Partner guest blog: B-612

The Challenge of Supporting Global Infrastructure

Managing physical infrastructure—whether for server maintenance services, hardware lifecycle management, or infrastructure audits—requires not just skill, but also strategic reach. Companies hosting equipment across multiple data center facilities often struggle with two suboptimal approaches:

• Doing it in-house, which means hiring and managing staff in every region.
• Outsourcing to the data center usually comes with a hefty premium and limited flexibility.

Why a Dedicated Remote Hands Partner Is the Smarter Choice

A Remote Hands partner is not just an extra set of hands—they’re an extension of your operations. Here’s how the right partner creates real value:‍

1. Lower Global Operational Costs

Maintaining your own IT support presence at every location is costly. Salaries, compliance, training, and logistics quickly add up. With a dedicated Remote Hands provider:

• You avoid hiring in multiple jurisdictions.
• You reduce training and onboarding cycles.
• You gain access to skilled, pre-vetted engineers on demand.

This means your Managed IT infrastructure budget stays lean and predictable.

2. Better Value Than Data Center Services

While most data center facilities services do offer Remote Hands, these are often:

• Priced at a premium
• Limited in scope (e.g. no parts sourcing or logistics)
• Unfamiliar with your setup

A dedicated partner offers higher data center quality at a lower cost because Remote Hands is their core business—not a side service.

3. One Partner. One Process. Full Familiarity.‍

Working with a single Remote Hands provider means:

• Consistency across global sites
• Engineers familiar with your operational standards
• Reduced error rates and faster issue resolution

This partner becomes intimately familiar with your hardware, network topology, and escalation procedures—just like your internal team.

4. Faster Troubleshooting with Familiar Engineers

Speed matters when issues arise. With a dedicated partner:

• You get the same technicians working on your sites.
• They’re already trained on your stack and SOPs.
• They handle server maintenance services efficiently and proactively.

This level of knowledge enables smarter, faster resolution of complex problems.

5. Real-Time Communication with Your Team

Forget emails and tickets that sit idle. A modern Remote Hands provider integrates with your daily workflows via:

• Slack or Microsoft Teams
• Instant messaging, file sharing, and video calls
• Two-way communication with engineers in real time

For agile operations, this level of responsiveness is critical to project success.

6. Centralised Ticketing, Analytics, and Reports

A strong Remote Hands partner provides:

• A centralised system to manage requests
• Customisable reporting
• Operational insights into issue trends, SLAs, and costs

This supports better planning for infrastructure audits and hardware lifecycle management.

7. End-to-End Support Services—Beyond the Rack

Unlike traditional data centers, a full-service Remote Hands provider offers:

• Shipping and receiving management
• Local sourcing of parts and consumables
• Dedicated storage and inventory handling

This holistic approach gives you a true end-to-end solution, covering gaps that most data centers simply don’t touch.

Final Thoughts

If your business depends on physical infrastructure housed in multiple data centers around the world, the old models of support—DIY or relying solely on the local facility—just don’t scale. You need uptime, precision, and speed.

A dedicated Remote Hands partner delivers exactly that:

• One point of contact for all sites, simplifying coordination.
• Familiar engineers who already know your rack layouts, cable maps, and escalation paths.
• Real-time communication that fits how your ops team works—whether that’s Slack, Teams, or custom dashboards.
• Logistics handled—from receiving and staging shipments to sourcing parts locally and even warehousing your inventory when needed.

In other words, you’re not just outsourcing tasks—you’re extending your operational capabilities, globally and intelligently.

For businesses serious about data center quality, infrastructure uptime, and cost-effective global operations, a Remote Hands partner isn’t a luxury—it’s a must-have.

Whether you’re scaling infrastructure or maintaining legacy systems, this is the future of Managed IT infrastructure.

Ready to replace complexity with clarity? Choose a Remote Hands partner that works like an extension of your team.

From Racks to Recycling: A Secure and Sustainable Process for Retiring Data Center Equipment

At some point, every data center faces the same moment.

The hum of servers, once the heartbeat of your infrastructure, goes quiet. Cables are unplugged. Carefully configured systems begin their final countdown. While powering down and decommissioning equipment may feel like the end, for IT leaders, retiring data center equipment is just the start of a high-stakes, risk-intensive process.

What happens next isn’t as simple as flipping a switch or carting out old hardware. It’s a process that demands precision, planning, and a deep understanding of the potential risk. Missteps can lead to data breaches, regulatory penalties, reputational damage, and missed opportunities for value recovery. However, done right, data center decommissioning becomes a strategic opportunity to strengthen compliance, recover value, and align with organizational ESG goals.

This guide outlines the full lifecycle of data center decommissioning, with real-world questions you should consider before the job begins. These insights will help you prepare, avoid delays, and confidently execute your decommissioning strategy.

Download our handy Data Center Decommissioning Checklist

Phase 1: Shutdown Strategy – Building the Foundation 

Decommissioning begins at the planning table long before a single asset is unplugged or wheeled out the door. The planning phase lays the foundation for a successful decommissioning. When done right, this is where the process can gain strength and efficiency; when done poorly, the seeds of future complications are sown.

Picture this: an IT manager is told that a facility is shutting down in 60 days. Servers need to be cleared, racks dismantled, and all infrastructure gone. That’s tight but doable. What’s not immediately visible is the massive web of interdependencies—teams to coordinate, assets to tag, data to classify, and compliance obligations that don’t end when the servers shut down.

This is why a shutdown strategy matters. It’s not just about logistics—it’s about creating clarity. The goal isn’t just knowing what you have, it’s having a defensible, documented baseline for data destruction, value recovery, and compliance. The best partners ask tough questions—and help you confidently answer them.

You should begin with a complete asset inventory: servers, storage arrays, switches, racks, PDUs, cabling, and even small or obscure devices should be noted. You should also know:

• Who owns the equipment—your company, a leasing firm, or a third party?
• What exactly needs to be removed—and what stays behind?
• Who has the authority to approve work and sign off on completion?
• Can your vendor perform a site walk-through before the job begins?

