A consumer technology company bought a consumer products business that a large industrial parent had carved out and sold. The combined company ran more than 1,000 endpoints across macOS, Windows, and Linux, a broad suite of apps for its connected devices, and customer data subject to the CCPA, the CPRA, the GDPR, and Virginia's Consumer Data Protection Act (CDPA). It needed a security leader who could set direction across all of it, and teams to carry the work out.
BD Emerson took the virtual CISO (vCISO) role, owning security strategy and oversight of the company's security program. We took charge of security for the endpoint estate, with endpoint management, threat detection, and incident response built for a mixed macOS, Windows, and Linux environment. As the company's primary application security team, we ran regular security assessments and vulnerability management across its apps and brought secure development practices into how the apps are built. On privacy, our consultants guided the company's compliance with the CCPA, the CPRA, the GDPR, and the CDPA.
The vCISO role put security strategy, endpoint security, application security, and privacy under one accountable lead working with the company's leadership. BD Emerson continues to serve on the company's leadership committee.
The combined company has security leadership in place, managed security across more than 1,000 endpoints on three operating systems, an application security function that assesses its apps on a regular cycle, and privacy compliance work covering four regimes.
Client details in this case study are generalized, and in places combined across engagements, to protect confidentiality. The work ran through our vCISO and data privacy practices. Carve-out cybersecurity covers the security work that follows a carve-out acquisition, and our carve-out advisory team handles the separation itself. We are glad to walk through comparable work under NDA.
