Deployment Readiness Framework

Every day before go-live is money earned.
Every rework is money burned.

A zero-touch deployment methodology to eliminate dead time between procurement and production — configure once, configure right, go live on Day 1.

15–45
Days Saved
Zero
Rework Target
100%
Config Tested Pre-Ship
Day 1
Investment Working
🧠

WHY Wait?

Procurement takes 4–12 weeks. That's dead time where your team could be building production-ready configs.

🔧

WHAT to Pre-Build

Policies, rules, integrations, user roles, dashboards — everything that doesn't need the physical appliance.

🚀

HOW to Deploy

Export tested configs, import on arrival, validate, go live. Zero-touch at site. Minimal downtime, zero surprises.

Section 01

The Zero-Touch Approach

Configure in your office lab, validate in a test environment, export the golden config, ship hardware to site, import config, go live. The site engineer's job reduces from "configure everything" to "plug in, import, verify."

DimensionTraditional On-SiteZero-Touch (Pre-Staged)
Configuration Time at Site3–15 days2–4 hours
Error RateHigh — pressure, unfamiliar envNear-zero — tested in lab
Engineer Skill Required at SiteSenior engineer mandatoryJunior can execute playbook
Downtime Window NeededExtended maintenance windowMinimal — swap & verify
Rollback PlanOften improvisedGolden config = instant rollback
Cost of Senior Resource Travel₹15K–50K/day + travelRemote support sufficient
Multi-Site ConsistencyDrift across locationsIdentical configs from template
DocumentationPost-hoc, often incompleteBuilt into the process
Compliance Audit TrailManual reconstructionLab logs + change records

✅ Advantages

Investment starts producing ROI from Day 1 of hardware delivery — no 2-week configuration lag
Configs are tested, validated, and peer-reviewed before they touch production
Senior architects work from the comfort of the office lab — no travel fatigue, no site pressure
Multi-branch/multi-site deployments become template-driven — deploy 50 branches in days, not months
Golden config serves as a rollback point — disaster recovery is just an import away
Junior engineers can handle site work with a clear runbook — reduces dependency on scarce senior talent
Change management approvals happen before deployment, not during — smoother CAB process
Every config decision is documented as part of the lab process — audit-ready from day one

⚠️ Challenges to Manage

Requires accurate site data upfront — wrong IPs, VLANs, or subnet info means rework (solved by Forward Integration checklists below)
Lab environment must mirror production topology — partial simulation can miss edge cases
Config export/import formats vary by vendor — Palo Alto, Fortinet, Cisco all have different mechanisms
License binding to hardware serial numbers may require post-delivery activation steps
Some products need physical network adjacency for initial bootstrap (e.g., HA pair formation)
Site-specific environmental factors (cabling, rack space, power) still need physical validation
Client IT teams must commit to providing accurate data during the procurement wait period
Initial investment in lab infrastructure and process documentation — but pays for itself after 2-3 projects
Section 02

Parallel Processing: Why Wait for Hardware?

The moment architecture is finalised, the clock starts. Smart teams use procurement lead time (4–12 weeks) to complete 80% of deployment work. Here's the parallel timeline.

Week 0 — Architecture Sign-Off
Decision Made → Procurement Initiated
Architecture finalised, vendor selected, PO raised. Most teams stop here and wait. Don't. This is exactly when the real prep work begins.
Trigger Point
Week 1–2 — Forward Integration Sprint
Gather Every Piece of Data You'll Need
IP schemas, VLAN maps, DNS records, AD/LDAP details, mail relay configs, existing policy documents, compliance requirements, stakeholder contacts, change management approvals. Use the Forward Integration Checklist below — miss nothing.
Data Gathering
Week 2–4 — Lab Build & Config Sprint
Build Production-Ready Configs in Test Environment
Stand up the product in your lab (trial license, virtual appliance, or existing test unit). Build every policy, rule, integration, user role, and dashboard. Use client's actual IP schemes with NAT translation where needed. Document every decision.
Core Configuration
Week 4–6 — Validation & Peer Review
Test, Break, Fix, Document
Run traffic simulation, test failover scenarios, validate HA configs, stress-test rule sets, verify log formats match SIEM expectations, peer-review all policies. Fix issues in the comfort of your lab, not under the pressure of a maintenance window.
Quality Gate
Week 6–8 — Golden Config Export
Export, Package, Prepare Runbook
Export the validated configuration. Create the deployment runbook — step-by-step guide a junior engineer can follow. Package firmware images, license files, SSL certs, and config backups. Everything in one deployment kit.
Deployment Kit Ready
Week 8–12 — Hardware Arrives
Unbox → Import → Verify → Go Live
Hardware arrives at site. Rack, cable, power on. Import golden config. Run the verification checklist. Connect to production network. Begin backward integrations (SIEM, ticketing, CMDB). Investment is working from Day 1.
🎯 Go Live — Day 1

💰 Quick ROI: What Does Saving Days Actually Mean?