These questions aren’t trivial—they’re operational guardrails that help your ITAD partner quote accurately, assign resources efficiently, and avoid scope creep. This is also where chain-of-custody planning becomes critical. 

You will want to help your vendor understand:

• Full site details, including access restrictions and parking
• Loading dock specs (consider questions like: is a dock plate needed? Is a freight elevator available? Is it a long distance from the equipment to the dock or staging area?
• Can the work happen during regular business hours?
• Who will handle facility access and escort requirements?
• Is broom sweeping or floor protection required?

Even the status of your racks matters: Are they bolted to the floor? Ganged together? Will they fit through doorways without tipping? The more details you can provide upfront, the fewer surprises later.

At this stage, risk classification is also very important. Not all assets carry the same weight. Some devices contain sensitive or regulated data—PII, PHI, financial information, or national security material. Others may be empty shells. With the help of a qualified IT asset disposition partner, it’s your job to identify what’s what based on data sensitivity and regulatory requirements. Using NIST 800-88 guidelines, some devices may qualify for secure reuse or resale, while others must be physically destroyed, shredded, or disintegrated beyond recovery.

Critical questions you will need to consider in partnership with your ITAD provider include: 

• Are data drives still in place? And what kind of drives do you have? (HDD, SSD, tape, mobile)
• Will on-site shredding or degaussing be required?
• How many drives will need to be destroyed?
• Which, if any, data-bearing assets can be redeployed, resold, or donated?
• Does the data destruction need to be witnessed by a staff member?
• Do you have an internal equipment inventory tracking system? 

And if value recovery is a goal, be prepared to share:

• Photos of the racks and assets
• Model numbers and serials for valuation
• An inventory list (or request help building one)

In addition to the considerations above, you also want to ensure that the IT asset disposition partner you choose comes to the table with more than a truck and a pickup date. Look for certifications demonstrating process maturity and alignment with any data privacy regulations you must comply with. 

• NAID AAA certification for on-site and off-site data destruction services. 
• ISO 9001, 14001, 45001 certifications 
• R2v3 certification for environmental regulations
• DLA/DOT clearance for secure transport
  

You should also understand how your ITAD vendor approaches Inventory tracking. An accurate inventory list isn’t just helpful—it’s defensible. In a post-project audit or compliance review, the ability to trace every asset from rack to final disposition protects your team and your organization. When choosing an IT asset disposition (ITAD) vendor, ensure your vendor uses advanced and accurate inventory tracking to account for every asset at every stage of the decommissioning process. Also, understand how long it will take to access your inventory reporting.  The best ITAD vendors will provide detailed inventory lists and certificates of destruction within 72 hours of job completion, but some take months to provide this information.  It’s also a plus if you can access your project information 24/7 via a client portal. 

The most successful decommissioning projects treat planning as a risk-reduction strategy, not just a task to check off. By taking the time to map every move before it happens, IT leaders avoid the most common pitfalls: misplaced assets, data leaks, project delays, and unexpected costs. In short, this isn’t just the shutdown phase—it’s the blueprint for everything that follows. 

Phase 2: Secure Data Destruction – Eliminating Hidden Risk

By the time your racks are empty and devices are staged for removal, the most visible parts of decommissioning may feel complete. But the real risk often lies inside the devices you can no longer see—in residual data tucked away in hard drives, flash storage, network devices, or embedded systems.

Data doesn’t disappear. It lingers in unexpected places: a forgotten backup device, a customer list stored on a decommissioned firewall, an admin password cached in a printer. Even a single overlooked drive can trigger compliance violations or reputational damage. That’s why secure data destruction is not a step to gloss over. It is the beating heart of any decommissioning project.

The best ITAD vendors provide:

• NIST 800-88–compliant wiping for resale-ready assets
• Degaussing for magnetic media
• Shredding or disintegration for SSDs and high-security environments
• NSA-approved equipment with documentation
• Ability to witness destruction 
• Documented destruction with easily accessible Certificates of Destruction

The primary standard for media sanitization is NIST 800-88, and any reputable ITAD partner should follow it and build their destruction methods around it. That starts with understanding the different types of drives and devices in your data center—HDDs, SSDs, flash-based systems, legacy tapes, and the kind of content stored on those devices and drives, and matching each to the appropriate data sanitization method.

Compliant software-based data wiping works well for hard drives designated for reuse or resale. This method overwrites every sector of the drive and verifies success before generating a Certificate of Destruction. However, not all assets are deemed good candidates for reuse. For those, physical destruction is deemed the better option.

Degaussing is a physical destruction method effective for magnetic drives, disrupting data through powerful electromagnetic fields. However, it has no effect on SSDs. That’s where shredding or disintegration comes in. Shredding devices to industry-standard particle sizes ensures that no data can be reconstructed. Disintegration goes even further, especially for small-form-factor devices such as flash or SSD cards, turning them into dust-sized fragments that render data utterly unrecoverable.

An experienced ITAD partner will not only offer all of these services—they’ll also know which to recommend based on your assets, data classification, and compliance needs. They should use only certified equipment and document every destruction event, preferably with advanced inventory techniques, and provide the option for on-site or off-site services, depending on your risk tolerance and logistics.

Data destruction is often the most invisible but consequential phase of the decommissioning journey. When it’s done right, no one notices. When it’s done wrong, everyone will.

Phase 3: Value Recovery, Redeployment, and Donation – Extending the Life of Your IT Assets

While some assets are destined for destruction, many still have value to offer, and smart organizations know how to capture it.

This phase is about more than maximizing financial return. It’s about making the most of what you already own. That might mean reselling equipment with market value, redeploying it within your organization, or donating it to support social impact and ESG goals. The key is knowing what to do with what you’ve got.

