Case studies usually cheat by hiding the messy middle, so this one shows the whole quarter. The organisation is invented — a mid-sized events collective in Ahmedabad that runs festival calendars, venue partnerships and a growing mailing list — but every figure, threshold and mechanism below is real, taken from the published record of the practice rather than from marketing. The team gave itself one season to move its protection work from memory and goodwill to clocks and files, and adopted the discipline its research kept pointing to: DataSecOps, the habit of guarding datasets while the datasets and the people touching them refuse to sit still. Read it as a rehearsal. Any team that handles partner records, vendor contracts and subscriber lists runs the same play with the same props.
The setup: a season of arrivals, named and unnamed
The collective’s year peaks around festival weeks, and its access pattern peaks with it. Photographers arrive needing the shot lists, volunteers need the participant spreadsheet, sponsors need audience counts, and every one of them gets a login for the duration — after which everyone moves on and the logins simply remain. Before the quarter began, an honest inventory of the problem read like this: no list of what data existed, rules that lived in one administrator’s habits, and an export folder that had become the de facto archive. That starting point is common enough that the maturity model gives it a name — the bottom rung, where activity happens and evidence does not. The team’s brief to itself was narrow and measurable: climb one rung in three months, and be able to prove the climb.
Weeks one and two: counting came before defending
Discovery ran first, against the instinct to buy something. Two people swept every database, drive and shared folder, and the sweep’s product was a plain inventory with sensitivity ratings attached — participant contact details rated sensitive, venue contracts internal, published schedules public. Classification was deliberately human-signed: automated tools proposed labels, a person confirmed the sensitive ones, because the tools miss and the tags would drive every rule afterwards. Those two weeks produced no security whatsoever in the cinematic sense; they produced the map without which nothing downstream could be measured. The sweep also settled arguments — the “surely we don’t keep the old registration sheets any more” debate ended when the sheets turned up in a shared drive nobody had audited since the previous year. The team’s note for the week was blunt and worth repeating: an estate that has never been counted cannot report progress, only vibes.
The middle of the quarter: rules became files, grants grew clocks
With the map in hand, the team moved its protection rules into a version-controlled repository, where a proposed change is a pull request and approving one is a merge. Every grant now began with a written request — the named dataset, the purpose in a single line, the lifespan in days — and ended with an expiry that the machinery applied without a human remembering anything. Routine asks cleared within hours; anything unusual took the heavy path, with a logged ticket and a senior signature accepting the risk. Exports stopped being ad-hoc: leaving the estate meant going through one monitored channel with the destination recorded. None of this was exotic tooling; it was the access-request flow the practice prescribes, applied with spreadsheets-grade discipline and a repository as the paper trail.
Mid-season: the scoreboard, read aloud
Halfway through, the team measured itself with four numbers from a published worked example, and the reading was sobering in the useful way. Coverage first: 1,085 protected fields against 1,240 flagged ones came out at 87.5 percent, and the team learned to hear that as twelve percent unfinished rather than eighty-seven done. Traffic second: 17.1 percent of read activity still hit values sitting in the open, which proved that paper coverage and query behaviour are different measurements — a protected original with an unprotected copy in circulation shows up only in the traffic count. Exposure third: 212 of 940 logins could reach material their roles never needed. Dormancy fourth: 310 grants among 1,900 had gone unopened for three months, the photographer logins and lapsed vendor accounts of this story rendered as arithmetic. All four went onto a monthly scorecard, dated, because a number without a date describes an estate that no longer exists.
Where the quarter landed on the DataSecOps ladder
The maturity model’s published thresholds gave the season its pass mark. The classified stage’s exit bar is working protections across a majority of the tables an estate rates tier one — call it the fifty-percent line — and the team crossed that in month two. Holding the enforced stage requires more than ninety percent coverage and the total absence of hand-typed console rules, the kind that leave behind no record of author or date; the console rules were hunted down and ported into the repository by month three, but coverage sat just short, so the honest verdict was “between rungs, moving up”. That verdict mattered more than a badge: it named the next quarter’s work precisely. The thresholds, the ladder and the worked example behind the scoreboard are all laid out in the Ops Atlas reference card for DataSecOps, which the team used as its checklist rather than as decoration.
What one season of DataSecOps actually changed
The quarter’s most consequential meeting was the review at its end, where fourteen dormant accounts were switched off in forty minutes — the volunteers and vendors of the festival weeks, their grants expired or revoked with the evidence on the table. The mailing list gained a named owner; the export folder gained a log; the administrator’s habits gained a repository. Onboarding changed too: a new volunteer’s first week now includes a request form instead of a borrowed login, which quietly retired the “ask Priya for access” chain of command. Nothing dramatic happened, which was the point: the failure modes this work prevents are the quiet ones, the stale login and the unlabelled copy, and those were exactly what the quarter removed. The team’s closing summary travelled well beyond events: structure first, then scrutiny, holds for any operation that earns trust by handling other people’s details — the same progression a visitor follows when planning a first trip to Gujarat, choosing among the best experiences for first-time visitors, or sampling the different types of tourism experiences the state offers. Count, name, clock, review — a season is enough to install it, and the install keeps working after the season ends.
The quarter, reduced to its ledger lines:
- Weeks one and two: the census and human-signed labels — the map before the walls.
- Mid-quarter: rules moved to a repository; grants written with purposes and end dates.
- Scoreboard: 87.5% coverage, 17.1% open reads, 212 of 940 over-armed, 310 of 1,900 idle.
- Rungs: the fifty-percent line crossed in month two; the ninety-plus-no-console bar missed by a step.
- Quarter’s end: fourteen dormant accounts switched off in forty minutes.