Every day your cybersecurity investment sits unconfigured is a day your organization remains exposed AND a day of wasted investment.

₹0
Total Savings per Project
₹0
Idle Investment Cost
₹0
On-Site Labor Saved
₹0
Travel Eliminated
Section 03

Forward Integrations — The Pre-Work Checklist

Everything you need to gather BEFORE you start configuring. This is the data pipeline that feeds your zero-touch config. Get this right and the configuration practically builds itself.

📋 Universal — Every Product Needs These

▼
🌐 Network & Infrastructure Data
Complete IP Address Schema
All subnets, VLANs, management IPs, server IPs, printer ranges, guest network, IoT segments, DMZ
Required
VLAN Map with Names & IDs
VLAN ID, name, subnet, gateway, DHCP scope, purpose (e.g., VLAN 10 = Management, VLAN 20 = Servers)
Required
Network Topology Diagram
Physical and logical topology, ISP links, WAN connections, core/distribution/access layers, redundancy paths
Required
DNS Configuration
Internal DNS servers, external DNS, domain names, split DNS requirements, conditional forwarders
Required
Routing Information
Static routes, dynamic routing protocols (OSPF/BGP areas), route tables, default gateways per segment
Required
NAT/PAT Rules (Existing)
Source NAT, destination NAT, port forwards, 1:1 NATs, any existing translation tables
Recommended
Bandwidth & ISP Details
ISP names, circuit IDs, bandwidth per link, SLA details, failover configuration, public IP blocks
Recommended
🔐 Identity & Access
Active Directory / LDAP Details
Domain controller IPs, base DN, bind account credentials, OU structure, group names for RBAC mapping
Required
Authentication Method
RADIUS/TACACS+ servers, SAML/SSO providers, MFA configuration, certificate-based auth requirements
Required
Admin Access Matrix
Who needs admin access, what role levels, which IP ranges for management access, break-glass accounts
Required
SSL/TLS Certificates
CA certificates, intermediate certs, device certificates, cert chain, SSL inspection CA if applicable
Recommended
📜 Policy & Compliance
Existing Security Policy Document
Acceptable use policy, internet access policy, data classification policy — these translate directly into rules
Required
Compliance Requirements
RBI guidelines, DPDPA, PCI-DSS, ISO 27001 controls, SEBI CSCRF, CERT-In directives — specific control IDs
Required
Data Classification Scheme
What's public, internal, confidential, restricted? This drives DLP rules, encryption policies, access controls
Recommended
Regulatory Audit Schedule
Upcoming audit dates, last audit findings, remediation items that new product must address
Optional
👥 Stakeholders & Change Management
Stakeholder Contact Matrix
CISO, CTO, Network Head, Security Head, Compliance Officer, Server Admin, DBA — names, phones, emails, escalation paths
Required
Change Advisory Board (CAB) Process
How to submit change requests, approval chain, lead time required, maintenance window policies, rollback requirements
Required
Maintenance Window Schedule
Available windows for cutover, blackout dates, business-critical periods to avoid, preferred days/times
Required
Communication Plan Template
Who to notify before/during/after deployment, escalation matrix, war-room setup for go-live
Recommended
Approval Workflow Documentation
Sign-off requirements for config changes, who approves policy modifications, SOP for emergency changes
Required
📧 Communication & Integration Infra
SMTP/Mail Relay Configuration
Mail server IP, port, authentication, TLS settings — for alerts, reports, notifications
Required
Syslog/Log Forwarding Details
Syslog server IP, port, protocol (UDP/TCP/TLS), facility, severity levels, log format preferences (CEF, LEEF, JSON)
Required
NTP Server Details
Internal NTP servers, timezone, synchronization requirements — critical for log correlation
Required
SNMP Configuration
SNMP version, community strings, v3 credentials, trap destinations, OIDs to monitor
Recommended
🏗️ Physical & Site Details
Rack Location & Space
Which rack, U position, adjacent devices, cable path planning, labeling conventions
Required
Power Requirements
Power socket type, UPS capacity, redundant power feeds, PDU port allocation
Required
Cabling Plan
Port-to-port connectivity map, cable types (copper/fiber/DAC), patch panel assignments, uplink ports
Required
Site Access Procedures
Data center access process, escort requirements, visitor badges, hours of access, emergency contacts
Recommended