For assets that retain resale value, your ITAD partner should offer fair-market appraisals and revenue-sharing models that return real dollars to your bottom line. Don’t settle for vague quotes or hidden fees. Transparency is key, especially when tying recovered value to sustainability goals or budget reporting.

Some assets may be more useful within your own walls than on the secondary market. Internal redeployment is an excellent strategy for extending the life of hardware in non-critical roles, such as QA environments or training labs. Your IT asset disposition vendor should help facilitate safe sanitization, reinstallation, and the transport of refurbished assets back to your organization.

Then there are the assets that, while no longer commercially viable, are still perfectly functional. Donation isn’t an afterthought—it’s a strategic lever for social impact and ESG alignment. Donating equipment to vetted nonprofit partners, schools, or global digital equity initiatives creates measurable social impact. It aligns with ESG frameworks, boosts your organization’s CSR profile, and puts useful technology into the hands of those who need it most.

A standout example comes from a recent project where refurbished laptops were donated to communities in Chad and Cameroon. After undergoing certified data destruction and refurbishment, these devices now support education, healthcare, and digital literacy programs—bridging the digital divide and giving legacy hardware a powerful second act.

Whether it’s dollars back to your budget or value to the community, this phase is about turning retired assets into new opportunities. Ensure your ITAD partner has the experience, network, and documentation to make it happen securely, transparently, and responsibly.

Phase 4: Responsible Recycling – Closing the IT Lifecycle Loop

When reuse, resale, or donation aren’t viable, responsible recycling becomes the final—and critical—step.

This is where sustainability and compliance intersect. Improper disposal of IT equipment doesn’t just harm the environment; it can also put your organization at risk of fines, public scrutiny, and missed ESG benchmarks. Electronics contain hazardous materials like mercury, lead, and cadmium—substances that must be handled properly to avoid polluting soil, water, and communities. EPA Guidelines recommend that your ITAD partner be R2v3 certified, which confirms their commitment to responsible downstream recycling, environmental compliance, and worker safety. But certification alone isn’t enough. They should offer complete transparency into where your e-waste ends up, maintain detailed documentation, and ensure that all downstream vendors meet the same high standards.

Responsible recycling isn’t just the right thing to do; it’s a brand protection strategy. In a time when consumers, investors, and regulators are paying close attention to sustainability practices, what your organization does with its retired IT equipment matters. ESG commitments only matter when backed by verifiable action and documentation. Closing the loop with sustainable recycling shows you’re serious about minimizing waste, maximizing reuse, and protecting both people and the planet.

Phase 5: Reporting & Compliance – Turning Documentation into Peace of Mind

If you’ve followed the steps above, you’ve reduced risk, recovered value, and upheld sustainability. But none of it counts unless you can prove it.

That’s why comprehensive reporting and compliance documentation are any decommissioning project’s final—and arguably most important deliverables. When assets are retired, data is destroyed, and materials are recycled, you need audit-ready evidence at your fingertips.

This is especially critical for organizations governed by data privacy and industry-specific regulations: HIPAA and HITECH in healthcare, GLBA and FFIEC in finance, SOX for public companies, FISMA and NIST for federal contractors. Compliance isn’t optional—it’s a mandate, and your ability to demonstrate conformance can mean the difference between smooth sailing and a regulatory nightmare.

Your ITAD partner should provide Certificates of Destruction, detailed asset tracking from pickup through final disposition, and access to secure portals for real-time status updates and downloadable reports. They should be familiar with your regulatory landscape and able to deliver documentation that satisfies not only your compliance team but also your legal, procurement, and finance stakeholders. 

Equally important is timeliness. Reports delivered weeks after the fact do little to help you during a surprise audit or board meeting. The gold standard: accurate, complete reports delivered within three business days.

In short, documentation isn’t paperwork. It’s protection. It’s assurance. It’s what transforms a completed decommissioning project into a verifiable success.

From Decommissioned to Done Right

Retiring data center equipment isn’t just a logistical task. When managed thoughtfully, it’s a strategic process that can strengthen your organization’s security posture, regulatory standing, sustainability performance, and bottom line.

For IT managers, this means looking beyond just powering down. It means partnering with an IT asset disposition provider that brings transparency, accountability, and expertise to every phase—from initial planning to final reporting. When you work with the right partner, you don’t just decommission equipment. You retire it with confidence, integrity, and purpose. Learn more about creating an RFP for your ITAD Vendor in this article. 

Because the next chapter of your infrastructure starts with how you close this one.

Download our handy Data Center Decommissioning Checklist

Don’t Destroy—Wipe and Reuse: Why Secure Data Erasure Is the Smartest First Step in IT Asset Value Recovery

Protect Data AND Maximize Value

Retiring end-of-life laptops, desktops, or servers? Your two priorities are clear: protect sensitive data and recover maximum value from those assets.

Securis helps you do both.

Securis performs certified data erasure using industry-leading tools like Blancco, fully compliant with NIST 800-88 guidelines, so you can wipe, reuse, and remarket with confidence. This allows your business to wipe data while preserving the device’s functionality securely, so it can be resold, redeployed, or donated.

The result? A secure, compliant, and sustainable device redeployment strategy that protects your organization while unlocking additional value from your technology investments.

Why Software-Based Data Wiping Is Secure—and Securis Makes It Certifiable

Simply deleting files or reformatting a hard drive leaves your data exposed. At Securis, we go further, with verified software-based data wiping that sets the stage for IT asset remarketing or internal reuse. That’s why we use NIST 800-88 compliant data sanitization software proven to render all data completely unrecoverable. Our approach ensures peace of mind when engaging in the resale of used corporate laptops or donating your used devices to non-profit entities.

