How Nexus Built Its First Secure Azure Foundation With CDW
Faced with a tight deadline, the medical review company partnered with CDW to build a secure, HIPAA-compliant Azure foundation, then turned to managed services to keep its cloud environment running securely and smoothly.
Nexus, a company based in Texas that provides independent clinical review and utilization management services, had 90 days to build an entire cloud infrastructure from scratch – with an IT team of two, neither of whom had ever touched the cloud. To say that the clock was ticking would be an understatement.
Nexus and its subsidiary, ProPeer Resources, needed the scalability and security of a cloud environment to support organizational long-term growth and stability. Both entities had been operating entirely on on-premises infrastructure, but they had hit a wall that was forcing them to prioritize a move to the cloud.
Nexus had acquired the source code for its primary medical review application. That software would play a key role in supporting business growth, “and the on-premises architecture could not support a web application without major upgrades,” says Chief Technology and Security Officer Cris Ewell.
The company would have needed to invest hundreds of thousands of dollars in hardware infrastructure to run the software on-premises. So, while standing the critical application up in the cloud made sense, Nexus would have to start from ground zero and with limited staff expertise.
As former CISO at UW Medicine, Ewell had extensive cloud experience himself. But he couldn’t manage the migration single-handedly, and implementing in a brand-new Azure environment was going to be a heavy lift on an already short timeline. Nexus was motivated to standardize on Azure mainly for alignment with its existing Microsoft footprint, which includes Microsoft 365 and Entra ID, HIPAA Business Associate Agreement coverage, and native security and governance tooling.
One of first steps to becoming cloud-ready relied on Nexus establishing a secure landing zone architecture before deploying business-critical applications in the cloud. This meant ensuring separation between development and production environments, as well as connectivity between cloud environments and on-premises infrastructure.
Nexus also required a cloud operating model that would allow internal teams to successfully adopt and manage Azure, along with support for healthcare compliance requirements, including HIPAA, HITRUST R2 and SOC.
The software developer who had built the application would only host it temporarily. Nexus would soon need to run it on its own infrastructure.
The internal team could not realistically make that happen. “They were on-premises only, and it’s a small team: two IT support techs and, essentially, one engineer who had only done on-premises work,” he says. “That was my entire staff. So, we had to have a partner.”
CDW Builds a Secure Azure Foundation
When Ewell joined Nexus, the company had no existing relationship with CDW, but he laid out the situation to an account representative there who he knew from his prior role.
“I reached out and said, ‘I have a problem. I need to get an engagement started within the next couple of weeks, and we need to develop an entire cloud infrastructure for both Nexus and ProPeer. And I have 90 days to get it done,’” he says.
Ewell also made clear that this would be a hands-on, roll-up-your-sleeves effort.
“I didn’t just want a resource. I wanted a partner who would grow with us,” says Ewell.
CDW rose to the occasion, and its experts hit the ground running.
As the Azure foundation came into place, everything was designed with security in mind.
“I take a CISO-first, technology-second approach. You’ve got to do both,” says Ewell. But he also knew Nexus had to maintain all necessary certifications as the deployment moved forward to comply with HIPAA, HITRUST, SOC and ISO 27001..
As the project progressed, CDW delivered a comprehensive Azure landing zone engagement, designing and implementing a hub-and-spoke architecture that provided centralized connectivity between Azure environments and on-premises resources.
It delivered secure networking through a dedicated connectivity layer, along with segregation of production and development environments. The Azure infrastructure foundation can support multiple business applications, and Nexus can leverage its cloud investment for future application expansion and growth.
The environment was designed with multiple subscriptions and networks to ensure clear separation of workloads and maintain operational governance as the environment matured.
CDW Helps Overcome Challenges Along the Way
“One of the biggest hurdles that we spent a lot of time on was ExpressRoute, a direct connection from our on-premises environment to Azure. It’s a private line directly into Azure, so you can get into your environment without going over the internet,” Ewell says.
The company’s telecom provider couldn’t make that essential connectivity work, and it was affecting operations for Nexus. This proved to be an immediate problem, he says.
The only alternative was a VPN, which could be excruciatingly slow.
“It was taking 10 or 20 seconds to transfer a file, and that’s not doable when you’re doing thousands of files a day,” says Ewell.
When CDW stepped in, Microsoft also came to the table as a strategic partner to fix the problem. “They helped us get Microsoft involved, and that’s the power of CDW,” Ewell says. “Now, we had a connection to Microsoft, and that helped get it working.”
