Our Projects

Department of Energy Customer

Advanced Vulnerability and Threat Management

Our primary focus has been to modernize and automate the handling of technical scan data. We successfully designed and implemented a sophisticated, self-managing system for vulnerability ingestion using Nessus and external CVE libraries. This involved creating a dedicated Nessus Plugin Library application that serves as the single source of truth for plugin information, eliminating the need for repeated manual entry into every Vulnerability Scan Result record. Furthermore, we developed several critical data feeds—including "Nessus Plugin Import" and cross-reference feeds to link CVEs to specific scan results (VSR)—which automatically ingest up to 140,000 records and correlate vulnerabilities with industry standards like CVEs. We also enhanced our capabilities by modifying the Vulnerability Scan Results process to handle both raw and modified .nessus files, greatly increasing the breadth of data we can analyze and ensuring that findings are accurately linked to associated controls.

Enhanced Compliance Scanning and Control Mapping

To ensure comprehensive compliance coverage, we have focused on integrating diverse scanning mechanisms into a unified reporting structure. We developed specialized XSL transforms for complex standards like SCAP and Nessus configuration results, allowing us to capture detailed security posture information previously difficult to integrate. For STIG compliance, we successfully built the DISA STIG import process, importing thousands of rules into the system database. Beyond simply ingesting data, we redesigned core applications (such as Devices and Allocated Controls) by implementing complex calculated fields and cross-references that automatically determine key metrics, such as "Date First Found," "Last Compliance Scan Date," and whether multiple failures exist for a given rule set. These improvements ensure that reporting is always based on the most current status of a device or control record within Archer.

Workflow Automation and Risk Governance Maturity

A major accomplishment has been the overhaul and refinement of our core risk management workflows, particularly for Program of Action & Milestones (POA&M) and Risk Acceptance (RBD). We rebuilt these processes into a highly functional “Versatile Advanced Workflow” model, providing significant improvements in user experience and data integrity. The team successfully incorporated support for Critical Security Controls (CSCRs) across both POA&M and RBD workflows, ensuring that the process can handle complex risk types. Functionally, we implemented granular rule sets requiring mandatory fields at specific review stages (e.g., ensuring reviewer names are populated before submission), which vastly improves auditability and enforces adherence to governance procedures.

Operational Efficiency and Project Foundation

Finally, our efforts have focused heavily on architectural improvements that underpin the entire solution. We addressed critical operational issues by enhancing permissions management across multiple roles and applications, fixing propagation issues for read-only flags, and modifying calculation logic across core objects like Allocated Controls and Devices. By creating new data feeds to import external compliance data (e.g., CISA data), we are ensuring that our records are not just based on internal scans but reflect the latest industry threat intelligence. These consistent improvements have resulted in a stable, scalable platform ready for large-scale testing and advanced user adoption across the client organization.

Health and Human Services Customer

Over the reporting period from March 2021 through October 2021, our team achieved substantial progress across all major phases of the Archer GRC implementation. We successfully navigated a complex technical landscape, resolving deep architectural challenges and completing multiple mission-critical integrations that have positioned the system for successful deployment. 

Security Architecture & Identity Management

In the foundational phase, we established robust security protocols by tackling core identity access issues. Our team designed the necessary Single Sign-On (SSO) framework, strategically determining that reliance on Windows Authentication was the optimal architectural path to inherit trust from standard network logins. Furthermore, we successfully planned and began implementing critical multi-factor authentication (MFA) capabilities using OpenID standards, ensuring a highly secure perimeter for user access right out of the gate.

Advanced Integrations & Threat Intelligence

Our most advanced work involved connecting Archer to the wider security ecosystem. We developed sophisticated data feed pipelines to centralize threat intelligence and vulnerability data. A major highlight was the successful integration of leading scanners like Tenable and Nessus, allowing us to pull real-time vulnerability metrics, plugin data, and host information into Archer. Furthermore, we developed a complex data feed that pulls historical and modified CVE records directly from the NIST National Vulnerability Database (NVD), drastically enhancing our organization's ability to manage risk contextually.

Platform Stabilization & Core Functionality Mastery

Throughout the weeks, we tackled numerous deep-dive technical challenges that ensured the stability of the core platform. We resolved critical issues within the global search functionality—a feature vital for user experience—and configured complex workflows, including A&A module processes and advanced record progress tracking. Our troubleshooting skills were instrumental in resolving persistent production data feed failures, often requiring us to pinpoint underlying infrastructural problems like incorrect firewall rules or database permissions.

