Background
A regional health network faced a regulator-scheduled audit in twelve months. An internal baseline measured Maturity Level 1 across most strategies: hand-patched multi-site estate, clinical devices on vendor-supported but unpatchable versions, and privilege administration grown by exception.
The constraint was clinical continuity: clinical devices and pathology interfaces could not be placed at risk by patch cycles.
Work performed
- The eight strategies ranked by consequence for the network; the programme sequenced patching, privilege and application control first.
- Micro-segmentation isolating clinical device classes, with monitoring tuned to the segments holding residual risk; risk acceptances owned by named executives.
- Ring-based patching model: pilot group, canary sites, estate; maintenance windows negotiated per clinical service; exceptions with expiry dates.
- Application control deployed device class by device class after a first estate-wide attempt broke three line-of-business applications and was rolled back.
- Controls instrumented to generate their own assessment evidence; quarterly governance forum with named risk owners and funded decisions.
Outcome
The audit assessed the network at Maturity Level 3 across all eight strategies, with the clinical-device compensating controls accepted as Level 3 equivalents. No clinical service went offline during the programme. Patch currency across the patchable estate ended above 95% within tolerance windows.
The governance forum continues after the programme; the network's next uplift decision was made by the forum without the firm present.