Case Study

Fragmented PKI. Hidden Certificates. A Healthcare Roadmap Built for Scale

How Encryption Consulting assessed a Minnesota-based healthcare organization’s fragmented PKI environment, closed governance and visibility gaps, and delivered a remediation roadmap to automate lifecycle management across hybrid infrastructure.

Customer Profile

A Minnesota-based healthcare organization with 7,000+ professionals, serving millions across nations with home-based pharmacy services. The organization has operated for decades in pharmacy, treatment development, and disease research, with infrastructure spanning on-premises and cloud environments.

Industry

Healthcare, Pharmacy & Treatment Services

Engagement Type

PKI Assessment & Remediation Roadmap

Download Case Study

At a Glance Outcome

7,000+

Professionals secured under a standardized PKI framework

NIST & FIPS

140-2/3 standards driving assessment and remediation

HSM

Root and Issuing CA keys moved to hardware-secured storage

Single Pane

Centralized certificate inventory across hybrid environments

The Enterprise

Challenges

The organization's PKI had grown organically to meet immediate security needs, but lacked a structured approach, formal governance, or centralized oversight. What started functional had become a patchwork that couldn't scale or be audited, and blind spots were accumulating across its hybrid environment.

No formal governance, CRL process, or backup procedures

No CP or CPS existed, CRL updates lacked structure, and CA databases had no regular backups. Without centralized oversight, certificate risks went untracked, exposing the organization to data loss and compliance penalties.

01 GOVERNANCE

Manual lifecycle management for thousands of certificates

Issuance, renewal, and revocation were all manual across thousands of certificates. This slowed operations and raised the risk of outages from expired certificates going undetected.

02 LIFECYCLE

Private keys stored in software without strong access controls

Root and Issuing CA private keys sat in software without strong access controls. This left the organization’s core cryptographic assets exposed to unauthorized access and compromise.

03 KEY SECURITY

The organization’s PKI environment had evolved to meet immediate security requirements, but without a compliance-focused strategy or centralized oversight, it left critical gaps that could lead to costly penalties.

Encryption Consulting

Engagement Summary · Encryption Consulting · PKI Services

Our Offered

Solutions

The engagement followed a phased approach: policy and standards review, stakeholder workshops, gap analysis against a custom PKI framework aligned with NIST 2.0 and FIPS 140-2/3, and a remediation roadmap for governance, automation, visibility, and key protection.

Capability 01

Assessment, Gap Analysis & Use Case Definition

Reviewed policies, data classification, and key management. Workshops defined use cases: client-server security, least privilege, centralized CLM, and strong cryptographic controls. Gap analysis benchmarked current state against NIST 2.0 and FIPS 140-2/3.

Capability 02

Governance, Policy & Multi-CA Flexibility

Evaluated multi-CA integration to eliminate vendor lock-in. The roadmap prioritized NIST SP 1800-16, 2048-bit keys, and least privilege, with policies to govern certificate management and phase out self-signed and wildcard certificates.

Capability 03

Certificate Lifecycle Automation & Alerting

Recommended automated lifecycle management to cut manual workload and outage risk. Defined real-time expiration alerts for proactive renewals and automated CA database backups for recoverability.

Capability 04

Centralized Inventory & Visibility

Recommended centralizing certificate inventory across hybrid environments into a single pane of glass to track status, ownership, and dependencies, close blind spots, and improve accountability.

The result was a clear remediation roadmap transforming a fragmented, manually managed PKI into a governed, automated, and visible certificate management framework aligned with industry standards and built to scale.

Encryption Consulting

Engagement Summary · Encryption Consulting · PKI Services

The Overall

Business Outcome

The PKI assessment gave the organization a clear path from fragmented, manual PKI operations to a centralized, automated certificate management framework built for long-term security and scalability.

Stronger security and key protection

Automated lifecycle management reduced manual work and prevented expired-certificate outages. Root and Issuing CA keys moved to HSM storage with defined roles and strong access controls.

Visibility and standardized operations

Centralized management provided visibility into certificate status, ownership, and urgency. Standardized CSR workflows replaced patchwork processes, with passwordless authentication across laptops, phones, servers, and IoT devices.

Foundation for future growth

Moved from fragmented PKI to a secure, scalable environment with proactive expiration monitoring. Next steps: automate deployment, integrate with identity and access management, and extend PKI to IoT security.

Discover Our

Latest Resources

Education Center

Introduction to Microsoft Intune

Microsoft Intune is Microsoft's cloud-based endpoint management service. Learn how it works, MDM vs. MAM, licensing, and Entra ID integration.

view all blogs

Windows Hello for Business Deployment Models

Use Case and Best Practices of Windows Hello

What Are Hybrid Certificates?

White Paper

Post-Quantum Cryptography for Finance: Threats, Standards, and the Road to 2035

Discover the quantum threats, NIST standards, and future of post-quantum cryptography for finance in our comprehensive white paper.

view all white papers

FIPS 140-3 Migration: The Complete Guide to Meeting the September 21, 2026 Deadline

The PQC Signature Selection Playbook

The Top 10 FIPS Compliance Mistakes Organizations Make

Video

Decoding Post-Quantum Security on the International Space Station (Part 2) | What It Means For You

Explore expert insights on cybersecurity, PKI, and post-quantum readiness, with practical guidance to strengthen security and future-proof cryptography.

Watch Now

view all videos

Decoding Post-Quantum Security on the International Space Station

From 50 to 9: NIST's Post-Quantum Signature Survivors (Part-2)

How to Automate Certificate Renewal with BIG-IP F5 Load Balancer