Weeks 1–2 · Assess and prioritise
Essential Eight maturity assessment against ML1, asset discovery, identity audit, and a risk register ranked by commercial impact rather than technical severity.
Mining & resources · Client identity withheld
Essential Eight case study: mining tender readiness
This Essential Eight case study follows a 12-week security uplift for an Australian mining services contractor. Compuloop strengthened access, devices and site networks, then built the evidence needed for a tender review.
$68KInvestment
$18MContract progressed
$36.4KRecurring annual saving
<2moPayback
Project technologies and related platforms we support
MicrosoftEntra ID
The starting point
The business challenge
The contractor had grown from a two-crew operation into a $60M contractor in eight years. IT grew reactively with it. When the business tendered for a major expansion project, the client's pre-qualification pack included a 40-question cybersecurity section on identity, patching, backup, incident response and supply chain risk. The contractor could answer perhaps six with confidence.
The submission came back non-compliant on security. Pricing was never opened. For a business whose growth model depended entirely on winning Tier 1 work, this was an existential commercial problem being managed internally as an IT annoyance.
What the assessment found
MFA on 6 of 180 users. Fourteen accounts with tenant-wide admin. One shared local administrator password across four offices and three mine sites. Two Windows Server 2008 R2 hosts still in production. Patch compliance at 34%. No incident response plan, no asset register, default 90-day audit retention.
Why it mattered
Three risks dominated. The shared local admin credential meant one infected site laptop could pivot into estimating, payroll and contract data. Unpatched internet-facing services had been exposed for 18 months — which triggered an emergency change on day three. And most at once damaging, the contractor could not evidence its controls, which is what actually lost the tender. Its security was better than its records. The client bought the records.
Technology in context
Network and identity controls in context
Network security, made visible
A firewall is one part of the wider network design. Segmentation, access rules and ongoing management matter alongside the hardware.
Identity decisions before access
Microsoft Entra Conditional Access evaluates signals and applies access controls. It helps explain the identity controls described in these projects.
Resilience beyond the office
Remote mining operations make secure access and recoverable systems especially important.
A view of endpoint incidents
A Microsoft demonstration screen illustrates security incident triage.
The implementation
How this essential eight case study was delivered
Weeks 3–6 · Identity and email first
Entra ID P1, conditional access, MFA with number matching. Admin roles cut from 14 to 3 with separate privileged accounts. Legacy authentication blocked. DMARC to p=reject with DKIM and SPF corrected.
Weeks 5–9 · Endpoints and patching
Intune enrolment across 180 endpoints, update rings replacing ad-hoc WSUS, 2008 R2 hosts retired by migrating file shares to SharePoint and Azure Files. SentinelOne across all endpoints and site servers.
Weeks 8–11 · Site and network hardening
FortiGate policy review, LAPS, USB control, segmented site networks separating office, day-to-day technology and guest. Managed UniFi Wi-Fi with per-site isolation.
Weeks 10–12 · Evidence and assurance
Incident response runbook, asset register, 12 months of centralised logging, and a 26-page evidence pack mapping each control to the client questionnaire with live setup exports.
Practical obstacles, handled in stages
- MFA on sites with poor mobile coverage. SMS MFA failed repeatedly in the remote sites. We deployed FIDO2 keys for 40 site staff and configured conditional access for defined offline windows.
- Legacy estimating software requiring local admin. Packaged and published through Intune, with an elevation approval workflow for the two staff who genuinely needed it.
- Cultural resistance. Site supervisors saw MFA as head-office overhead. We ran 20-minute toolbox talks on site, in work time, framed around tender eligibility — the thing they already cared about.
Controls that stay in place
The project also established repeatable processes. These controls support ongoing operation after the initial rollout.
- Intune update rings — patching continuous, no monthly manual cycle
- LAPS password rotation on all 180 endpoints
- Conditional access enforced at every sign-in
- FIDO2 key registration and self-service password reset
- Phishing simulation on a rolling schedule with automated reporting
- Evidence pack generated from live setup exports
Prepare for your next security review
Talk through your priorities, current systems and next practical step with Compuloop.
Measured change
Essential Eight case study results
The following before-and-after figures relate to this engagement. The scope and starting position matter when comparing them with another business.
| Measure | Before | After |
|---|---|---|
| MFA coverage | 3% | 100% |
| Accounts with tenant-wide admin | 14 | 3 (privileged) |
| Patch compliance (30-day) | 34% | 96% |
| Unsupported server OS | 2 | 0 |
| Phishing simulation click rate | 31% | 6% |
| Tender cybersecurity section | Non-compliant | Compliant |
Time returned to the team
3h → 25m
New starter onboarding
12h → 1h
Monthly patch admin
-41%
Helpdesk ticket volume
1 day
Tender security response (was a quarter)
The financial picture
Project-specific financial model. Avoided losses and productivity benefits are estimates, not guaranteed cash savings or returns.
| Line item | Value |
|---|---|
| Project investment (12 weeks) | $68,000 |
| Contract value progressed | $18,000,000 |
| Contract margin at 9% (typical Tier 1 civil) | $1,620,000 |
| Avoided cost: deferred Tier 1 panel entry (18 months) | $12M–$20M deferred revenue |
| Annual recurring: patching and onboarding time saved | ~$14,400 / yr |
| Annual recurring: tender response effort reduced | ~$22,000 / yr |
| Payback | Under 2 months against contract margin |
Lessons for your business
- Pre-qualification security questions are a procurement gate, not a technical exercise. Evidence is a deliverable from day one.
- Identity is the fastest risk reduction per dollar. Fix MFA and admin sprawl before buying anything else.
- Build the evidence pack once and maintain it. The second tender should take a day, not a quarter.
Explore the relevant services
Background guidance: read the relevant official framework or product documentation. This explains the technology; it is not independent verification of this client project.
Discuss a similar project
If this essential eight case study reflects a problem in your business, start with a scoped conversation. Tell us about your sites, people, systems and current priorities. We can then identify the right assessment, the practical constraints and the evidence you need.