EvrazTekhnika

How EVRAZ Maintains Strong Information Security with a Small Team and Flexible Processes

EVRAZ reports achieving over 92 percent compliance in external audits while operating one of the smallest information security teams in its industry. The company relies on gradual rollout of controls, collaboration with developers and contractors, and avoidance of blanket prohibitions. A 2017 Petya incident reinforced the need for stronger security measures across the organization. Current challenges include business users creating their own AI-assisted applications that bypass standard review processes. Detailed workflows cover architecture approval, static code analysis in DevOps pipelines, and mandatory security sign-off before production deployment. The approach emphasizes education and risk demonstration rather than strict enforcement.