Deployment Readiness & Operational Milestones

As the project matured, our focus shifted to readiness for go-live. We successfully managed the logistics of critical infrastructure setup, including configuring and testing new services servers in the DMZ environment using newly acquired hardware. Crucially, we completed all necessary administrative milestones—including finalizing ALT card paperwork—and delivered mandatory security, privacy, and records management training to key stakeholders. These collective efforts confirm that the platform is not only technically functional but operationally ready for organizational adoption.

In summary, our collaborative effort ensured every major architectural layer was built, tested, and stabilized, transforming a concept into a fully capable, integrated GRC system.

Department of Treasury Customer

Project Foundation and Technical Implementation

Our initial efforts focused heavily on establishing a robust technical foundation for the eGRC platform at the agency. This phase involved successfully guiding the client through environment setup, including addressing complex prerequisites such as permissions structuring and FIPS hardening requirements. We worked closely with the internal IT teams to ensure that the core Archer 6.3 documentation was implemented correctly. A significant accomplishment during this period was the successful installation of key Public Sector packages, which laid the groundwork for integrating governance, risk, and compliance functions into a unified system.

Core Module Configuration and Issue Resolution

As the project advanced, our focus shifted to configuring critical modules within the Archer platform. We successfully tackled several complex technical hurdles related to data integrity and application dependencies. This included detailed work on importing Controls data into the A&A (Assessments & Assessments) application, resolving field misalignment issues in key areas like Control Catalogs and Assessment Objectives. When encountering licensing or versioning conflicts—such as difficulties with the POA&M package installation—we provided expert recommendations, advising the client when to use specific versions (e.g., 6.1 vs. 6.3) or recommending the setup of new instances to ensure maximum stability and functional alignment across all interconnected modules.

System Stabilization and Knowledge Transfer

In the later stages, we achieved significant progress in stabilizing the environment and ensuring operational readiness. We worked through detailed bug remediation and optimized the A&A package structure, particularly by advising on how certain data dependencies (such as Offices or Departments) could be made non-mandatory without compromising security. Our final accomplishments centered on knowledge transfer; rather than continuing active configuration, we successfully transitioned support to the client team. This shift allowed agency staff to begin actively learning and navigating the A&A package, demonstrating that the system is stable and functional, marking a successful transition from deep technical consultancy to user proficiency.

Financial Services Customer

Project Architecture and Core System Design

The initial focus of the project centered on building a robust foundation for the Enterprise Governance, Risk, and Compliance (eGRC) system. We successfully finalized the foundational design of the Risk System, establishing critical components such as implementing manual risk overrides and removing outdated risk exposure calculations. A major technical milestone involved establishing the Development/UAT environment copy, ensuring that the system could be tested in a stable, segregated setting before production deployment. Furthermore, significant effort was dedicated to integrating external data sources; we successfully implemented the connection with LexisNexis data feeds, which confirmed its ability to ingest large volumes of primary documentation and topics into Archer. This ensured that the system's knowledge base is comprehensive and continuously updated by authoritative third-party intelligence.

Operational Controls and Process Enhancements

Substantial work was completed in refining core governance processes and controls within Archer. We introduced several granular improvements to enhance data integrity and workflow efficiency. Key accomplishments included splitting the "Open" status into distinct categories ("Open – Never Tested" and "Open in Testing") to provide clearer visibility during control testing cycles, along with adding complex calculations to automatically determine which status category is appropriate. The system was also enhanced by creating specialized linkages that allow users to cross-reference regulatory obligations directly to Authoritative Sources and Regulators. To strengthen internal controls, we developed mechanisms within the Control Procedures module that reference test results from various assessment questionnaires (Operating, Design, and Implementation), providing a verifiable audit trail for every control assessed.

Data Integrity and System Refinements

Throughout the reporting period, our team systematically addressed data quality and system usability across multiple modules. We corrected and updated key fields—such as adjusting the calculation logic for "Sample Size" in Control Procedures to account for multiple related risks—and implemented new scope management capabilities by creating dedicated Scope fields within both Authoritative Sources and Regulatory Intelligence Items. On the technical front, we resolved initial challenges regarding date field calculations by addressing how Archer handles time internally (UTC). We also refined system workflows, such as adjusting control procedure status tracking and implementing advanced permissions to manage sensitive records. Finally, we successfully added specialized filtering rules—such as preventing "empty" obligations from populating Control Standards—to maintain the accuracy and relevance of compliance data within the eGRC platform.