Cyber Security Project Design

Critical Infrastructure

Western Australia

Context

A major Australian critical infrastructure organisation faced a recurring problem: translating a 200-page cyber security business case into a well-defined, auditable project scope for a Privileged Access Management (PAM) implementation.

The manual process took 3–5 days, produced inconsistent outputs across project managers, buried critical requirements inside risk registers and appendices, and left no traceability from scope items back to their originating business case paragraph or regulatory obligation.

StepChange deployed an AI agent embedding our Scope Development Method to solve this, delivering a governance-ready project scope document in under 4 hours.

The AI solution analysed the complete business case alongside supporting documentation, including cyber security strategies, enterprise architecture standards, risk registers, regulatory requirements, and previous project artefacts, to identify only the requirements relevant to the specific project.

Every proposed scope item was automatically linked back to its originating source, creating full end-to-end traceability and providing project teams, governance boards, and auditors with confidence that each deliverable could be justified against approved investment decisions and compliance obligations.

200+

Pages Analysed

4 hrs

To Draft Scope

100%

Traced to Source

6

Regs Mapped

14

Hidden Reqs Found

Zero

Missed Reqs

  • 200+ pages of business case, cyber strategy, risk registers, architecture standards, and audit findings reviewed manually by one BA — taking 3–5 days with inconsistent results.
  • Critical regulated requirements routinely missed buried inside risk register appendices, latest regulations, and previous audit findings.
  • No traceability: project teams could not always link scope items back to the originating business case, risk, or regulatory obligation.
  • Scope boundary between PAM, MFA, SIEM, and future Zero Trust workstreams was undefined creating downstream creep and rework risk.
  • AI agent deployed with StepChange’s Scope Development Method embedded; ingesting all source documents simultaneously: business case, strategy, risk registers, architecture standards, audit findings, and workshop scripts.
  • Structured extraction prompts applied systematically across all documents — identifying in-scope items, exclusions, assumptions, dependencies, and regulatory obligations.
  • Every extracted scope item automatically linked to its source document, section, paragraph, risk register entry, and applicable regulatory obligation — building a complete traceability matrix.
  • Governance-ready PAM project scope document delivered in under 4 hours, versus 3–5 days manually.
  • Complete traceability matrix produced with every scope item linked to its originating business case section, risk item, or regulatory obligation.
  • 14 previously overlooked requirements surfaced
  • Automated compliance mapping to SOCI Act 2018, Essential Eight, and ACSC guidance, with gap analysis against each framework.
  • Formal out-of-scope register produced across all four workstreams preventing scope creep before the project commenced.

The agent didn’t just save time, it found requirements we would have missed entirely. The traceability matrix alone justified the approach. Every line in the scope links back to a source we can validate with a request and response.

Business Analyst, Critical Infrastructure Client