Protect what actually matters.
We define what matters in your environment, starting with the data itself. Then we align systems, controls and security decisions to the information that drives your business.
- Starts with
- Department workshops
- Model
- CIA-based, in business terms
- Aligned to
- NIST SP 800-53 or your standards
- You leave with
- Inventory, tiers, controls and policy
What makes it different
A clarity problem before a security problem.
Most organizations don't know what data they have, so they treat everything as critical. We start with the data, not the tools.
Data first
Systems inherit importance.
Importance is set at the data level, and systems and controls follow from what the business values.
Business-led
Operational truth.
We work with each department to learn what data exists, how it's used and where it goes.
Proportionate
Controls that match impact.
Minimum controls per tier, so effort follows real importance instead of maximum everywhere.
The problem
Without governance, decisions get expensive.
Security decisions become inconsistent, costly and hard to justify.
- No view of the dataYou know your systems better than your information.
- Everything is criticalSo nothing gets focus.
- Controls not tied to impactRequirements applied without a link to sensitivity.
- Unclear ownershipNo one accountable for handling and retention.
- Wasted effortLow-risk systems over-secured, critical ones under-secured.
Our process
Six steps, from discovery to policy.
We start with department workshops and finish with practical policies, grounded in how your business really uses data.
- 01
Data discovery
Department workshops on what data exists, where it lives and who it's shared with.
- Data type and volume
- Storage and systems
- Vendor and external sharing
- 02
Mapping and ownership
Systems of record, business owners and how data flows.
- 03
Classification
CIA-based scoring, practical tiers, validated with the people who know the data.
- Confidentiality, integrity and availability rated in business terms
- Availability ratings and recovery objectives feed your BCP and DR plans
- 04
System mapping
Systems inherit classification from the data they hold. Control gaps identified.
- 05
Control alignment
Minimum control sets by tier, mapped to NIST SP 800-53 or your standards.
- 06
Policy and procedures
Storage, transmission, access, retention and accountability, documented.
What is changing
NYDFS now requires MFA everywhere and a formal asset inventory. Sections 500.12 and 500.13 took effect November 1, 2025. See how our data governance process builds the inventory.
Who it's for
The business sets importance. Security matches it.
For business leaders
Know what matters most.
- ClarityWhich data matters, and why.
- Faster prioritiesInvest where it counts.
- DefensibleA clear accountability model.
For technical teams
Clear expectations, less ambiguity.
- Clear standardsWhich controls apply, where.
- Less wasteNo over-engineering low-risk systems.
- AlignmentTechnical work tied to outcomes.
What you get
Data Governance & Classification deliverables.
Concrete artifacts you keep, not a slide deck that disappears after the readout.
- 01
Data inventory
Type, volume, owner, systems and sharing, in one living record.
- 02
Classification framework
CIA scoring and tiers in plain language.
- 03
System classification map
Which systems inherit which tier.
- 04
Minimum control standards
Baseline expectations per tier.
- 05
Governance policy
Ownership, accountability and decision authority.
- 06
Handling procedures
How data is stored, shared and retained.
Runs on one risk language
Scored with your methodology.
Every finding is scored the same way as the rest of your program. Already have a methodology? We use it. If not, we build it with you first, in a single workshop.
How we build a risk methodology →“Security decisions driven by data. Not assumptions.”CyberRisk One
Connected services