We don’t expect you to just take our word for it. Our erasure software:

• Is certified by over 15 global bodies, including Common Criteria, NCSC (UK), and BSI (Germany)
• Meets or exceeds standards set by HIPAA, GLBA, SOX, HITECH, and other data privacy regulations
• Produces a tamper-proof Certificate of Data Erasure for each device—critical for compliance and internal audits
• Supports secure resale and redeployment of equipment for value recovery and ESG alignment

This process ensures complete data security and an unbroken chain of custody, delivered by Securis technicians at your site or in our secure facilities.

Reuse: The Smart Way to Maximize ROI and Reduce Waste

When hard drives are securely wiped, devices don’t have to be shredded. That opens the door to:

? Resale Value

Through our IT asset remarketing program, wiped devices can be resold as refurbished corporate-grade equipment. Many of our clients recover value from retired IT assets that would otherwise go to waste, often offsetting the cost of new technology investments.

? Internal Redeployment

With secure IT equipment reuse, your organization can safely repurpose devices without risking data breaches.

❤️ Device Donation: Extend the Life—and the Impact—of Your IT Assets

When devices are securely wiped and certified, they can safely be donated to organizations in need, creating powerful opportunities for community impact.

At Securis, we’ve seen firsthand how secure device donation can change lives. One standout example is a partnership with Avalara, which donated hundreds of retired devices that were refurbished and shipped to underserved communities in Africa. These laptops are now being used in schools, job training centers, and nonprofits, helping to bridge the digital divide and unlock opportunities that didn’t exist before.

? Read how Avalara’s IT donation is transforming lives in Africa

With Securis handling the secure data erasure and logistics, Avalara’s team had peace of mind knowing their data was completely destroyed, and their devices were going to a worthy cause.

Secure device donations align with Environmental, Social, and Governance (ESG) and Corporate Social Responsibility (CSR) programs, while ensuring your data stays protected and your retired devices are put to impactful, sustainable use.

Securis: A Trusted Partner for Secure and Sustainable ITAD

From government agencies to Fortune 1000 enterprises, organizations across regulated and commercial sectors rely on Securis to handle their retired IT equipment securely and responsibly. Here’s why:

• ? Security-first approach: All staff are background checked and trained in secure data handling procedures
• ✅ Verified processes: Our operations follow strict chain-of-custody protocols and generate complete audit documentation
• ? Sustainable outcomes:  Reduce e-waste with sustainable device redeployment and responsible recycling
• ? On-site or off-site service: We come to you or securely transport equipment to one of our regional processing centers
• ? Certified and compliant: NAID AAA, R2v3, and ISO 9001 standards backed by third-party audits

Securis doesn’t just wipe drives—we enable resale-ready IT asset recovery that’s secure, accurate, and aligned with your company’s sustainability and compliance goals.

Let’s Talk About a Smarter ITAD Plan

Certified hard drive wiping for resale isn’t just a checkbox—it’s a smarter, more sustainable way to manage IT asset disposition.

With Securis, you can:

• Ensure compliance with industry regulations
• Protect sensitive data with verified software wiping
• Recover value from retired IT assets through resale, redeployment, or donation
• Build a sustainable ITAD strategy that meets ESG and financial goals

Ready to turn retired IT into recovered value—without compromising on security?
Talk to Securis about a secure, compliant, and value-driven approach to IT asset disposition.

Mergers and acquisitions (M&A) are transformative events, offering immense opportunities for growth, market expansion, and innovation. However, beneath the promise of synergy lies a significant, often underestimated, threat: data security. For buyers and sellers, an M&A transaction exposes a company’s most sensitive information to new vulnerabilities, making robust cybersecurity and diligent IT asset disposition (ITAD) a non-negotiable component of any successful deal.

The M&A process inherently involves the exchange of vast amounts of confidential data – financial records, intellectual property, customer databases, and employee information. This heightened data flow and the integration of potentially disparate IT infrastructures create ripe conditions for data breaches and security lapses. Overlooking these risks can lead to catastrophic consequences, including hefty regulatory fines, reputational damage, and significant financial losses that can easily eclipse the deal’s value.

Past Breaches: A Stark Reminder

To understand the gravity of these risks, one only needs to look at prominent M&A-related data breaches:

• Verizon and Yahoo (2017): Before Verizon completed its acquisition of Yahoo, the internet giant disclosed two massive data breaches from 2013 and 2014, impacting 1 billion and 500 million user accounts, respectively. The discovery of these breaches, which occurred before the deal closed, led to a $350 million reduction in the purchase price. This incident was a stark lesson in the critical importance of thorough cybersecurity due diligence.
• Marriott and Starwood (2016/2018): Marriott International’s acquisition of Starwood Hotels & Resorts in 2016 was intended to create the world’s largest hotel chain. However, two years later, Marriott discovered a breach that had persisted in Starwood’s reservation system since 2014, affecting up to 500 million guests. Marriott faced significant fines2 (including an intended £99.2 million by the UK’s ICO) and immense reputational damage due to this inherited vulnerability, with the ICO explicitly stating Marriott “failed to undertake sufficient due diligence when it bought Starwood and should also have done more to secure its3 systems.”
• T-Mobile and Sprint (2020): Following their merger, T-Mobile experienced a significant data breach affecting over 54 million individuals. This incident highlighted the immense challenges involved in securing customer data during extensive network integration processes, where disparate systems can create new, exploitable weaknesses.

These cases underscore a critical point: data security isn’t just about protecting your current environment. It’s about meticulously assessing an acquired entity’s security posture and securing your assets as you divest or integrate.

The Indispensable Role of ITAD in M&A Security

This is where a specialized IT Asset Disposition (ITAD) partner like Securis becomes an invaluable ally in a holistic security and due diligence process. M&A activity often involves decommissioning old equipment from both the buyer and seller, consolidating data centers, retiring legacy systems, or shedding redundant assets. Without a certified, secure ITAD process, this equipment can become a treasure trove for malicious actors.