🛡️ Firewall / NGFW — Forward Integration Specifics

▼
Existing Firewall Rule Export
Export current rules from incumbent firewall — CSV/XML format. Every rule needs review: keep, modify, or deprecate
Zone Architecture Design
Trust, Untrust, DMZ, Guest, IoT, SCADA, Management — inter-zone traffic matrix with permit/deny decisions
Application Inventory
Critical business applications, ports/protocols used, SaaS apps, cloud services — for App-ID / application-aware rules
VPN Configuration Details
Site-to-site VPN peers (IPs, PSK/certs, encryption), remote access VPN user groups, split-tunnel requirements
SSL/TLS Decryption Policy
Which categories to decrypt, bypass list (banking, healthcare), CA cert for SSL inspection, browser trust deployment plan
HA Configuration Details
Active-Passive or Active-Active, HA IPs, heartbeat interface, preemption settings, failover triggers
URL Filtering Categories
Block list, allow list, custom categories, per-group policies (e.g., social media blocked for ops, allowed for marketing)
Threat Prevention Profiles
IPS signature sets, anti-malware profiles, vulnerability protection, DNS sinkhole, wildfire/sandbox settings

🖥️ Endpoint Security (EDR/XDR) — Forward Integration Specifics

▼
Endpoint Inventory & OS Distribution
Total count by OS (Win 10/11, Server 2019/2022, macOS, Linux distros), architecture (x64/ARM), VM vs physical
Existing AV/EDR to Remove
Current product, version, uninstall method, tamper protection passwords, known conflicts
Software Deployment Method
SCCM, Intune, GPO, manual — how will the agent be pushed? Bandwidth constraints for large deployments?
Exclusion List
Applications that need scanning exclusions — databases (Oracle, SQL), backup agents, custom LOB apps, dev tools
Policy Groups / Device Groups
Servers vs workstations vs VDI vs kiosks — each needs different policy settings, scan schedules, response actions
Network Proxy Details for Agent
If endpoints go through proxy to reach cloud console — proxy IP, port, authentication, PAC file URL
USB & Device Control Policy
Block all USB? Allow specific vendor IDs? Printer policy? Bluetooth restrictions? Mobile device tethering?

📊 SIEM / Log Management — Forward Integration Specifics

▼
Log Source Inventory
Every device/app that will send logs — firewalls, switches, servers, AD, DNS, DHCP, applications, databases, cloud (count + EPS estimate per source)
Total EPS (Events Per Second) Estimate
Calculate: number of sources × avg EPS per source. Critical for SIEM sizing and license. Peak vs average EPS.
Log Retention Requirements
Hot storage (30-90 days?), warm (6 months?), cold/archive (1-7 years per compliance). RBI mandates 5 years for banking.
Use Case / Detection Rule Requirements
Top 20 use cases to implement: brute force, lateral movement, data exfil, privilege escalation, insider threat, compliance violations
Dashboard & Report Requirements
Who sees what? CISO dashboard, SOC analyst views, compliance reports, executive summary — define audience + frequency
Correlation Asset Context
Asset criticality ratings, user-to-device mapping, service accounts list, VIP users, honeypot IPs — enriches correlation rules
Threat Intelligence Feeds
STIX/TAXII feeds, commercial TI subscriptions, CERT-In feeds, sector-specific IOC sources to integrate

☁️ Cloud Security (CASB/CSPM/CNAPP) — Forward Integration Specifics

▼
Cloud Environment Inventory
AWS accounts, Azure subscriptions, GCP projects — account IDs, regions, resource counts, org structure
SaaS Application Inventory
Sanctioned apps (O365, Salesforce, etc.), shadow IT discovered apps, API integrations, OAuth grants
IAM Roles & Service Accounts
Cross-account roles, service principals, managed identities, API keys in use — for CIEM and access review
Cloud Network Architecture
VPC/VNet layout, peering, transit gateways, security groups, NACLs, private endpoints, ExpressRoute/Direct Connect
Container & Kubernetes Details
EKS/AKS/GKE clusters, namespaces, registries, CI/CD pipeline tools, image scanning requirements
Compliance Benchmark Selection
CIS benchmarks, cloud-specific (AWS Well-Architected, Azure Security Benchmark), PCI in cloud, SOC 2 controls

