My Portfolio
This is a selection of my architecture work, scrubbed of client-identifying detail. As this work demonstrates, I can generate materials to solve IT problems that run the gamut from long form white papers to elevator pitch executive presentations.
Zero Trust Enterprise Strategy
A Zero Trust strategy developed from the enterprise architecture function, covering the full estate — identity and access management, privileged access, network infrastructure, intrusion detection and prevention, data protection, IaaS/PaaS, and SaaS. Each domain assessed for current state, analyzed against Zero Trust principles, and written up with the specific gaps that stood between the two.
The argument
The white paper makes a business case before it makes a security one. Decentralization is what modern competition demands; the classic perimeter model answers decentralization by building a bigger fortress, which gets more expensive and more onerous the better it works. Zero Trust dismantles the fortress by embedding security in the system itself — the security posture rises while the controls become more transparent to the people working under them.
It is equally direct about how the strategy fails. Deploying tools without policy produces a false sense of security. Treating Zero Trust as a project rather than an operating posture guarantees the original problems return. And cherry-picking pieces of it while leaving perimeter controls intact is the worst outcome of the three: the fortress becomes a prison.
Method
The assessment is organized using PISTOL — a framework I developed for separating the layers of organizational planning that routinely get collapsed into one another:
- Principles — core assumptions from which business value derives
- Ideals — the standard that defines whether the goal was met
- Strategies — plans of action designed to reach an overall aim
- Tactics — the specific actions that implement a strategy
- Operations — the concerted activity required to run it
- Logistics — the coordination of people, facilities and supply behind the operation
The distinction does real work here. Most Zero Trust conversations are tactical arguments (MFA, microsegmentation, VPN replacement) conducted as though they were strategic ones, which is why they stall.
For more information on the PISTOL methodology please take a look at my Substack.
Recommendations
The executive presentation closes on five: articulate the strategy comprehensively rather than piecemeal; show where existing security investments already fit it; train the department and the business before rolling anything out; build a 24-month roadmap on the principle that the plan drives the tools rather than the reverse; and score systems against Zero Trust inside the existing architecture review board rather than in a separate security review.
Artifacts
- Zero Trust Enterprise Strategy — the full white paper (PDF, 39 pages)
- Zero Trust Strategy: Discussion of Findings — the executive presentation (PPTX)
Enterprise Content Strategy
A strategy for bringing an organization's unstructured content — documents, email, chat, media, message boards, web and wiki content — under management across a platform estate that had grown piece by piece. Each platform was inventoried, sized by share of storage, and assessed against six core ECM capabilities: document management, data categorization, eDiscovery, data loss prevention, record management and external content sharing.
The argument
Content that is part of an active business process is valuable; content that isn't is a liability. The white paper reduces the standard seven-step content lifecycle to four stages that map directly onto controls — Draft, Store, Record and Dispose — and is explicit that the point of managing the lifecycle is security, compliance and reduced liability. Keeping everything “just in case” protects individual careers at the expense of the company's risk.
The assessment found the organization already had the platforms it needed. Several were fully ECM-capable, others only partially, and many of the capabilities that existed were available but not switched on. The hard part wasn't technology. It was defining the policies that tell the controls what to do.
Recommendations
A three-phase strategy, each phase expected to take six to twelve months:
- Implementation — convene security, compliance, legal and HR work groups to set policy, then raise every platform to its full native ECM capability
- Transfer — move content from weakly controlled platforms to strongly controlled ones, ordered by severity and ease of move, and change the business processes so new content lands in the right place to begin with
- Re-evaluation — only then look for gaps, redundant platforms, consolidation savings and opportunities to move locally managed platforms to SaaS
The sequencing is the point: policy and controls on existing platforms come first, and cost-saving consolidation is deliberately treated as a secondary effort.
Artifacts
- Enterprise Content Management Strategy — the full white paper (PDF, 12 pages)
Validated SharePoint Online Upgrade
Not all architecture planning is strategic. Some of it is tactical: a defined scope, a known destination, and an audience who needs to know exactly what will happen and who will do it. This plan was written for the IT application owner, who wanted just the facts — so it has no business case, no framework and no options analysis. It covers what's in, what's out, who owns what and how the upgrade day runs.
The problem
Move a regulated research environment — on-premises SharePoint 2010 content organized as projects and studies — to SharePoint Online, then retire the on-premises platform and its supporting technologies. The complication is validation: the content falls under 21 CFR Part 11, so the move has to preserve controlled document management, auditing and permissions, and has to be tested and documented to prove it.
What the plan covers
- Scope — infrastructure (site collections, libraries, permissions, audit logging, content types, managed metadata, data transfer) separated from applications and customizations (InfoPath forms, workflows, custom search and page-layout changes), with an explicit out-of-scope list of what gets retired instead
- QA — because SharePoint Online is a hosted service, installation and operational qualification (IQ/OQ) fall away; the plan defines the performance qualification (PQ) testing that remains
- Roles — a RACI matrix across the four teams involved: Clinical Systems, R&D Systems, SharePoint Infrastructure and SharePoint Applications
- Governance — the policies for the validated environment: a “VALIDATED” watermark on every page, centrally managed content types, enforced versioning, and auditing of all changes but not views
- Runbook — the step-by-step for each project: change control, provisioning, a first-pass copy, a cutover-day delta copy, final PQ, and user redirection
Artifacts
- Medical Research O365/SharePoint Online Upgrade — the upgrade plan (PDF, 3 pages)
More
Further artifacts will be added as they are cleared for publication. To discuss any of this work in detail, reach me at stephen.choolfaian@outlook.com or on LinkedIn.