Case Study: Defining Data Protection Standards for Sensitive Client Information

Executive Summary

Many small and mid-sized organizations invest in securing user accounts and access, but never define standards for the data itself. They can say who has a login, but not where their most sensitive information lives, who can reach it, or how long it should be kept.

This case study describes how Secure Strategic Technologies (SST) helped a professional services firm move from an undefined, keep-everything approach to a documented data protection standard grounded in the CIS Critical Security Controls (v8.1), Control 3. The result was a smaller, better understood, and more defensible data footprint.

Customer Overview

Industry: Professional Services (Accounting and Advisory)

Location: Upper Midwest

Size: 35 Employees

Challenge

The firm handled highly sensitive client information every day, including tax returns, payroll records, bank statements, and Social Security numbers. Its user accounts were reasonably well managed, and leadership believed that controlling who could log in meant client data was protected.

In practice, the firm had no defined standard for its data. Over the years, several issues had developed:

• Sensitive client files were spread across a file server, SharePoint, email attachments, personal OneDrive folders, and local desktops
• Shared folders had grown broad permissions over time, giving most staff access to most client records regardless of role
• Nothing was ever deleted. Records from clients who had left the firm years earlier were still stored alongside current work
• Encryption was applied to some laptops but not others, depending on when and how each device was set up

When the firm’s cyber insurance renewal and several client security questionnaires asked where sensitive data was stored and how it was protected, leadership found they could not answer with confidence.

Key Risks Identified

Through SST’s discovery process, several risks were identified and translated into business terms for leadership.

• Unknown Data Footprint – Without an inventory, the firm could not protect, monitor, or account for sensitive data it did not know it had. In a breach, it would struggle to determine what was exposed and which clients needed to be notified.
• Over-Shared Access – Broad folder permissions meant a single compromised account could reach far more client data than that employee ever needed. Account security alone could not limit the damage once someone was inside.
• Indefinite Retention – Keeping everything “just in case” felt safe, but every unnecessary record was additional liability. Data from former clients carried the same breach and notification exposure as current work, with none of the business value.
• Inconsistent Device Protection – An unencrypted laptop that is lost or stolen can turn a hardware loss into a reportable data breach. Inconsistent encryption left the firm exposed depending on which device went missing.
• Regulatory and Insurance Exposure – Tax and accounting firms are subject to the FTC Safeguards Rule and IRS expectations for a written information security plan. Without defined data standards, the firm had difficulty demonstrating due diligence to regulators, insurers, and clients.

SST Approach

SST worked with leadership to establish a documented data protection standard, grounded in CIS Control 3 rather than an internally invented set of rules. The goal was to keep the standard simple enough for staff to follow and clear enough for leadership to verify.

• Data Inventory – SST identified where sensitive client information actually lived across servers, cloud storage, email, and endpoints, giving the firm its first complete picture of its data footprint. This supports CIS Safeguard 3.2, Establish and Maintain a Data Inventory.
• A Simple Classification Standard – SST helped the firm define three data categories, Public, Internal, and Confidential, with plain-language handling rules for each. Staff could quickly understand that client tax and financial records were Confidential and what that meant for storing and sharing them. This supports CIS Safeguard 3.7, Establish and Maintain a Data Classification Scheme.
• Access Aligned to Classification – Folder permissions were reviewed and restructured so Confidential data was available only to the roles that needed it. This built directly on the firm’s existing account standards: accounts define who someone is, and data standards define what they can reach. This supports CIS Safeguard 3.3, Configure Data Access Control Lists.
• Retention and Secure Disposal – SST worked with leadership to define how long each type of record should be kept, based on business and regulatory requirements, and how it should be securely disposed of afterward. This supports CIS Safeguards 3.4 and 3.5, covering data retention and secure disposal.
• Device Encryption Standard – Encryption was applied consistently to all laptops and workstations holding firm data, so a lost device would no longer mean exposed client information. This supports CIS Safeguard 3.6, Encrypt Data on End-User Devices.

Results

By defining standards for its data, not just its accounts, the firm achieved meaningful improvements in its security posture and its ability to demonstrate it.

• A clear, documented map of where Confidential client data resides
• Access to Confidential data limited to the roles that require it, reducing the impact of any single compromised account
• A smaller data footprint as outdated records were securely disposed of under the new retention rules, reducing breach exposure
• Consistent encryption across all end-user devices
• Faster, more confident answers on cyber insurance applications and client security questionnaires

Key Takeaways

Securing accounts controls who gets in. It does not control what they can reach once inside, or how much there is to lose. A data protection standard closes that gap.

Keeping everything is not a safety net. Every record retained beyond its useful life adds risk without adding value, and the safest data is the data an organization no longer holds.

A practical data protection standard gives organizations:

• A clear understanding of what sensitive data exists and where it lives
• Access that matches business need rather than historical convenience
• Defined rules for how long data is kept and how it is disposed of
• A standard that maps to a recognized framework (CIS Critical Security Controls), which supports due diligence with insurers, regulators, and clients

How SST Helps

Secure Strategic Technologies partners with organizations to define, document, and implement data protection standards that reduce exposure and build on strong account and access practices. Through structured discovery and ongoing advisory support, SST helps customers transition from an undefined, keep-everything approach to a documented, CIS Controls-aligned standard, establishing a clear view of what data they hold, what they need, and how it is protected.