South East Water provides water, sewerage and recycled water services to 1.8 million Victorians living and working from Port Melbourne to Portsea and about 30 kilometres east of Pakenham. Its operations feature 27,400 kilometres of pipeline, 82 water pump stations, 275 sewerage pump stations, 11 recycled water pump stations, eight water recycling plants, and AU$5.2 billion in infrastructure and assets. Optimising operations is one of the five focus areas in South East Water’s Corporate Strategy 2028. A key part of achieving this is maintaining confidence in the security of its people, data and assets, and South East Water takes a rigorous stance to protect sensitive and private information across the organisation.
The Challenge
Australia has witnessed a surge in cyber security incidents, particularly against critical infrastructure targets, with heightened public discourse leaving citizens concerned about the management of their personal information by companies. The challenging threat environment combined with the increased concerns from the general public make the discovery and full lifecycle management of personally identifiable information (PII) crucial for all organisations, but especially so for critical infrastructure like South East Water. The organisation’s approach reflects the optimal state of risk mitigation, and powers its ability to fulfil compliance obligations.
South East Water is committed to protecting our customers’ personal information. Like other organisations, we’re focused on mitigating risk, and compliantly and securely managing the data entrusted to us by our customers. Castlepoint has helped us ensure we understand the sensitive information we store, and we now have granular visibility into what data we hold, where it lives, and when it must be destroyed.
Kim Murray, Interim Finance and Technology General Manager, South East Water
The Solution
As part of its cyber strategy, South East Water leveraged Castlepoint’s explainable artificial intelligence (XAI) platform for proactive PII discovery across multiple structured and unstructured systems, including Network Drives (NTFS), Microsoft 365 (SharePoint, Exchange, Teams and OneDrive), Salesforce, HiAffinity, PEGA, and LiveLink. This was done in a manage-in-place model, without moving, duplicating, or modifying the content, and without modification or disruption of the source systems. The Castlepoint system identified PII and other sensitive data, and automatically calculated the legal retention periods of the records using Explainable AI.
The Outcome
South East Water completed the project in three months, giving it a comprehensive view over the documents, records and archives in its information stores, showing precisely where specific PII is located. South East Water is now in a position to ensure this data is protected effectively, and, importantly, to compliantly dispose of sensitive and client information where it is no longer required to be retained under law.
“South East Water is committed to protecting our customers’ personal information. Like other organisations, we’re focused on mitigating risk, and compliantly and securely managing the data entrusted to us by our customers. Castlepoint has helped us ensure we understand the sensitive information we store, and we now have granular visibility into what data we hold, where it lives, and when it must be destroyed.” Kim Murray, Interim Finance and Technology General Manager, South East Water
“The Australian Signals Directorate (ASD) has warned critical infrastructure is a prime target for both opportunistic and targeted cyber-attacks. Cyber criminals are targeting sensitive information, including ‘dark data’ that may be hidden in pockets across the data estate. South East Water now has a comprehensive map of where risky information is being managed, is providing the opportunity to either protect or dispose of information that no longer needs to be kept, and therefore significantly reducing privacy risk.” Rachael Greaves, CEO, Castlepoint Systems