Building a security front door for a large enterprise

by Campbell Williams

The Challenge

Our client had a large in-house security function, split across six specialist teams: identity and access management, governance risk and compliance, cloud and DevSecOps, security architecture, the cyber defence centre, and business information security.

Each team was highly capable but the problem was how work reached them. Requests arrived through at least five different channels: an established service desk queue, a SharePoint portal one team had built for itself, a separate board on another ticketing tool used mainly for identity requests, a shared mailbox, and direct messages to individuals on Teams.

There was no documented triage criteria, no formal escalation path, and no audit trail for any of it.

 

  • Duplicated effort

    Duplicated effort

    Because there was no shared view of what was in flight, teams were sometimes duplicating each other's work without knowing it.

  • Informal triage

    Informal triage

    One of the teams had become the default, informal triage point for the entire function, manually reading requests and working out where they belonged, eating into their already very busy week.

  • No line of sight

    No line of sight

    For security leadership, there was no reliable way to answer basic questions about volume, ownership, or turnaround.

The Solution

Map the work, agree the owners, build one route in

Six specialist security teams, five-plus ways in, and no shared view of the work. We replaced all of it with one documented route.

  • Capability mapping against NIST CSF 2.0

    RiverSafe worked with all six teams to map what each one actually delivered, day to day, rather than what a policy document said they were responsible for. That produced a set of named capabilities, mapped against NIST CSF 2.0, giving leadership, audit, and the teams themselves a shared reference point for the first time.

  • A service catalogue with named owners

    That map became a service catalogue: roughly thirty distinct request types, each with a named owner, an agreed route, and an expected response time.

  • A single, search-first front door

    Rather than replacing any team's existing tooling which, in an organisation of their size and complexity, would have been an inefficient route, RiverSafe built a single, search-first front door in front of all of it. Clearly defined requests are routed automatically to the team that already owns them. Anything ambiguous goes to one documented triage point instead of an informal one.

THE OUTCOME

One route in, clear ownership, an auditable trail

Requests land right first time.

Business users get their request to the right team straight away, rather than it being passed around. Teams spend less time working out whose job something is, and more time doing the work itself.

Less duplicated work.

With clear ownership and routing in place, the same request landing with two teams independently, unnoticed, is far less likely.

A foundation for better decisions.

Every request now carries an owner, a type, and a route, visibility that didn’t exist before at all. The full reporting layer needed to turn that into live capacity planning and bottleneck data was designed as part of this work but not completed within the engagement, so today it’s a structural foundation rather than a finished dashboard.

 

Looking for the same for your business?

Give your security function one way in

Explore how RiverSafe can map your capabilities, agree ownership across teams, and build a front door the whole business can use.

Read more customer success stories