🔑 PAM / Identity Security — Forward Integration Specifics

▼
Privileged Account Inventory
All admin accounts — domain admins, local admins, service accounts, root accounts, database admins, network device admins
Target System List
All systems requiring privileged access management — servers, databases, network devices, cloud consoles, applications
Password Rotation Policy
Rotation frequency per account type, complexity requirements, break-glass procedures, dual-control requirements
Session Recording Requirements
Which sessions to record (RDP, SSH, database), retention period, who can review, keystroke logging policies
Access Workflow Design
Request → Approve → Checkout → Use → Checkin flow. Approval matrix, time-bound access, just-in-time elevation

📡 NAC / Network Access Control — Forward Integration Specifics

▼
Switch Inventory & 802.1X Readiness
All switches — make, model, firmware version, 802.1X support, current port security configs, management access method
Endpoint Supplicant Status
Which OS versions support 802.1X natively, which need software supplicant, BYOD devices, IoT devices without supplicant
Wireless Controller Details
WLAN controllers, SSIDs, authentication methods per SSID, guest portal requirements, captive portal design
Posture/Compliance Policy
What to check: AV updated? OS patched? Disk encrypted? Domain-joined? — and what to do if non-compliant (quarantine VLAN, limited access)
MAC Address Database
For MAC Authentication Bypass (MAB) — printers, cameras, IoT devices that can't do 802.1X. Full MAC inventory with device type mapping.

💾 Backup & DR — Forward Integration Specifics

▼
Data Source Inventory with Sizes
Every server/DB/app to back up — current data size, daily change rate, growth projection. Critical for sizing.
RPO/RTO Requirements per System
Recovery Point Objective and Recovery Time Objective for each tier — Tier 1 (minutes), Tier 2 (hours), Tier 3 (days)
Backup Schedule Design
Full/incremental/differential schedule, retention policy (daily/weekly/monthly/yearly), backup windows, impact on production
DR Site Details
DR location, connectivity (dedicated link/VPN/internet), available infrastructure, replication method (sync/async), failover process
Immutability & Air-Gap Requirements
Ransomware protection — immutable snapshots, air-gapped copies, WORM storage, multi-admin approval for deletes

📱 MDM / UEM — Forward Integration Specifics

▼
Device Inventory by Type & OS
iOS (version spread), Android (version + OEM), Windows laptops, macOS — BYOD vs corporate-owned counts
App Catalog & Distribution Plan
Mandatory apps, optional apps, prohibited apps, enterprise app store setup, VPP/managed Google Play
Enrollment Method
Apple DEP/ABM, Android Zero-Touch/Knox, Windows Autopilot — or manual enrollment. Determines prep work needed.
Compliance Policies
Passcode requirements, encryption, jailbreak detection, OS version minimums, app restrictions, geofencing
Conditional Access Rules
Integrate with Azure AD/Okta — block non-compliant devices from email, cloud apps, VPN access

🔒 DLP / Data Protection — Forward Integration Specifics

▼
Sensitive Data Types & Patterns
Aadhaar numbers, PAN cards, credit card numbers, IBAN, medical records, source code patterns, trade secrets — regex patterns for custom identifiers
Data Flow Map
Where sensitive data lives (endpoints, servers, cloud, email), where it flows (USB, email, web upload, print, cloud sync), who accesses it
Policy Actions per Channel
Email: block/encrypt/notify. USB: block/audit. Web upload: block/warn. Print: watermark/block. Cloud: block/DRM. Define per sensitivity level.
Exception Process
Who can grant exceptions? Time-bound? Logged? Manager approval flow? — avoid blocking business-critical transfers

🏭 IoT/OT Security — Forward Integration Specifics

▼
OT Asset Inventory
PLCs, HMIs, SCADA servers, RTUs, historians — make, model, firmware version, protocol (Modbus, BACnet, OPC-UA, Profinet)
Purdue Model Level Mapping
Which devices at which level (0-5), current segmentation state, IT/OT convergence points, DMZ design
Network Segmentation Current State
Current flat vs segmented, which protocols cross boundaries, remote access methods for OT (jump servers, VPN)
Vendor Remote Access Inventory
Which vendors need remote access to OT systems, current methods (TeamViewer, VPN), scheduling, monitoring requirements

