Security operations, move by move.
A SIEM contract comes up for renewal, or the detection rules still point at a network that was rebuilt two years ago. In these moves the logs had to keep arriving while we swapped the platform under them.
- CMMC Level 2 and SOC 2 readinessimplementation · delivered
- OT security baseline for plants and pipelinesimplementation · delivered
- Service account, API key and non-human identity cleanupmodernization · delivered
- SIEM migration from Splunk to Microsoft Sentinelmigration · delivered
- VPN to zero trust network accessmodernization · delivered
CMMC Level 2 and SOC 2 readiness
Told without the client's name or anything that could identify them.
An aerospace parts supplier's IT team was asked by a prime contractor for its SPRS score and by a commercial customer for a SOC 2 Type 2 report at about the same time. Evidence for access reviews was a folder of old screenshots, and nobody could say which systems held CUI, so the assessment boundary kept growing. We traced where CUI lived across email, file shares, PLM and ERP, and moved what we could into an enclave to narrow the boundary. NIST SP 800-171 requirements and the Trust Services Criteria were mapped once to the systems that implement them, with one owner per control. After closing the MFA, access review and logging gaps, we automated evidence from Entra ID, the IGA platform, PAM and SIEM, ran a mock assessment and handed the evidence index to the compliance owner.
what the client got- A boundary drawn around where CUI really livesWe documented how CUI flows and narrowed the in-scope systems. Sensitive work moved into an enclave, so controls didn't have to cover everything.
- One control map for both frameworksWe mapped NIST SP 800-171 requirements and the Trust Services Criteria to the same systems. Shared controls were mapped once, and each has a named owner.
- Evidence is pulled, not screenshottedWe collect identity, IGA, PAM and SIEM evidence on a schedule and file it in a dated evidence index. Over time that becomes the operating history a SOC 2 Type 2 period asks for.
All 5 in security operations
Read any of them and you get the story, the before-and-after architecture, the plan phase by phase and the results.
CMMC Level 2 and SOC 2 readiness
Engineering the identity, access, logging and evidence controls behind CMMC Level 2 and SOC 2, so assessments rest on system evidence rather than narrative.
read the case studyOT security baseline for plants and pipelines
Securing plants, substations and pipelines from a passive asset inventory up, with IEC 62443 zones and conduits and vendor access kept under control.
read the case studyService account, API key and non-human identity cleanup
Tracking down every service account, app registration, API key and AI agent, putting an owner on each and moving them to short-lived, federated credentials.
read the case studySIEM migration from Splunk to Microsoft Sentinel
Moving detections, log sources, playbooks and retention from Splunk to Microsoft Sentinel in the Defender portal, with a parallel run before cut-over.
read the case studyVPN to zero trust network access
Retiring remote-access VPN one app at a time, and moving users to access that checks identity and device through Entra Private Access or your current ZTNA.
read the case studyNot sure which one fits?
Send us what you run and what's due. An engineer reads it and tells you where we'd start.
start an assessment →Risks that keep coming up
One risk from each of these moves, and the case study that shows how we handled it when it hit.
-
A boundary that keeps growing ↗
If CUI sits in every mailbox, every system is in scope. Narrowing the boundary early cuts the work more than any tool.
-
Sensors in the wrong place ↗
One sensor on the plant core switch misses traffic that stays inside cell switches. Placement follows the switch trace, not the org chart.
-
Disabling something critical ↗
Last-sign-in data can miss a job that runs once a quarter. So we disable first and delete later, with a waiting period and a quick way to turn things back on.
-
Ingest cost surprise ↗
Send everything to the analytics tier and you rebuild the cost problem you left. Decide tiering table by table before any connector goes live.
-
Apps nobody knew about ↗
Expect flow data to surface apps nobody had on a list. Find each one an owner and a policy, or the VPN can't be switched off.
Platforms and services across these moves
Ordered by how often they appear in this area's case studies.
01Do we still need CMMC work after the Phase 2 suspension?
Yes. The suspension paused third-party Level 2 assessments. DFARS 252.204-7012, NIST SP 800-171, self-assessments, SPRS scores and annual affirmations still apply, and we'd plan as if third-party assessment will return.
02Claroty, Nozomi Networks or Dragos?
It depends on your control vendors' protocols, your site layout and who will run the platform. We test two on your own mirrored traffic at one site before you buy.
03Do we need a dedicated NHI tool?
Not always. Entra ID, your IGA platform and the cloud IAM reports can produce a first inventory between them. A dedicated tool earns its cost when SaaS OAuth grants and secrets are spread over many platforms. We begin with the tools you already own and show you where they fall short.
04Will Sentinel be cheaper than Splunk?
It depends on volume, which tables need analytics-tier queries, retention, and which Microsoft licenses you already hold. We model it from your actual ingest before anyone commits.
05How long does it take to retire the VPN?
It depends on how many apps sit behind it, how many use legacy protocols and how many unmanaged devices connect. Web apps move fast. The last few thick clients usually set the end date.
More case studies by area
The same approach, applied to other parts of the estate.
2009c574 - 01Federal Register: DFARS CMMC final rule, effective 10 Nov 2025federalregister.gov ↗
- 02DoD CIO: Memorandum implementing the suspension of CMMC Phase II (Jul 2026)dodcio.defense.gov ↗
- 03WilmerHale: Pentagon suspends CMMC Phase 2 requirements (20 Jul 2026, secondary source)wilmerhale.com ↗
- 04eCFR: 32 CFR Part 170, CMMC Programecfr.gov ↗
- 05NIST: SP 800-171 Rev. 2, Protecting CUI in Nonfederal Systemscsrc.nist.gov ↗
- 06AICPA: 2017 Trust Services Criteria (with revised points of focus, 2022)aicpa-cima.com ↗
- 07TSA: Security directives and emergency amendments (Pipeline-2021-02 series)tsa.gov ↗
- 08NERC: CIP-015-1 internal network security monitoringnerc.com ↗
Facing one of these moves?
Tell us what you're on now and where you need to be. We'll come back with how we'd run the move.
- The platform and the version you're on
- Where you need to get to, and by when
- What's custom: rules, plugins, integrations
- Any audit finding or deadline driving it