Here’s how Securis partners with companies navigating M&A to mitigate data security risks:

• Secure Data Destruction: Mergers often mean redundant hardware. Whether it’s servers, laptops, or mobile devices from the acquired company, or your own equipment being phased out, ensuring complete data erasure is paramount. Securis employs NSA-approved degaussing and shredding technologies and NIST 800-88 compliant data wiping to guarantee that sensitive data on retired assets is irreversibly destroyed, leaving no trace for potential exploitation.
• Comprehensive Due Diligence Support: While legal and financial teams conduct due diligence, Securis can provide a crucial layer of ITAD-specific assessment. This includes evaluating the target company’s existing IT asset management and disposition practices, identifying potential hidden liabilities from improperly retired equipment, and ensuring all data-bearing assets are accounted for
• Chain of Custody and Audit Readiness: The M&A process demands meticulous documentation. Securis provides a transparent, audit-ready chain of custody for all IT assets, from collection to final disposition. Detailed inventory reports and certified Certificates of Data Destruction are accessible 24/7 through our client portal, providing irrefutable proof of compliance with data protection regulations like HIPAA, GDPR, and SOX. This level of accountability is vital for demonstrating responsible data handling during and after an M&A transaction.
• Minimizing Environmental and Reputational Risk: Beyond data security, proper ITAD ensures environmentally responsible e-waste recycling. Securis is R2V3 certified, meaning we adhere to the highest standards for responsible recycling, preventing hazardous materials from entering landfills and protecting your company’s brand reputation from environmental liabilities.

Don’t Let Your Next Deal Become Your Next Breach

The complexities of M&A demand a multi-faceted approach to security. While legal and financial aspects are critical, the vulnerability of data during these transitions cannot be overstated. Proactive engagement with a trusted ITAD partner is not an afterthought; it’s a strategic imperative. By incorporating secure IT asset disposition into your M&A due diligence and integration plans, you can protect your company from crippling data breaches, regulatory penalties, and reputational damage.

If your company is contemplating or undergoing an M&A transaction, ensure your data security strategy is comprehensive and robust. Contact Securis today to learn how our expert IT asset disposition services can become vital to your holistic security and due diligence process.

Interview with Senior Security Engineer and Cybersecurity Expert Greg Witte of Palydin

About Greg Witte

As a Senior Security Engineer for Palydin, Greg Witte supports federal and commercial clients, primarily within the National Institute of Standards and Technology (NIST) IT Laboratory and  U.S. Department of Homeland Security (DHS) Continuous Diagnostics and Mitigation  Program (CDM). In more than 30 years in the Information Security arena, he has helped to build and improve multiple enterprise frameworks, including the NIST Cybersecurity, Privacy, and Workforce frameworks; ISACA’s COBIT model; and the Baldrige Cybersecurity Excellence builder. Drawing upon that expertise, he helps organizations to better integrate cybersecurity risk considerations into enterprise risk management activities.

Helpful Links:

IAITAM

Palydin

Greg Witte

TRANSCRIPT OF DISCUSSION: 

KURT: Good afternoon. Greg,  How are you?

GREG: :  I’m doing great, Kurt, other than a minor thunderstorm passing by. But things are good here.

KURT: All right. Well, glad you are safe. I heard there was a little bit of, hail. I understand that you’re a little bit south of the, Annapolis area, just outside of Washington, D.C.. Thanks for joining me today.

GREG: :  Oh, thanks for having me. Awesome.

KURT: So, for anybody who might not know me, my name is Kurt Greening. I work for a company called Securis, and we are in the business of helping government agencies, government contractors, also regulated industries like banks and health care, remove data from end of life electronics and then recycle them in an environmentally responsible way. So, I’m glad that I have GREG:  Witte here, joining me. He works for a company called Palydin, and Greg supports, a bunch of federal clients, but also has some commercial clients. Most people who have listened to us in the past would know about, National Institute of Standards and Technology or NIST. In the past, I’ve talked about standards like NIST 800-88. GREG:  has also worked with, DHS, a program called Continuous Diagnostics and Mitigation, or CDM, and actually been an information security for more than 30 years. Been a part of tons of cool projects. He’s, built some models and frameworks. We may talk a little bit more later about his work with a security organization, known as, ISACA. But, I will at the end of the show, maybe let people know how they can, reach out to you, Greg . Because yourself and your company, you know, you help people, at least my understanding is better integrate cybersecurity risk considerations, into enterprise risk management activities, which for me, I understand that, you know, the opportunities or the threats are growing and so it’s super important to have, people like you, keeping our way of life, safe and protecting us from cyber adversaries. So, Greg , again, thanks for joining us.

GREG:   Thank you. Yeah. Ready to help? Anytime.

KURT: Awesome. So, you and I. GREG: , we originally met, out in Las Vegas at a conference, known as ACE, which is the yearly conference from the International Association of IT Asset Managers. And I understand that you’re pretty active in that, organization. I think you may even, teach some classes besides, volunteering at their conference. Tell me what interested, you about that organization.

GREG:  Oh, thanks. Yes. Usually what’s what happens in Vegas stays there. But we’ve met in Henderson, so it’s a little bit outside the strip. We can talk about it. Yes, exactly. Now, I’ve been really fortunate to work with ITAM for going on a decade now. If you look at security controls, if you download any of the controls frameworks, you’ll see that they always start with asset management, and that’s for good reason. You know, we all know you can’t secure or even really manage your asset. The resources that companies depend on so heavily, unless you know what you have and where it is and what is being used for. So for that reason, IT asset management really is the hub, or at least from an IT and a OT perspective for the whole organization. So good security begins with good asset management. 

So I got to know, Dr. Barb and the team at ITAM long ago. And yes, as we talk more and more about security, and as I got to know their certification programs, particularly their camp C program that focuses on asset management, security. It really helps us to understand, you know, exactly where that asset management piece fits. And they also do a really good job of thinking about the total cost of ownership better than most organizations I’ve seen. If you think about, for example, you know, think about what you were saying Kurt, about Securis. 

