asset register current: what the asset is, who owns it, how sensitive it is, where it lives and how long it should be kept.

4. Show that the controls are working

An information security management system brings the controls, responsibilities and evidence together. Discovery results, disposal logs, access reviews and the asset register help demonstrate how information is governed.

WyldLynx is ISO 27001 certified by Southpac Certifications and runs its own business, including client records, on Content Manager. We bring that practical experience to discussions about your controls and evidence needs. The certification scope and requirements for your organisation remain a separate assessment.

The cost of leaving information unmanaged

Greater exposure: sensitive information retained unnecessarily or shared too widely can increase the impact of an incident.
Slower investigation: unclear ownership and incomplete inventories make it harder to establish what information is affected and meet applicable response obligations.
Weak assurance: reports and attestations need evidence that disposal, access and other controls are operating as intended.
Delayed improvements: unresolved permissions and information-quality problems can hold up new tools and other projects.
Continuing costs: unnecessary volume adds to storage, backup, migration and search effort, including information requests and legal discovery.
Trust: people rely on agencies, health services and other organisations to handle the information entrusted to them responsibly.

How WyldLynx works with you

Assessment. Agree a discovery scope across a representative part of your environment. Identify sensitivity, exposure and retention questions, then build a ranked risk register and plan. Engagement name, duration, repositories and deliverables are agreed before work starts.
Remediation. Address priority exposures through controlled batches: overly broad access, sensitive content in the wrong place and information requiring retention or disposal review. Respect legal holds and log agreed actions.
Governance. Establish retention and disposal processes, classification, an information asset register and access reviews. Confirm how Content Manager and Microsoft 365 controls connect in your environment.
Evidence. Build reporting from the systems and processes so your team can demonstrate what was done and identify what needs attention next.

Privacy impact, breach readiness and artificial intelligence readiness can raise related information questions. Discuss the scope you need with us; we will confirm which services and responsibilities fit the engagement.

Examples from our work

This is an example are from our earliest discovery work, before the platform was called Data Security Platform. They show what we were finding in 2019, and the same patterns turn up in every scan we run today.

Our published Data Security Platform describe historical discovery and remediation work. These are individual examples, rather than promised results for another environment.

Sensitive patterns: 1 per cent of one customer’s unsecured data matched a credit-card-like pattern; relevant information was moved into Content Manager with appropriate security.
Board papers: sensitive board and executive material was identified on an open file system and secured in the relevant repository.
Duplicate data: a customer with 20 terabytes of unstructured data found half was duplicated and estimated a $2.5 million storage saving over five years from de-duplication.
Disposal holds: analytics located records in scope of a government disposal freeze so holds could prevent changes or deletion.

Frequently asked questions

Is information security only the technology team’s responsibility?

Infrastructure security is one part of it. Information ownership, sensitivity, permitted access and retention also need business, records, privacy, risk and security teams to work together.

We already use Microsoft Purview. Do we still need discovery?

Review the repositories, capabilities and licences your deployment covers. Information can also sit in file shares, legacy systems and records systems. A discovery plan should address any gaps and connect sensitivity with access; it should not assume every repository is covered or unsupported by a particular product.

How does this relate to cyber security?

Cyber security and information governance complement each other. Alongside protecting and monitoring systems, assess what information is held, who can reach it and whether it still needs to be retained.

Do we need ISO 27001 certification?

That depends on the obligations, contracts and assurance needs that apply to your organisation. Certification and operating an information security management system are related but separate decisions. Discuss your requirements and the scope of any preparation or improvement work with us.

Will this help us introduce Microsoft 365 Copilot responsibly?

Discovery and access review help identify oversharing and information-quality risks. Confirm permissions, protections, licensing and product behaviour, then test the intended uses. These activities form part of readiness rather than a guarantee that every use is safe.

Where do we start?

Tell us which repositories and information concern you. We can discuss an assessment scope and the evidence needed to prioritise the next steps.

Information security starts with knowing what you hold