🔍 Vulnerability Management — Forward Integration Specifics

▼
Asset Scope & Scan Groups
Internal scan ranges, external IPs/domains, cloud assets to scan, scan frequency per group, authenticated vs unauthenticated
Scan Credentials
Windows domain account for authenticated scans, SSH keys for Linux, SNMP credentials for network devices, database credentials
SLA for Remediation
Critical: 24-72hrs, High: 7-14 days, Medium: 30 days, Low: 90 days — or per your compliance framework requirements
Patch Management Integration
Which patch tool (WSUS, SCCM, Intune, manual), patching windows, test-before-deploy process, exception handling
Section 04

Backward Integrations — Post-Deployment Connections

Once the product is live, it must plug into the broader security ecosystem. These are the connections that turn a standalone product into a force multiplier — logs to SIEM, alerts to ticketing, assets to CMDB, metrics to dashboards.

📊
SIEM Integration
Every product → SIEM
↩ Backward Tasks
Configure log forwarding (syslog/API/agent) from new product to SIEM
Validate log parsing — confirm fields map correctly (source IP, dest IP, action, severity)
Build/tune correlation rules specific to the new log source
Create product-specific SIEM dashboards for SOC visibility
Set up alert thresholds and notification channels
Validate EPS impact — ensure SIEM license and performance can handle additional load
Test end-to-end: generate test event → verify SIEM alert → confirm notification delivery
🎫
Ticketing / ITSM Integration
Alerts → ServiceNow / Jira / BMC
↩ Backward Tasks
Map alert severity levels to ticket priority (P1/P2/P3/P4)
Configure auto-ticket creation for high-severity events
Define assignment rules (which team gets which alert type)
Set up bi-directional sync — ticket closure updates product status
Build escalation workflows with SLA timers
Create ticket templates with all required fields pre-populated
Test deduplication — ensure one incident doesn't create 500 tickets
🗄️
CMDB / Asset Register
Discovery → Asset Management
↩ Backward Tasks
Add new product as a CI (Configuration Item) in CMDB
Map relationships — which assets it protects, upstream/downstream dependencies
Configure auto-discovery feed to CMDB (if product discovers assets)
Update asset register with protected asset coverage
Link product license/support contract to asset record
Set up warranty/renewal alerts in asset management
🤖
SOAR / Automation
Alerts → Automated Response
↩ Backward Tasks
Build API connector for the new product in SOAR platform
Create response playbooks (e.g., firewall alert → auto-block IP → notify SOC → create ticket)
Define automation boundaries — what can auto-execute vs requires human approval
Test playbooks with simulated events before enabling in production
Set up audit trail for all automated actions
Configure rate limiting to prevent automation storms
📈
Monitoring / NMS
Health → PRTG / Nagios / Zabbix
↩ Backward Tasks
Add device to NMS — SNMP polling, ICMP monitoring, port monitoring
Configure SNMP traps for hardware events (fan failure, disk, HA failover)
Set up performance baselines (CPU, memory, sessions, throughput)
Create uptime/SLA monitoring dashboards
Configure alert thresholds (CPU > 80%, disk > 90%, HA state change)
Integrate with capacity planning for trend analysis
📋
Compliance & Audit
Evidence → GRC Platform
↩ Backward Tasks
Map product controls to compliance framework requirements (ISO 27001, RBI, PCI-DSS)
Configure automated evidence collection (config exports, log samples, policy screenshots)
Schedule compliance reports (daily/weekly/monthly per regulation)
Set up continuous compliance monitoring alerts
Document product in security architecture documentation
Update risk register — mitigated risks, residual risks, new risks introduced
📞
Notification & Communication
Alerts → People
↩ Backward Tasks
Configure email alerts — distribution groups per severity and product area
Set up SMS/WhatsApp alerts for critical events (P1 incidents)
Integrate with collaboration tools (Teams, Slack) — dedicated security channels
Configure PagerDuty/OpsGenie for on-call rotation integration
Build escalation matrix — who gets notified after 15min, 30min, 1hr of no response
🔄
Backup & DR of the Product Itself
Protect the Protector
↩ Backward Tasks
Schedule automated config backups (daily minimum)
Store config backups in secure, offsite location (not on the device itself)
Document DR procedure — how to rebuild from scratch if device is lost
Test config restore process — verify backup actually works
Set up firmware/version tracking for update management
Maintain golden config version control — track every change with who/when/why
🧑‍💻
Knowledge Transfer & Handover
Documentation → Operations Team
↩ Backward Tasks
Create operational runbook — day-to-day tasks, common troubleshooting, FAQ
Conduct hands-on training for L1/L2/L3 support teams
Document vendor support process — how to raise TAC cases, support portal access, SLA terms
Create admin credential handover with secure password vault entry
Schedule 30/60/90 day health check reviews
Define success metrics — what "healthy" looks like for this product
Section 05