In addition to the Microsoft connection, CDW brought its own extensive cloud expertise to bear for the project.
“CDW helped establish a secure, scalable Azure foundation by implementing best practices for governance, security and operational readiness aligned with the Microsoft CAF/WAF framework,” says Keith Valentine, a cloud architect at CDW.
All of this work then transferred easily to the Nexus subsidiary, which helped ease one of Ewell’s main pain points when deciding whether he could handle the project in-house or not.
“We built it once, then took that entire design and replicated it for the other tenant, ProPeer,” says Ewell. “We had that other tenant up and running within a week. It was very easy to replicate.”
“It really was the tenacity of the CDW team that made all of these things possible,” he adds. Just as important, Nexus met its 90-day deadline: The new environment was ready on schedule.
“It really was the tenacity of the CDW team that made all of these things possible.”
— Cris Ewell, Chief Technology and Security Officer, Nexus
Managed Services Keep Cloud Environment Secure
With a strong Azure foundation in place, the company now has a far greater level of resilience built into its infrastructure.
“We have very strict SLAs with our customers. We can afford only minimal downtime during business hours, so I’m always looking at availability,” Ewell says. Now that the mission-critical application is running in the cloud, “if the system goes down or a region goes down, I can bring up another region to keep us running.”
As a 24/7 operation, the system needs to keep running even during maintenance windows, and the cloud makes that possible. That’s essential, given the nature of the medical reviews that Nexus supports. “These are patients’ second opinions. It may be a surgery that they need,” he says. “This is not something that can wait until the next day.”
The cloud likewise delivers the needed level of information integrity. Now, systems work together to ensure data is not corrupted as they are backed up or restored, he says.
With the foundation in place, CDW has pivoted from cloud implementer to serving as a managed service provider, further helping Nexus maximize the value of its investment in a cloud-based infrastructure. The Managed Services team “continues to provide proactive support and guidance, enabling Nexus to maintain a secure, reliable and well-managed cloud environment,” Valentine says.
That means, in part, helping ensure the required level of security.
Given the high value of the data Nexus manages and the increasingly aggressive threat landscape, monthly patching was no longer sufficient. Ewell’s team is too small to do it more frequently. But with support from CDW, he can achieve the goal of delivering weekly patches for the first time in his career, he says.
“We are staying current, and we must, because one of the largest areas that our adversaries target is unpatched machines. CDW takes care of that, and it’s been great,” says Ewell. “My team doesn’t have to worry about it.”
In addition to weekly patches, CDW is also delivering much-needed support for ongoing security operations.
“They look at our logs, and their network operations center can see if something is going on in the middle of the night, or if the system goes down,” says Ewell. “They’ll give us a call if one of our production systems goes down, because we need to have that up and running.”
In addition to routine work, such as running backups, the CDW team also helps Nexus be strategic in its cloud usage.
“You have to plan ahead so that it can grow with your needs,” he adds.
To that end, “we have great monthly meetings where they will tell us, ‘What about fixing this?’ or, ‘This one’s coming up on the list of things that you should take a look at,’” he says. “It’s another set of eyes on the Azure environment, which is ever-changing.”
That extra set of eyes also helps ensure a robust security posture. “With Azure Advisor, the recommendations can be overwhelming. There are hundreds and hundreds of recommendations, and that does not feel actionable. We take that information and digest it, and make it more bite-sized,” says Angie Walworth, technical account manager for customer lifecycle services at CDW.
The level of support CDW provides Nexus makes a difference in numerous ways. The most immediate one is the scale that CDW brings, which would otherwise not be possible considering Nexus’s small IT team. This scale is vital, as cloud-based infrastructure can require rapid expansion.
“We have to be able to support a cloud infrastructure without making it unwieldy,” says Ewell. “That allows us to support the business as it grows and still field all of the curveballs that are thrown at us each and every day.”
Another aspect of the managed services relationship that Ewell values is the consultative nature of the CDW team, which acts as an extension of his team. CDW doesn’t just implement; it advises Ewell and Nexus on the trade-offs of different configurations and decisions, which helps Ewell feel like he’s still in the driver’s seat.
“It’s great to be working with a team that has been doing Azure for 20-plus years. They understand all of the little hiccups: If we don’t do this, or if we make this decision, here’s the impact three layers down,” says Ewell. “It’s a great relationship.”
Adam Stone
CDW Expert
