Data center operator learns its security gap is process, not products, and finds a path to CIS IG2 without new tools
A multi-site edge data center and colocation operator. Outcome verified
The problem
A multi-site edge data center and colocation operator wanted a real measurement of its corporate IT controls. It had bought and switched on most of the right tools, but leadership doubted whether anyone used their output or would notice when something broke. Interviews described the tools; the consoles told a different story, and nearly every user was a local administrator.
Why it mattered
For a provider that customers trust with their infrastructure, and had never had a penetration test, unproven controls were an exposure and a credibility gap.
What we did
Vizius scored the 18 CIS Controls on two axes, process maturity and technical reality, and held a calibration session that downgraded several 'pass' answers once console evidence contradicted interviews. Where the two diverged the finding was 'the tool is on, the process is not,' pointing to fixes that cost habit rather than money.
What changed
The report showed 5 of 18 controls in good shape, 11 partial and 2 absent, an external scan of 47 hosts with zero critical or high findings, and a path from IG1 to IG2 within the fiscal year without new tools.
- Technology services and msp
- Midsize company
- CIS Controls