You know, we know even when we first purchase a laptop, that there’s going to come a day when I’m going to need your team to help me to basically decommission that device and maybe even, do some work to make sure that you’ve disposition the drives correctly. We know there’s going to be a cost. So we should be thinking about that cost even when we first requisition it or when we, you know, have our moves and adds and changes. 

So we should be thinking about that in advance. And you should be thinking about the patching and the updates and the licenses and the training. You know, there’s a total cost to that, and ITAM does a good job of helping us to think about that, to make sure that, you know, both from a good business standpoint and from a risk management standpoint. We need to be thinking about, really, the total lifecycle of that ownership, including, of course, good disposition. So that’s that was how we got involved. And it’s, really exciting to be kind of looking at where that those circles of the security and IT Asset management really overlap quite heavily.

KURT: Yeah. So International Association of I.T. Asset Managers is, I think, a wonderful organization. Anybody that gets involved in asset management, I would recommend that they join. I’ll try to post a link in the in the show notes. But GREG: , you know, I talked about you being a cyber guy and being in cybersecurity for 30 years. We talked about IT asset management being one component of cybersecurity. But tell me, how did you get into cybersecurity?

GREG:   Yeah, it’s true. The gray beard is real. Yeah. I started out, even just straight out of high school, working in factories, building computer equipment and networking equipment. I’d always played with networks and, you know, amateur radio as a kid. So for a while I was working in factories, building networking equipment. And one of my customers in the federal government, they had one of our, you know, one of the early internet working routers. They called us up and said, hey, your router is broken. 

So we went out with our tool kit, and I went out there with my packet sniffer and said, my router is fine, your network’s broken. No, my networks on your routers broke, went back and forth a little bit, and it turned out to be one of the very early federal security bugs, on the the brand new, you know, shiny new thing called the internet. I think they were in the process of moving from Arpanet to internet. But at the time, the networking company that I was supporting was starting to go out of business. 

This little upstart company called Cisco was starting to come out, and, and they were obviously Ethernet was growing. And, you know, this security thing seemed kind of interesting. So I said, maybe I’ll try that for a while. Of course, that was 1993. And we’re we’re still going. But it was a good intersection of my networking and the Unix side of things. One of the things I love about security and cyber in general is that, you know, you can, you know, the things that we do, the things that you and I do, goes all the way back to George Washington. 

You know, you think about the Revolutionary War and some of the biggest battles were lost because somebody didn’t properly secure their their resources, and they didn’t have Securis at the time to shred their plans, their war plans. But, you know, you can have that solid foundation, and yet it’s always changing. 

I was at a meeting with, with Securis just yesterday talking about innovations in AI and how we can be doing that, you know, the next steps. We were talking, you know, about how do we better secure AI in our asset resources that are based on artificial intelligence. So it’s it’s always changing. And yet you’ve got that solid foundation. So it’s it’s always exciting. It’s not always. Well, it’s not always exciting, but it’s never boring. Let me put it that way.

KURT: Yeah. No, I mean, we’re seeing AI, drive a faster refresh cycle around hardware assets. Most agencies and a lot of, health care organizations that I work with are scrambling to get rid of devices that aren’t going to support Windows 11 and the AI resources. So that’s, you know, AI’s a big thing and all aspects. It’s a big thing for, you know, for businesses, for improving, citizen services and government. But also causes some challenges around, IT asset management. 

So I when I made the intro to you, I talked about this organization, called NIST, and, not everybody knows what NIST does, but, we’re not going to maybe share everything that they do because what they do is pretty broad. But yeah, focus a little bit on, you know, maybe you can tell, you know, generally what they do. But really, how does NIST help improve cyber security. And I understand it’s not just for government agencies but, you know, even you know, banks and hospitals look at NIST and say, hey, what is the best practice for securing my organization?

GREG: :  Oh, yeah, it’s a wonderful organization and I’m fortunate I’m a contractor there. So I can’t you know, I’m not a government employee, but I can speak about them since I’ve been working with them going on 15 years, which is a great place for me to be. NIST was actually born in 1901 as the National Bureau of Standards. It was their job to help kind of make sure that, you know, when you buy a pound of something that it actually was a pound and that same thing, lengths and measures, all kinds of things. 

But, the great example where they are today, you can go back to 1904. There is a large fire, just not far from where you and I are sitting up in Baltimore. There was a huge fire in downtown, and they had fire companies came from all over the East Coast to help put out the fire, but they found out that the hoses didn’t couple the hydrants, you know, didn’t work together. They had all the equipment, but it didn’t work together. And it ended up, you know, I think, you know, something like a thousand buildings burned down because they couldn’t respond quickly enough. 

So that kind of opened their eyes to the notion that in addition to making sure that we have consistent weights and measures, we absolutely had to better support interconnectivity. The stuff’s got to work together. And that’s where NIST really shines. Today they’re the National Institute of Standards and Technology, as you said, and much of their work has to do with making sure stuff works together. They’re not going to tell us what to do with, each second of our day, but you know that you can tune your clock to the National Bureau of Standards and the NIST clock, and you know what time it is. It’s the same way for information security.

You know, the conversation we’re having now is encrypted through encryption methodologies that NIST has reviewed and approved. And that way, we know that our tools can talk together. It’s the same thing with networking, and of course, that’s true with other elements of security. They don’t tell us what the security plan should do, but they’ll give us a catalog of security and privacy controls so that we can agree together on how we’re going to interoperate from a security standpoint.

And that’s really what we do. The main part of what I love working on is on the frameworks, as you said earlier, and the one that I’m mostly focused on is called the Cybersecurity Framework, which basically is just based on five simple functions. If you can identify what matters, then you can do what we need to do to protect it from the known knowns, hopefully very quickly detect what we need to detect in our monitoring role and then respond and recover quickly. So we released that framework in 2014 and in 2024, we just updated that to version 2.0. 

