Case study / Public sector healthcare
County health system restores device management after Cisco CMS is sunset
Cisco-wired offboarding with SOC, NOC, and device management as one team.
~90–100 firewalls
Estate taken on when Cisco CMS was sunset, plus the ISE deployment
Upgrade cycle completed
Partial Cisco upgrade work finished instead of left on older firmware
Renewed after year one
June-to-June delivery completed, then signed for another year
The challenge
A sunsetting Cisco managed service left a ~100 firewall estate without a prepared operator
A large county health system was running device management through Cisco’s managed service, CMS. That service was being sunset. Without a replacement, those devices would not have been managed. The estate was on the order of 90 to 100 firewalls, plus the ISE deployment. Standing up management of that scale is not work a team can pick up without preparation.
The stakes sat in the handoff, not in a greenfield build. Cisco’s team was already partway through an upgrade cycle. If that work stopped, a large share of devices would have stayed on older versions, with the security exposure that follows. The constraint was continuity: the health system needed an operator wired into Cisco closely enough to finish what CMS had started, rather than absorb a break in coverage and then try to reconstruct the estate.
Why Gruve
Gruve was chosen because it was wired into Cisco for a clean CMS offboarding
The decision turned on the Cisco relationship. Cisco needed a managed service provider that already understood how Cisco does business and how Cisco products work, so the health system could leave CMS without losing continuity. A provider without that relationship would have made the transition from the old service to the new one much harder.
What that relationship then made possible was delivery as one team. SOC, NOC and device management often sit with separate vendors. Here they did not. Cisco did not have to assemble three companies to replace one sunsetting service.
The approach
Four steps took an unfinished CMS estate to a managed operating baseline
Step 1
Onboarding
Gruve built a full picture of what had to be covered, including upgrade work already in flight, and carried that work forward instead of restarting it.
Step 2
Technical review
Gruve reviewed the operating infrastructure, especially on the NOC side, documented how devices were configured, and turned that into recommendations.
Step 3
Optimization
Gruve implemented improvements with the customer, including firewall-rule changes and ISE architecture work identified in the review.
Step 4
Process and procedure
Gruve put standard workflows in place so ongoing NOC and device-management operations would run consistently.
What changed in the operating rhythm
SOPs and MOPs arrived fast enough that the customer, not the provider, became the review bottleneck. Even before every document had been validated, the content existed, which meant there was something to use if an incident hit.
Where it runs
Managed device operations across ~90-100 firewalls and the ISE deployment, with NOC and device management handled as part of the same team that also covers SOC.
The outcomes
The estate is back on an operating baseline, and the internal team is no longer stuck fighting fires
Speed to production
SOPs and MOPs were produced faster than the previous CMS team had been able to. The customer became the bottleneck for review, which is the better problem: the operating content exists even if it has not all been signed off.
The previous managed-service team had been the bottleneck for SOPs, MOPs and guidance on how to run the devices.
Risk reduced
The unfinished upgrade cycle was completed. Devices were not left on older firmware. Firewall rules were optimized and ISE deployments were improved, bringing infrastructure back to an ideal operating baseline.
A paused upgrade cycle would have left a large share of the estate on older versions, with the exposure that creates.
Control and sovereignty
Device configurations were documented, recommendations were delivered, and standard workflows now cover ongoing NOC and device-management operations.
Operating knowledge was slow to leave the sunsetting CMS team.
Cost per outcome
Costs have gone up slightly. This is not a savings story. The return is reliability, speed, and freed internal capacity: less time fighting fires, more time on forward-looking network and user-experience work. Outage-cost reduction is not quantified here because pre-Gruve outage data was not in the source.
Status-quo device management was the sunsetting CMS service.
The path not taken
The realistic alternative was an expensive, fast replacement or an unmanaged upgrade cycle
Without Gruve, the health system would have needed a replacement for CMS on a clock it did not control. The path named in the source was a large, expensive competitor brought in quickly to stand up coverage. That would not have been cheap.
The other path was worse in a quieter way: no prepared operator, the upgrade cycle paused, devices left on older firmware, and the internal team stuck managing the environment it already had instead of improving it.
What would have happened
The cost of the old path was outdated firmware and a team that could not move forward
Staying on the old path meant the unfinished upgrade cycle would have stopped, devices would have remained on outdated firmware, and network improvement would have stayed stagnant while the team kept absorbing day-to-day operations. The health system would have kept the estate. It would not have kept a prepared operator.
What's next
Year two starts from a restored baseline, not from a scramble
The first year of delivery ran June to June. The health system then renewed. Day-to-day device operations and monitoring are no longer the thing the internal team has to hold itself, which is what makes forward-looking improvements possible.
Who else this applies to: public sector healthcare and enterprise teams facing a Cisco CMS sunset, or any buyer that needs a ~90-100 firewall and ISE estate taken on as a prepared operation, with SOC, NOC and device management coming from one team rather than three vendors.
