The most damaging data breaches rarely begin with a genius hacker. They begin with an unpatched system, a reused password or a file sent to the wrong person. IBM’s 2024 Cost of a Data Breach report put the global average cost of a breach at USD 4.88 million, and Verizon’s 2024 Data Breach Investigations Report attributed 68 percent of breaches to a human element. In Australia, the 2022 Medibank incident, which affected roughly 9.7 million current and former customers, showed that even large, well-resourced organisations can be caught out. If you run, manage or advise a business of any size, this article is for you. It sets out a practical, prioritised programme: know your data, control access, protect the technology, train people, and use a secure data room when sensitive files must leave the building.
Start by Understanding What You Hold
You cannot protect what you cannot see. Many businesses discover during an incident that they hold far more personal and commercial information than they realised, in far more places.
Build a Data Inventory
Create a simple register listing the main categories of information, where each is stored, who can access it and how long it is kept. Typical entries include customer records, employee files, financial statements, contracts, intellectual property and supplier details. Include “shadow” locations such as personal drives and messaging apps. IBM’s 2024 research found that around a third of breaches involved shadow data, information held outside managed systems.
Classify by Sensitivity
Group information into four tiers: public, internal, confidential and restricted. Apply the strongest controls to the last two. Classification keeps security spending proportionate and gives staff a simple rule for what may be shared and how.
Control Who Can Access What
Most breaches exploit access that was broader than necessary.
-
Apply least privilege. Give each person the minimum access needed for their role.
-
Require multi-factor authentication (MFA). Enable it on email, cloud services, finance systems and remote access first.
-
Use a password manager. Unique, long passwords reduce the damage when one service is compromised.
-
Review access quarterly. Remove permissions that are no longer needed, especially after role changes.
-
Close accounts on departure. Disable access on the employee’s last day, including shared logins and personal cloud links.
Managing Third-Party Access
Suppliers, consultants and advisers often hold more of your data than staff realise. Verizon’s 2024 report found that third-party involvement in breaches had doubled in a year to 15 percent. Include security terms in every contract: encryption standards, breach notification within a defined period, restrictions on subcontracting and return-or-delete obligations when the work ends.
Secure the Technology Foundation
Technical hygiene is unglamorous but effective. Focus on the basics before buying advanced tools.
-
Patch promptly. Apply security updates to operating systems, applications and network devices, prioritising internet-facing systems.
-
Encrypt data. Use encryption at rest and in transit, and enable full-disk encryption on laptops and phones.
-
Back up and test restores. Keep backups offline or immutable so ransomware cannot encrypt them, and test recovery at least twice a year.
-
Protect endpoints. Deploy reputable endpoint protection and manage mobile devices.
-
Segment networks. Keep sensitive systems separate from general office and guest networks.
-
Log and monitor. Collect logs from key systems and review alerts. Without logs, you cannot tell what was accessed after an incident.
The Australian Signals Directorate’s Essential Eight, a set of baseline mitigation strategies, offers a well-regarded roadmap. Even if you are not required to follow it, the framework gives smaller businesses a practical checklist covering patching, application control, MFA and backups.
Train People and Build a Security Culture
Technology fails when people are unprepared. With human factors involved in most breaches, awareness training is among the highest-return investments you can make.
What Good Training Looks Like
Keep sessions short, frequent and practical. Cover phishing recognition, safe file sharing, handling of personal information and how to report a mistake quickly. Run simulated phishing exercises and use the results to coach rather than punish. A culture where people report errors early limits damage far more than one where they hide them.
Make Secure Behaviour the Easy Option
If the approved tool is slower than a personal alternative, staff will use the alternative. Provide fast, approved ways to share, store and collaborate, and explain why they exist.
Secure Sharing of Highly Sensitive Documents Through a Data Room
Some information must leave the company: financial statements for lenders, contracts for auditors, due diligence files for investors or buyers. Email attachments and consumer links offer little control once a file is sent. A data room is a purpose-built environment for this situation, where documents stay on a protected platform and recipients view them under rules you set.
Useful capabilities include:
-
Permissions by user, group, folder and document
-
View-only access with printing and downloading disabled
-
Dynamic watermarks showing each viewer’s identity
-
Detailed activity logs for every view and download
-
Instant revocation and automatic expiry of access
For transactions, audits, fundraising and regulatory submissions, a data room gives you both protection and evidence of how information was handled.
Protect Data at the Physical and Remote-Work Edges
Security also depends on the environments where people work. Lock laptops and phones with strong screen locks, enable remote wipe, and prohibit sensitive work on shared or public computers. For remote and hybrid staff, require a managed device or secure remote-access tool, and remind people that home routers need updated firmware and non-default passwords. In the office, keep server rooms and network equipment in locked spaces, shred paper records containing personal information and enforce a clear-desk habit for confidential documents. These measures are inexpensive, and they close gaps that sophisticated software cannot.
Meet Your Legal Obligations
Australian organisations covered by the Privacy Act 1988 must take reasonable steps to protect personal information under the Australian Privacy Principles. The Notifiable Data Breaches scheme requires organisations to notify the Office of the Australian Information Commissioner and affected individuals when an eligible data breach is likely to cause serious harm. Regulated financial entities also face APRA’s CPS 234, and some contracts impose additional duties. Document your controls, because “reasonable steps” are easier to demonstrate when you can show policies, training records and logs.
Prepare for the Day Something Goes Wrong
No programme eliminates risk, so plan the response.
-
Name an incident lead and a backup, with contact details available offline.
-
Write a short response plan covering containment, investigation, legal advice, communications and notification decisions.
-
Know your evidence sources: logs, backups and access records.
-
Prepare templates for customer, regulator and staff communications.
-
Run a tabletop exercise annually, walking through a realistic scenario such as ransomware or a lost laptop.
-
Review after every incident, even minor ones, and record what changed.
Measure Progress
Choose a handful of indicators and review them quarterly: percentage of users with MFA, time to patch critical vulnerabilities, number of accounts with unreviewed access, phishing simulation reporting rate and backup restore success. Report the results to leadership in plain language. Measuring turns security from a vague worry into a managed business risk, and it helps justify future investment.
A 90-Day Starter Plan
If you are unsure where to begin, sequence the work:
-
Days 1–30: Build the data inventory, enable MFA on critical systems and verify that backups restore.
-
Days 31–60: Review access rights, patch backlog systems and run first training session.
-
Days 61–90: Review key supplier contracts, adopt a secure sharing platform for confidential files and run an incident tabletop.
Small, steady gains outperform one dramatic project that stalls.
Conclusion
Reducing information risk is a matter of disciplined basics: know what you hold, limit who can reach it, keep systems patched and backed up, train people, secure external sharing and rehearse your response. Each step is modest, yet together they address the failures behind most breaches. Begin with your data inventory and MFA this month, and move sensitive transaction material into a controlled data room as soon as outsiders need to see it. The cost of preparation is small next to the cost of explaining a preventable incident.