Tool Sprawl and Architecture Review Bottleneck in a Hospital System
Lakeshore Health Partners is a nine-hospital system with 2,200 beds, 42,000 endpoints, and 140 applications moving to AWS and Azure. Security has 61 staff and 12 vacancies, plus 18 overlapping tools: three SIEMs, two EDR platforms, and four vulnerability scanners. The architecture review board meets weekly but has a six-week backlog. A recent near-miss occurred when an EDR alert failed to reach the SIEM because a connector license had lapsed. The CIO favors best-of-breed tools and says consolidation will slow clinical innovation. The CISO has a 12-month mandate to reduce tool sprawl by 30% and improve detection. Thirty percent of applications are unclassified, and 40% of production workloads still lack a documented data flow.
1. Recommend a target security architecture and sequencing for the next 12 months.
Read the worked answer
Target one SIEM, one EDR, one vulnerability management platform, and a cloud-native control plane with centralized logging. Sequence by risk and dependency: first fix the alert path by renewing or implementing the EDR-to-SIEM connector and defining critical detection use cases; second classify the 140 applications and document data flows for the unclassified production workloads; third consolidate SIEMs after a log-source and retention inventory; fourth standardize EDR by cohort rather than big bang; fifth retire redundant scanners as contracts expire. Keep only a thin best-of-breed exception for a demonstrated capability gap, not preference. Measure detection coverage, mean time to detect, and tool cost per endpoint. This sequence addresses the near-miss immediately while building the inventory needed to consolidate safely.
2. How should the CISO decide between consolidation and best-of-breed tools? Give explicit criteria.
Read the worked answer
Use criteria: unique capability, integration cost, operational burden, contract exit cost, clinical risk, and total cost of ownership. Best-of-breed is justified only if it closes a material detection gap that the standard platform cannot meet within 12 months and the integration is supportable with current staff. Otherwise consolidate. Run a scored review with security architecture, clinical informatics, and procurement. Prototype the top two scenarios and require an exception with a named owner, sunset date, and integration test. This prevents both uncontrolled sprawl and false economies that remove a control the hospital actually needs.
3. Redesign the architecture review process to remove the six-week bottleneck without weakening risk control.
Read the worked answer
Split the board into a fast lane for low-risk changes using pre-approved patterns and cloud landing zones, and a full review for high-risk changes such as crown-jewel applications, new data flows, and internet exposure. Publish architecture standards and reference patterns so teams can self-assess before submitting. Set a five-day service-level target for full review and use weekly triage to clear the queue. The CISO keeps stop-work authority for material risk. Track backlog age and the percentage of changes going through the fast lane. This reduces latency because most changes are not novel, while preserving scrutiny where the blast radius is high.