Meridian Health runs three hospitals and a dozen clinics on margins measured in single digits. Security had always lost the budget fight to clinical equipment — until ransomware encrypted the electronic health record over a weekend, diverted ambulances for two days, and forced staff back to paper. The board’s question afterward was not how to become world-class, but what Meridian could actually afford that would reduce the chance of it happening again.

The first assessment

A rapid assessment across the six domains found the money had gone to the wrong places. Infrastructure was the open wound: one flat network let the ransomware reach everything, and the backups that existed had never been test-restored. Endpoints were a museum — nursing workstations years behind on patches and medical devices running operating systems their makers no longer supported and Meridian could not legally modify.

Data access was tighter than expected, hardened by years of HIPAA audits, and Software barely applied since almost nothing was built in-house. Process was the quiet culprit: there was no rehearsed incident plan, and the first phishing email had reached a clerk never trained to doubt it.

Phase one — stop the bleeding cheaply

Meridian chose the highest-risk, lowest-cost moves first. Multi-factor authentication and tested, offline backups came before anything glossy. The flat network was carved into segments so a compromised clinic could no longer reach the hospital core. Because the legacy medical devices could not be patched, they were isolated behind their own segment with tight access rules — a compensating control rather than a fix.

Process gained a one-page, rehearsed ransomware playbook and short, mandatory phishing training for every badge holder.

Phase two — build the muscle

With survival addressed, the second phase raised Monitoring & Maintenance so someone would actually see an intrusion in progress, and formalized Threat Assessment so new clinical systems were reasoned about before they were plugged in. Vendor management tightened around the imaging and records suppliers whose remote-support connections had been standing open.

Where they landed

Meridian never became a bank, and never tried to. It spent its limited dollars where they bought the most risk reduction — Infrastructure, Endpoints and Process — and left the rest deliberately modest. The model gave the board a way to see that its spending finally matched its risk, and a schedule to revisit as devices aged, because in healthcare the estate is never static and the next unsupported device is always arriving.

Halstead Tooling makes precision components on a plant floor that runs three shifts. When ransomware crossed from the front-office network onto the factory network and idled the line, the cost was counted not in leaked records but in hours of stopped production and a genuine worry about machine safety. For Halstead, an outage — not a breach — was always the disaster.

The first assessment

Assessing across the six domains surfaced a risk model unlike an office’s. Infrastructure was the crux: the IT and operational-technology (OT) networks were effectively one, so an ordinary phishing click could reach programmable controllers that cannot be rebooted or patched on demand. Vendor was close behind — the machine-tool suppliers kept always-on remote connections for support, a convenient door no one watched.

Data mattered less here than availability, and Software was mostly purchased, but Process carried real weight: change on the plant floor is governed by safety, and security fixes had to respect that no control could be altered lightly.

Phase one — separate and control

The first phase drew a hard line between IT and OT, so a compromise in the office could no longer reach the floor. Vendor remote access was pulled behind brokered, time-boxed connections that someone approved and logged. Neither change touched a single machine’s programming, which kept the safety engineers comfortable, yet both sharply cut the paths an attacker could take.

Phase two — see and sustain

The second phase added monitoring tuned to the OT environment, where “normal” looks nothing like an office network, and hardened the aging servers that bridged the two worlds. Threat assessment was extended to ask, for each new piece of connected equipment, what it could reach if it were turned against the plant.

Where they landed

Halstead’s program will always read differently from a bank’s: it optimizes for keeping the line running safely, not for secrecy. It pushed Infrastructure, Vendor and Process furthest and left others deliberately lighter. And because every new machine arrives with its own software and its own remote-support habits, the assessment became a standing part of procurement rather than a one-time project.

Coastal State University is less an organization than a federation: hundreds of departments, thousands of staff and tens of thousands of students, each guarding its autonomy. Its reckoning came when a research group’s data — years of work with real commercial and national-security value — was quietly exfiltrated through a departmental web application no central team knew existed.