We added a whole governance function to kind of go around that, because we found that, you know, we can do all the protection and detection we want to, but we need a governance aspect of it to really drive our strategy to understand, you know, what do our stakeholders expect from a risk management perspective? How do we instantiate that through policies and oversight? And we also added a great deal of information there about supply chain. Your listeners, I’m sure are focusing heavily on supply chain risk management, especially for information and operational technology.

You know, we depend more than ever on external apps. The conversation we’re having is using, you know, something as a service everywhere. We’re depending on these external apps and partners. So we need to do even more than ever to manage the risk to and from those partners to make sure we’re doing the right things the right way. And again, that’s back to that interoperability. 

So, you know, you know from your work, Kurt, in the in the things that you’re doing, you know, some of the data that you can all you have to do is just format the drive and go on about your day. And there’s other data that’s stored like health care or other, you know, sensitive data where, you know, you want somebody to erase that drive and that’s smashing into pieces, and then toss those pieces into the volcano and Mordor. You know, there’s some information that’s just absolutely got to be well protected.

And part of our job in risk management is to understand, you know, which are the crown jewels, and how do we make sure the right things are well protected. So that kind of goes back to what we do at NIST, where we can’t tell you what to do. Much of what we, you know, would want to build into our plan kind of depends on different context and different factors. But we do provide a ton of frameworks and guidelines to help, you know, like the AI we were talking about, you know, our recent work in the AI risk management framework, combined with the cyber framework, that type of thing that that really helps us to work together with our colleagues to see, you know, how do we categorize it? What should we be doing next? How should that work?

One last piece I really love about the work at NIST is the Workforce Framework. So many of the controls and you go through the international standards, and they’d say that, you know, somebody should do these following activities, but they didn’t really focus on the who. And that meant it’s difficult to teach people to hire people to promote people, to understand where we may have some skills gaps. We weren’t so focused on workforce. And I know as a parent, if I say, hey, somebody should lock the door, who’s going to lock the door? Well, nobody, if it’s not actually assigned to a particular role. So, we’ve been working now for, I guess going on ten years about how do we better describe the workforce, the work roles and the tasks and the skills and the knowledge that the people have. And that’s turned out to be really helpful for helping people understand, you know, what they should learn, how they should apply it, and what tasks need to be done. So it’s been really exciting.

KURT:  Yeah, right. That’s helpful. In my house, my wife says somebody should do the dishes, and I think she’s just decided that somebody should be me. So I’m very helpful in making sure the right people will take care of. 

GREG: So that role has been defined and assigned and it’s overseen, I’m sure. 

KURT: Awesome. So we learned a little bit about NIST, which is great. I knew about the Baltimore Fire. But I didn’t know the history behind, why it was so bad. So that was, super helpful. So let’s talk a little bit more about a federal agency. The Department of Homeland Security, parts of Department of Homeland Security have been in the news, recently, more around, like Border Patrol and ICE that, you know, that’s been. But but other people might not be aware that, you know, besides securing our borders and, making sure that, we’re tracking who’s, in our country, DHS does a lot to secure, critical infrastructure. And I also understand that, they have a role through, the Congress and OMB to report back to Congress on how federal agencies are doing from a cybersecurity posture management perspective. So, yeah, I understand that this this CDM program or continuous diagnostics mitigation program helps with some of those things. Can can you tell me a little bit more about that?

GREG:  Sure. And that takes us right back to asset management. Yeah. As you said, in particular, I support the CISA, which is the Cybersecurity and Infrastructure Security Agency, which, as you said, is a component of DHS, the US Department of Homeland Security. It’s, you know, if you think about so much of our nation depends on critical infrastructure. You know, we saw just what happened in Europe just a few weeks ago, where whole sections of the country went down. Now, in that case, you know, you never know which is a cyber attack and which is just the nature of the the flexible power grid. But, you know, so much of our nation is very dependent on that critical infrastructure, our water sector, power, you know, making sure that, like you said, our health care and financial systems are sound and reliable. 

So CISA’s job is to help monitor those infrastructure components, including the government side, state, local and federal government agencies can get help from CISA. And CISA is there to help to provide advisories on new types of risks that are happening. They put out, lists of key vulnerabilities that the bad guys are exploiting. And part of our program there that that I support is the continuous continuous diagnostics and mitigation program CDM, which started out as an asset management program. 

Really… as you know from your work in ITAM, first thing you need to know is what’s on the network, right? So it started out as an opportunity for federal civilian agencies at least to be able to load agents and understand, you know, what are the devices, including IOT, operational technology, other cyber physical systems. What exactly is on the network? And they they’ve built a huge database that they use to do asset management, including, you know, they use with with new assets coming in as those, those move and add and change within the organization. 

And in fact, we do track the disposition of those resources once they reach their end of life. And then, you know, besides just knowing what’s there, we also keep track of what vulnerabilities the vulnerability scanners have found. They’ve got a threat hunt team that keep track of what they see. You know, just provides a visibility capability for the federal government so that they can see what’s happening. They can inform, you know, the agencies have their dashboard, the ECS cyber team that I support, provides agency level dashboards, federal level dashboards, maybe someday even state and local dashboards for, for those entities. But we provide visibility into that IT asset management so that organizations can see what’s on the network, who’s on the network, what’s happening that supports continuous monitoring for any threats and vulnerabilities that seem to be emerging, and then it helps them to have a better understanding of that, that bigger picture.

You mentioned one of my loves as enterprise risk management. You know, a lot of organizations focus at the system level, and that’s vital. But we also sometimes need to take a step back and see, what does this mean about our whole organization. So, you know, this way we can do both. We can go all the way down to a device, we can look at it as a system, as an agency, and as an entire, federal civilian, executive branch, for example.

