You connect common data environments (CDEs) securely on critical infrastructure projects by taking desktops, personal accounts and uncontrolled scripts out of the data path, and using a certified integration that streams files directly between platforms with every action logged. CDE Sync™ does this without storing files, encrypts data in transit and processes it in the Azure region you choose, which suits projects with obligations under Australia's Security of Critical Infrastructure (SOCI) Act.
Why critical infrastructure raises the bar
The SOCI Act places obligations on owners and operators of critical infrastructure assets in sectors such as energy, water, transport, aviation and communications. Those obligations flow down to the contractors and consultants who design and build the assets, and to the information they handle. Design documents for a substation, a water treatment plant or a rail system can be sensitive in themselves.
The weak point is often the movement of information between organisations. When files are downloaded to a laptop and uploaded to another platform, or moved by a script running on someone's desktop, they leave the controlled environment. There is no reliable record of who moved what, and the files may sit in places nobody audits. That is exactly the kind of uncontrolled intermediary security teams want removed. Scripts bring a further problem, because they often run under one person's credentials and stop working when that person leaves or a vendor changes its API.
What a secure CDE connection looks like
A secure connection has a few clear features. Files move directly between platforms through service accounts, never through personal devices. The integration does not keep copies of files. Data is encrypted in transit and processed in a known region. Every action is attributed and logged, so the audit trail shows exactly what moved, when and by which rule. Access uses role-based controls and multi-factor authentication. The provider evidences its controls through independent certification and regular penetration testing. CDE Sync™ is built on that model, and Utopia Digital holds SOC 2 Type II and Cyber Essentials.
How to connect CDEs securely on SOCI projects, step by step
Identify every point where project information currently crosses between organisations or platforms.
Note where those transfers involve desktops, personal accounts, shared drives or scripts.
Agree the platforms, folders and directions that need a controlled connection.
Run a security review of the integration, using the evidence on the Security Trust Portal and a second meeting with your cyber team where needed.
Select the Azure processing region that matches your obligations, using the global data region map.
Create dedicated service accounts with least-privilege access on each platform.
Connect the platforms in the CDE Sync™ wizard, retire the manual and scripted routes, and monitor the audit log.
Joint ventures and government clients
Critical infrastructure projects are often delivered by joint ventures for government clients, which adds parties and scrutiny. Partners and clients may not accept data passing through another organisation's uncertified tools. A neutral, certified integration that each party can review gives everyone the same assurance. It also simplifies the end of the project, because the audit log and the archived record show a clean chain of custody for the information that was exchanged. Our article on the risks of cross-CDE data transfers covers this in more depth.
Resilience as part of security
Security on critical infrastructure includes keeping work going if a platform is compromised. CDE Backup™ keeps an ongoing, independent copy of project files, versions and metadata in your own Azure tenancy, so a ransomware incident on a vendor platform does not leave the project without its record. Our article How Do I Back Up My CDE? explains how to set that up.
Secure CDE connections and the Utopiaverse™
Secure connection is the foundation of the Utopiaverse™. CDE Sync™ connects platforms without storing files, CDE Backup™ keeps an independent copy in your own Azure, CDE Migrate™ moves records between platforms or regions and CDE Archive™ captures the final record. AI Insights runs inside your own tenancy, so the record stays under your control. See also How Do I Meet Data Residency Requirements When Connecting CDEs?
See the security model in the monthly live demo, or talk to the team about your SOCI obligations.
