Secure Cloud Landing Zone for a Health Network
Guardrails in code across every account, with critical misconfigurations down 92% in two quarters.
Client name withheld by agreement- Client
- Multi-state health network
- Region
- Texas and Oklahoma
- Year
- 2024
- Duration
- 26 weeks
- Scope
- 310 AWS accounts · 4,000 workloads
- Practice
- AI, Cloud & Digital Trust
The challenge
What was at stake.
A multi-state health network had moved four thousand workloads into more than three hundred AWS accounts in two years. Each team had built its own way, and security findings were arriving faster than anyone could close them.
Patient data, regulators and a ransomware threat that targets hospitals meant the network could not afford to slow down migration or to keep accepting the risk.
What we did
The approach, step by step.
- 01
Landing zone redesigned
A new account structure, organization-wide guardrails and centralized logging, defined in infrastructure as code.
- 02
Identity first
Federated access, least-privilege permission sets and break-glass procedures replaced long-lived keys and shared administrator accounts.
- 03
Guardrails in the pipeline
Policy checks run before deployment, so misconfigurations are stopped at the pull request instead of found in production.
- 04
Posture you can watch
A single posture dashboard by account, owner and severity, with remediation service levels the CIO reviews monthly.
- 05
HIPAA evidence by default
Controls were mapped to HIPAA Security Rule safeguards so audit evidence is generated as a byproduct of operating.
Outcomes
What changed, in numbers.
- 92%
- drop in critical misconfigurations in two quarters
- 310
- AWS accounts under one guardrail set
- 4,000
- workloads covered by policy as code
- 0
- long-lived administrator keys remaining
We kept migrating at full speed, and our risk went down instead of up.
Services delivered
Related engagements
More work in AI, Cloud & Digital Trust.
-
Austin, Texas · 14 weeks
AI, Cloud & Digital Trust · 2024SOC 2 Type II Readiness for an HR PlatformA clean Type II report on the first audit window, and enterprise deals unblocked the same quarter.
-
U.S. and EU · 20 weeks
AI, Cloud & Digital Trust · 2025 · OngoingAI Governance and Red Teaming for a GenAI PlatformAn AI management system built for certification, and 31 jailbreak paths closed before launch.
-
North Texas · 16 weeks
AI, Cloud & Digital Trust · 2025CMMC Level 2 Readiness for a Defense SupplierAn SPRS score raised from 38 to 110 and a C3PAO assessment booked with confidence.
Let’s talk about your version of this.
Share what you are up against. A senior practitioner who has delivered this kind of work will reply within one business day.