The first assessment

Assessing a place that resists central control was itself the lesson. Software was a sprawl of departmental and research-built applications, unmaintained and unmapped, the breached app among them. Data ranged from ordinary student records under FERPA to sensitive research that drew patient, sophisticated adversaries. Process reflected the culture — open by default, with security seen as something that got in the way of teaching and research.

Endpoints were a free-for-all of personal devices, while Infrastructure and Vendor were comparatively well run by the central IT group that did hold authority.

Phase one — influence, not mandate

Coastal could not simply order compliance, so its first phase worked through incentives and services: an inventory that finally found the shadow applications, an easy path to retire or adopt the riskiest ones, and data classification that let the university concentrate protection on the research that warranted it. Security requirements were offered as help to grant-funded projects rather than imposed as a checkpoint.

Phase two — raise the floor

The second phase lifted the baseline everywhere the center could reach: review of departmental applications before they went online, guidance and light-touch management for the devices touching sensitive data, and threat assessment focused on the research groups most likely to be targeted.

Where they landed

Coastal accepted that uniform maturity was neither possible nor the point; it raised the domains carrying real risk — Software, Data and Process — while leaving the long tail governed by influence. The model gave a decentralized institution a shared language its many fiefdoms could actually agree on, and a way to keep revisiting the parts of itself it could never fully see.

Calder & Boyd is a mid-size law firm — eighty partners and associates, a support staff, and a duty of confidentiality that is not merely a regulatory obligation but the core of the business. Its reckoning came the ordinary way: a phishing email, opened on a partner’s laptop during travel, gave an intruder a foothold in the matter files. Nothing was encrypted and no ransom was demanded — the data was quietly copied and, months later, offered for sale. For a firm whose product is discretion, the exposure of client secrets was the worst outcome imaginable.

The first assessment

A quiet assessment across the six domains found the firm’s risk concentrated exactly where its work happens. Endpoints were the weak point: partners’ laptops and phones travelled everywhere, carried copies of highly sensitive matter files, and — because partners are owners rather than employees — had never been brought under consistent management. Data was both the prize and the exposure, duplicated across mailboxes, laptops, and a shared drive with little classification and no retention discipline, so no one could say where a given matter’s secrets actually lived.

Vendors added a surface the firm did not control — the e-discovery platform, the cloud practice-management system, and the outside services that handled overflow copying all held client data under agreements no one had reviewed for security. Infrastructure and Software were modest and largely outsourced, and Process, though informal, was not where this breach began — even if the phishing that started it was a reminder of how close that domain sits.

Phase one — manage the devices, protect the files

The firm did not attempt the wholesale IT takeover its partners would have resisted. The first phase secured what mattered most: multi-factor authentication on every account, and enrolment of the laptops and phones that touch client data into management that could enforce encryption and wipe a lost device — presented to partners as protection of client confidence rather than corporate control. The most sensitive matter files were consolidated into the firm’s best-secured system and pulled out of scattered mailboxes and local drives.

Phase two — govern the data and the vendors

With the immediate exposure reduced, the second phase built the disciplines a firm is actually judged on. Data gained a simple classification tied to client sensitivity and a retention schedule that finally closed old matters rather than keeping everything forever. The most critical vendors — the e-discovery and practice-management providers above all — were assessed against a short security standard and held to it in their contracts, so borrowed capability stopped being unexamined risk. Brief, mandatory training taught staff to recognize the client-impersonation and wire-fraud attempts that target legal practices.

Where they landed

Calder & Boyd did not become a technology company, and its partners kept their autonomy. What changed was that the firm could show clients — and its own malpractice insurer — that the confidentiality it promised was backed by controls, concentrated in the domains that carried its real risk: Endpoints, Data, and Vendor. The model gave a partnership that resists central mandates a shared, professional language for the few security decisions that were not optional, and a schedule to revisit as new matters, new devices, and new legal-technology tools continually reshaped what it had to protect.