Product-Wise Integration Quick Reference

At-a-glance view of forward and backward integration priorities by product category. Click any card to see the key integration points specific to that technology.

→ Forward (Pre-Config Data)

Zone architecture — Trust/Untrust/DMZ/Guest zone design with inter-zone matrix
Existing rule export — Current firewall rules in CSV/XML for migration analysis
Application inventory — Business apps, ports, protocols for App-ID rules
VPN peer details — Site-to-site tunnel parameters, remote access design
SSL decryption scope — Categories to decrypt, bypass list, CA cert plan
HA design — Active/Passive or A/A, heartbeat IPs, failover behavior
Threat profiles — IPS, anti-malware, URL filtering, sandboxing settings

← Backward (Post-Deploy Connect)

SIEM log ingestion — Traffic, threat, URL, tunnel, system, config change logs
Panorama/FortiManager — Central management registration if multi-site
SOAR playbooks — Auto-block malicious IPs, quarantine infected hosts
NMS monitoring — SNMP for CPU, memory, sessions, HA state
Ticketing auto-create — High-severity threat alerts → auto P1/P2 tickets
Config backup schedule — Daily config export to version-controlled repository
Compliance mapping — Map rules to control IDs (ISO A.13, PCI 1.x)

→ Forward

Endpoint inventory — OS distribution, hardware types, VM vs physical counts
Existing AV removal — Current tool, uninstall method, tamper passwords
Deployment method — SCCM/Intune/GPO push plan, phased rollout groups
Exclusion whitelist — Database paths, backup agents, LOB apps, dev tools
Policy groups — Servers vs workstations vs VDI vs executive laptops
USB/Device control — Block, audit, or allow by device class/vendor ID

← Backward

SIEM integration — Detection alerts, process events, network connections telemetry
SOAR response — Auto-isolate endpoint, collect forensic package, kill process
Ticketing — Malware detection → auto-ticket with device details & user info
NAC integration — Non-compliant endpoint → quarantine VLAN via NAC
Vuln management feed — Software inventory → VM tool for patch prioritization
CMDB sync — Endpoint discovery → auto-update asset register

→ Forward

Log source inventory — Every device/app with EPS estimate, format, protocol
Use case matrix — Top 20-50 detection rules mapped to MITRE ATT&CK
Retention policy — Hot/warm/cold tiers per compliance requirement
Dashboard requirements — SOC, CISO, compliance, operations views defined
Asset context — Criticality ratings, user-device mapping, network zones
TI feeds — STIX/TAXII sources, commercial feeds, CERT-In indicators

← Backward

Ticketing auto-create — Correlated alerts → auto-ticket with context & evidence
SOAR trigger — High-confidence alerts auto-trigger response playbooks
Email/SMS alerts — Severity-based notification to SOC, management, on-call
Compliance reports — Scheduled reports to GRC platform, auditor portal access
Executive dashboards — KPI feeds to business intelligence / CXO dashboards
Threat intel enrichment — IOC match → auto-enrich from TI platform

→ Forward

Switch inventory — Make/model/firmware, 802.1X capability, management access
Supplicant readiness — OS 802.1X support, IoT devices needing MAB
Wireless details — Controllers, SSIDs, auth per SSID, guest portal design
Posture policies — AV, patch, encryption, domain-join checks
MAC database — Printers, cameras, IoT MACs for bypass authentication

← Backward

EDR posture feed — EDR health status → NAC compliance check
SIEM logs — Auth success/fail, posture violations, quarantine events
CMDB discovery — Profiled devices → asset register auto-update
Ticketing — Repeated auth failures → auto-ticket for investigation
MDM integration — MDM compliance status feeds NAC decisions

