Summary
The Yoorrook Justice Commission needed a secure operating environment that could be established quickly, protect highly sensitive information and scale with changing workloads. Delivered in partnership with Kapish through a broader Commission as a Service engagement, Citadel Edge provided the cyber security capability, including a secure Azure platform aligned to the ASD PROTECTED classification, identity and device controls aligned to Essential Eight Maturity Level 2, 24/7 security monitoring and incident response, supported by virtual Chief Information Security Officer (vCISO) leadership.
The challenge
Yoorrook was established as Victoria’s first formal truth-telling process into historical and ongoing injustices experienced by First Peoples. The Commission managed significant volumes of sensitive information and evidence. It also needed to establish its operating environment within weeks, initially from temporary accommodation before transitioning to its permanent premises.
As the Commission grew and managed increasing volumes of sensitive information, it required a secure technology environment that could be rapidly established and effectively governed.
Key requirements included:
- Establish a secure, scalable environment without delaying the Commission’s work.
- Protect sensitive information through appropriately managed security controls.
- Maintain visibility of cyber risks and respond to security anomalies.
- Provide strategic cyber leadership without requiring an internal CISO function.
The solution
Citadel Edge and Kapish delivered an integrated Commission as a Service model through a single coordinated engagement. Kapish managed the broader service, while Citadel Edge focused on the secure platform and cyber security services.
To support the Commission’s security, governance and operational requirements, Citadel Edge delivered:
- A secure Azure cloud environment aligned to the ASD PROTECTED classification.
- Entra ID identity management and end-user device policies aligned to Essential Eight Maturity Level 2.
- Logical segregation between the corporate environment and the protected Azure landing zone.
- Security architecture validation of the protected and corporate security boundary.
- 24/7 security monitoring and alerting, with incident response for security anomalies.
- A virtual Chief Information Security Officer (vCISO) service providing strategic guidance, governance support, cyber risk management and a prioritised security roadmap throughout the Commission’s lifecycle.
Ongoing monitoring, alerting and incident response complemented the governance function, providing operational visibility and supporting the Commission’s security posture.
Outcome and impact
The cyber security solution delivered:
- A protected cloud platform with clear separation between corporate and protected environments.
- Identity and device controls aligned to Essential Eight Maturity Level 2.
- Continuous monitoring and alerting, with response to security anomalies.
- Improved visibility of the security environment and control posture.
- Structured cyber governance and a prioritised roadmap through the vCISO service.
At the conclusion of the Commission, services were transitioned out and information was transferred in line with Yoorrook’s closure requirements. The engagement demonstrated the value of combining secure platform services, cyber governance and strategic security leadership to support the management of sensitive information.