KURT:  Yeah. I mean, interesting. I think, Greg, you and I have a mutual friend, GREG:  Crabb, who you may have worked with, at CISA and, and other places. I have Greg , on and interviewed him around third party risk, a few months ago and IT asset disposal companies. He talked about, what has gone wrong in the past and the results and the fines, but he also talked about some of the best practices. And then, his company developed a risk assessment for vendors, like Securis in the IT asset disposition space, because it turns out, a lot of them could do better. When it comes to, following, best practices. So if anybody wants to check that out, they can.

GREG:  Yes, I in fact, I just saw Greg a few days ago. He and I first worked together. He and I were reminiscing that our first work together was at the Postal Service back in the late 90s. So. Yeah, it’s, like I said, it’s it’s exciting and in, in many ways, you know, in some ways it’s the same. And in some ways it’s always changing. We hadn’t even dreamed about what AI could be doing these days, but yeah, that’s part of the fun. It’s a very small town. And, he and his son, I enjoyed the interview that you did with them not long ago.

KURT:  Yeah. That’s great. So, Greg, what’s something you’re passionate about in terms of improving cybersecurity posture of government or even, you know, critical infrastructure that might be run by local governments or even, you know, power companies or, or financial institutions. What are some of the things if somebody, you know, executive team brings you in and say, hey, Greg, we’re worried about cybersecurity. You know, and talking to our CISO,, the the list is long. Well, what are things that you tend to look for early on and you’re passionate about trying to help people improve?

GREG: Well, one of the things that I’ve been doing a lot of work on, which is, risk measurement has been really challenging. One of my early mentors was a fellow named Jack Jones, who went on to create, for a methodology called FAIR, which many of your listeners may have seen. It, you know, we currently see in many of the places I go, even today, you know, I’ll ask to see, you know, do you have a risk chart? 

Do you have a register of your risks that you use to figure out what scenarios might happen and how likely they are, and for many of them, they still just rank their risk as low, moderate or high or red, yellow, green, or they use some sort of measure like that. That’s very qualitative and it’s really hard to not only is it hard to sort your risks just for cyber, but it makes it even harder when you’re trying to compare cyber risk with market risk and labor risk. And one of my customers is even, you know, dealing with Brexit risk. 

You know, there’s there’s so many different risks in the risk universe that an organization has to deal with. And it’s it’s not really always helpful when all you have to go on is low moderate, high at best. So what we’ve really been pressing is the fact that we can do a better job of quantifying the risk. You can come up with a range. We can say that I know, I know what it costs to go down for a minute or an hour or a day. You know, you can go back and calculate for a particular business system or application. 

This is what it would cost us if we didn’t have access to that. Or better yet, this is what we have to make sure we continue to have access to. This is what must go right, so you can figure out the value of your different resources and assets. And based on that, now we can go back and think about what are the threat sources that might jeopardize those. We can think about the factors. It’s not just, you know, threat or not threat. It’s not binary. But we can say, you know, just like we would with our house as well. 

You know, we’ve got a fence and that helps. We put up a sign in the front that might deter an adversary. We can think about, you know what? We have of value. That’s there within that house. So we can start to think about not just we have a threat or we don’t have a threat, but what’s the likelihood that a threat would occur? What would be the things that we could do to decrease the frequency of access by that threat actor? 

We can think about the vulnerabilities that they might exploit or the preexisting conditions. You know, right now with this thunderstorm, I’m about a block off the Chesapeake Bay. So I’m thinking about the flooding and the warnings that they’re giving me about the floods that may occur. You know, we can think about, a true range. We can start to think about percentages and I can say, all right, looks like there’s a 43% likelihood. 

Based on the past five years experience, we can actually calculate the likelihood that a flood would occur in my neighborhood. And based on that, I can think about what IT resources might be jeopardized by that flood. And we can actually start to go from, you know, red, yellow, green to an actual exposure, even a dollar sign exposure cost to say, all right, if this went down for an hour, it would cost me a million bucks. There’s a 13% chance it would happen. So now we can start to calculate real dollars and they can use that for a trade off. 

So really all I’m getting at is there’s so much more data that’s already available to us to do a better job of estimating and modeling the, the actual potential risk exposure that we have and the impact that would happen if a scenario were to take, take hold. And I think, you know, enterprises have an opportunity to kind of go from, yeah, it feels like moderate to me, to actually thinking about, a range of cost exposure that they have that will help them to do better for planning and executing a cybersecurity program for both their critical resources and in overall enterprise risk.

KURT:  Yeah. That’s great. Greg, so if somebody is listening out there and has heard, okay, great. So yeah I would like to better quantify my either cyber or my enterprise risk. And I’m thinking about these assets that, that, that I have, these IT assets and, and potential threats or vulnerabilities and they feel like, hey, I want help, Greg.  Sounds like, he he knows what he’s doing. What are ways people can can reach out to you? Would you recommend, you know, do you answer LinkedIn messages from people or your website? Or what can I put in the show notes if somebody says, hey, you know, I might benefit from talking to Greg and his company.

GREG:  Yeah, we’d love to help, and either one is great. I love meeting new people on LinkedIn. I’m getting new, new friends every day. Yes. Feel free to reach out at the site. It’s just www.palydin.com, and we’ll we’ll put that in the show notes or reach out through LinkedIn. And, of course, you know, love to talk to anybody about ITAM or security or, you know, any, any other topic. I’ve been around quite a bit. So happy to just share. We were having fun the other day, just kind of remembering some of the some of the old, good old days. One of the folks, you know, broke out an old RIP tech report from a long time ago. We were having fun flipping through that just it’s it’s a fun industry and it’s a very small town. So happy to make new acquaintances any time. 

KURT:  Awesome. Great. Well, hey, thank you again for, joining us. I know I learned some things and, I think, the rest of our listeners sort of learn some things and hopefully a bunch of new people will reach out to you and and benefit from your help.

GREG: Oh, I really appreciate you having me, Kurt. And thanks for having me here.