In This Article
Watch the video to see how CDW uses Paramify to do more the easy way.
At a Glance
Customer: CDW, Government Security team
Industry: IT solutions and professional services, federal and defense work
Scope: 4,500 governed systems, 40 asset owners, a four-person government team
Key results
- Asset coverage expected to grow from 10 to about 100 with the same team
- About 100 hours per review, down to about one, Gap assessment from 10k hours to instant
- 50 evidence fetchers built in a day
- A framework revision that would have taken about a year, now an afternoon of mapping
- A 10-year program vision compressed to roughly 2 years
CDW: Government security services
CDW built its name reselling IT, but much of the company's growth now comes from professional services, complete with a government security team.
Griffin Brown, Principal Government Security Architect, helps run the team's compliance programs. They govern 4,500 systems, many carrying what he calls "mountains of legacy tech debt" from systems built 20 years ago, and they work with 40 asset owners across the business.
The Challenge: Overcoming Legacy IT & Compliance Documentation Bottlenecks
Before Paramify, Brown lived a documentation nightmare.
He once did a gap analysis at a role before CDW, where the SSP alone arrived at 250,000 words. Yes, Brown counted. This document was 10x longer than the assessment guide people already find hard to read.
"This is impossibly complex to operationalize," he says.
A "mega spreadsheet" tracked the rest, and nobody could answer the basic questions:
- What's our score?
- Where are we?
- What progress are we making?
The giant paperweight of an SSP covering changes to an agency’s zero trust program was little more than a point-in-time snapshot that Brown knew no one outside the meeting would ever touch.
"What kind of weird game are we playing?" he remembers thinking.
The documents were so long that just opening them could max out the RAM on a standard work laptop, and the format only got worse from there.
"Imagine if every time you had to do a code review, you had to read the whole code base. That's the way it feels when you're doing these SSPs in a doc."
Creating and maintaining these docs absorbed massive time and resources, without improving security. One change to a piece of evidence could mean opening 100 documents by hand. Gap analyses took months and a 10,000-hour consulting engagement.
Even a framework revision, like the move from 800-171 Rev 2 to Rev 3, would take about a full year creating what Brown calls a "bizarre change management problem."
The Solution: One Structured Source of Truth
Brown stumbled on Paramify looking for an OSCAL solution. Once he took a deeper look, he realized it kept solving problems he hadn't gone shopping for.
Live visibility into evidence
Stale evidence shows up the moment it happens.
The impact of a single stale artifact before Paramify had always been a guess.
Brown’s big aha moment came when one of CDW's documents went stale and all the affected controls turned red. When the team supplied the missing evidence, everything went back to green.
"That seems like a really easy tech win," Brown says, "but I never get to have that kind of clarity."
Automated evidence collection
Evidence updates on its own.
Evidence fetchers pull artifacts straight from source systems. Griffin Brownbuilt 50 of them in a day to capture account inventories across CDW's assets.
"I tried hard for a decade to be able to do that sort of thing and I couldn't, and now we got Paramify and now we can," he says. "It was a day's worth of work to solve that forever."
A queryable program
The whole program can be queried like data.
"Everything is structured and machine readable," Brown says.
"Our entire security program is queryable." When evidence changes, the affected controls update immediately, with no analyst hours behind them.
AI-assisted reviews, kept in-house
Reviews arrive as drafts, and the evidence never leaves CDW's environment.
Because the evidence is structured, CDW built a review workflow on top of it. A local AI server pulls the latest artifacts, drafts the review, and emails it to the system owner.
CDW securely runs the AI on its own hardware without sending it out into the cloud.
Brown says the draft's starting point "was better than any review we've ever had." And "we didn't need an engineering team."
The Results: Reduced Effort, Expedited Growth
100x Faster Reporting
The review process has changed dramatically for CDW. Brown puts the old effort at about 100 hours per review, covering evidence gathering, meetings, and drafting. Now the draft shows up as an email to the system owner and the owner edits it.
"It really compresses us down from 100 hours per review to about one".
CDW has 40 asset owners, each averaging about five reviews, so these savings compound across the whole program.
Instant Gap Analysis
Gap analysis changed the same way. It wasted up to 10,000 hours — literally. Now it's just continuous, Brown says. "Now we just immediately know, without honestly any hours."
Framework Transition in an Afternoon
Framework adjustments are also a non issue. Brown expects transitions like Rev 2 to Rev 3 that would have taken a year to be "an hour mapping exercise or an afternoon of mapping."
5x Faster Growth
Leadership saw the time savings as the opportunity to scale fast. “They were like, ‘Oh, well, great. We don’t want to save that time. We want you guys to keep stacking up wins for us.’”
As a result, Brown’s team doubled and its 10-year vision is now on track for about two, 5x faster than planned.
Advice for Teams Still Doing Security by Hand
Griffin Brown recommends starting with automated evidence gathering and choosing a tool that supports it, like Paramify.
“Otherwise you’re going to have to do 10 times more work to change all of that stuff,” he says, and once a program is in place, changing it gets harder.
.svg)
.svg)
