Secure Cloud Transformation with 50% FISMA Score Improvement

Client

Department of Homeland Security – CISA

Summary

CRG helped the Department of Homeland Security’s Cybersecurity & Infrastructure Security Agency (CISA) modernize its cloud environment, implement Zero Trust, and achieve measurable gains in security maturity and resilience.

Audit-Ready

Secure by Design

Incident Response

quick stats

50% increase in global FISMA security maturity scores

45% faster response to critical incidents

The Challenge

DHS CISA faced the urgent need to secure and modernize its cloud operating environment. The agency was deploying Amazon Web Services (AWS) Landing Zone and Microsoft Azure CLAW (Cloud Log Aggregation Warehouse) while managing sensitive federal systems that required strict compliance with NIST, FedRAMP, FISMA, and OMB standards.

The risks were clear:

Disparate systems creating compliance gaps.

Rising number of security incidents.

Pressure from Executive Order 14028 to adopt Supply Chain Risk Management and Zero Trust.

Need for a secure-by-design migration from on-premise to cloud.

Our Approach

CRG partnered with BAE to deliver comprehensive Systems Engineering & Information Assurance (SE&I) support under a $10.7M firm-fixed-price contract.

Cybersecurity Strategy Development

Designed and implemented an agency-wide strategy that aligned with Zero Trust and secure-by-design principles.

Cloud Security Integration

Directed the secure design and deployment of AWS and Azure environments, including virtual private clouds, VPNs, and relational databases.

Governance & Standards

Established corporate cloud computing policies and standards in line with NIST 800-53, FedRAMP, and FISMA.

Enterprise Risk Management

Conducted enterprise-wide risk assessments, identifying and prioritizing vulnerabilities with mitigation roadmaps.

Security Operations

Oversaw daily security operations, incident response, and anomaly investigations across CISA systems.

Collaboration

Advised the CIO and CISO directly, and worked closely with enterprise security operations teams to ensure smooth adoption.

The Results

Measurable Outcomes:

50% increase in global FISMA security maturity scores.

45% reduction in Mean Time to Respond (MTTR) to critical incidents.

40% fewer high-risk vulnerabilities across the enterprise.

Significant reduction in overall security incidents.

CISA required a partner with proven federal expertise to deliver a transformation without disrupting mission-critical operations.

Aerial view of a city with high-rise buildings at night.

Why It Matters

For a federal agency like DHS CISA, even small lapses in security can have national implications. By embedding secure-by-design principles into cloud transformation, CRG helped ensure: