The Challenge
The Social Security Administration manages one of the largest and most sensitive data environments in the federal government. As part of a broader effort to modernize its cybersecurity posture, SSA partnered with CISA’s Continuous Diagnostic and Mitigation (CDM) program — a governmentwide initiative to strengthen federal network visibility and risk management.
The challenge: SSA needed to expand and enhance its CDM implementation through an enterprise-wide logging and observability initiative called Better Convergence. This required processing billions of data records from multiple security tools into a unified, analyzable format — a complex data engineering problem requiring both deep technical capability and cybersecurity domain knowledge. Without it, security analysts and leadership lacked the consistent, reliable data sets needed for governance, risk, and compliance decision-making.
The Solution
Our engineers focused on aggregating data from multiple security tools managed in SSA’s environment — enabling automated risk assessment and prioritization across four critical domains:
RHO embedded consultants within data engineering team — a specialized group to support the Better Convergence initiative end to end.
- Asset Management — maintaining accurate visibility into SSA’s full technology inventory
- Identity & Access Management — tracking user accounts and access controls across the enterprise
- Network Security — monitoring traffic, connectivity, and threat indicators
- Data Protection — ensuring sensitive records are handled in compliance with policy
The CIM-compliant data sets RHO helped produce feed directly into the risk dashboards — giving security analysts and leadership a real-time, data-driven foundation for governance, risk, and compliance (GRC) auditing. RHO also supported SSA’s policy and GRC management approach, helping quantify organizational security impact as CISA’s CDM tool collection and log sources evolved over time.
The Outcome
- Billions of data records processed from multiple security tools into a unified Common Information Model
- Enabled automated risk assessment and prioritization across asset management, IAM, network security, and data protection
- Strengthened SSA’s adaptive cybersecurity and risk governance framework
- Improved security policy compliance and reduced policy violations by giving analysts reliable, CIM-compliant data for GRC auditing
- Enhanced risk-based decision-making for SSA leadership through live CDM and SSA risk dashboard feeds