→ Forward

Privileged account audit — All admin, root, service, DB, network device accounts
Target systems — Servers, databases, network gear, cloud consoles to protect
Rotation policy — Frequency, complexity, break-glass, dual-control rules
Session recording scope — RDP, SSH, DB sessions — what to record, how long to keep
Access workflow — Request → Approve → Checkout → Use → Checkin flow design

← Backward

SIEM correlation — Privileged session events → correlation with user behavior analytics
Ticketing — Access requests auto-create change tickets, session anomalies → alerts
Compliance evidence — Session recordings as audit evidence for ISO/RBI/PCI
Identity governance — PAM data feeds access reviews and certification campaigns
SOAR integration — Suspicious activity → auto-terminate session, rotate credential

→ Forward

Data types & patterns — Aadhaar, PAN, credit card, medical, source code regex patterns
Data flow map — Where sensitive data lives, flows, and who accesses it
Channel policies — Email/USB/web/print/cloud actions per sensitivity level
Exception process — Approval workflow, time-bound, audit trail

← Backward

SIEM alerts — Policy violations, data exfil attempts, high-risk user behavior
Ticketing — Violations → HR incident tickets, compliance violation records
CASB sync — Cloud DLP policies sync with on-prem DLP for consistent enforcement
Compliance reporting — DPDPA evidence, PCI cardholder data monitoring reports

→ Forward

Cloud inventory — AWS accounts, Azure subs, GCP projects, regions, resource counts
SaaS catalog — Sanctioned apps, shadow IT, OAuth grants, API integrations
IAM mapping — Cross-account roles, service principals, API keys audit
Cloud network — VPC/VNet, peering, transit GW, security groups, private endpoints
K8s details — Clusters, namespaces, registries, CI/CD tools

← Backward

SIEM cloud logs — CloudTrail, Azure Activity, GCP Audit → SIEM for correlation
Ticketing — Misconfigurations → auto-ticket to cloud ops team with remediation steps
CMDB sync — Cloud assets → asset register, auto-track ephemeral resources
Compliance dashboard — CIS benchmark scores → executive compliance posture view
Cost management — Security group waste, unused resources → cost optimization feed

→ Forward

Data source sizing — Servers/DBs/apps with current size, change rate, growth
RPO/RTO matrix — Recovery requirements per system tier
Schedule design — Full/incr/diff schedule, retention policy, backup windows
DR site specs — Location, connectivity, infrastructure, replication method
Immutability plan — Air-gap, WORM, multi-admin approval for ransomware protection

← Backward

NMS monitoring — Backup job success/failure alerts to monitoring system
Ticketing — Failed backups → auto P2 ticket to storage/backup team
Compliance evidence — Backup completion reports for audit (RBI mandates DR testing)
CMDB integration — Protected assets → backup coverage report in asset register
DR drill scheduling — Automated DR test calendar with results tracking

→ Forward

Scan scope — Internal ranges, external IPs/domains, cloud assets, scan groups
Scan credentials — Windows domain, SSH keys, SNMP, DB creds for authenticated scans
Remediation SLA — Critical/High/Medium/Low timelines per compliance
Patch integration — WSUS/SCCM/Intune details for vulnerability-to-patch workflow

← Backward

Ticketing — Critical vulns → auto-ticket to respective server/app teams
Patch management — Vuln data → patch tool for automated remediation
CMDB enrichment — Vulnerability count per asset feeds risk scoring in CMDB
Compliance reports — Monthly vulnerability posture for CISO, auditors, board
SIEM risk scoring — Asset vulnerability scores enhance SIEM correlation priority

→ Forward

OT asset inventory — PLCs, HMIs, SCADA, RTUs — make, model, firmware, protocol
Purdue model mapping — Devices at each level (0-5), IT/OT convergence points
Segmentation state — Current flat vs segmented, cross-boundary protocols
Vendor remote access — Who, how, when — for secure remote access design

← Backward

SIEM OT events — Protocol anomalies, firmware changes, unauthorized access to SIEM
CMDB OT assets — Discovered OT devices → IT asset register for unified view
Ticketing — OT anomalies → tickets to both IT security and plant operations
Safety systems — Critical OT alerts → integration with safety instrumented systems

Raksha Technologies — Cybersecurity Procurement Advisory Platform

Zero-Touch Deployment & Integration Framework v1.0

Deployment Framework — Use checklists during procurement phase