Cisco ISE Zero Trust network access control for a major academic medical center

The challenge

A major U.S. academic medical center needed to bring Zero Trust discipline to network access across a sprawling hospital environment: many thousands of endpoints, a mix of managed Windows and Mac workstations, personal and vendor devices, and a large fleet of clinical and medical equipment that cannot run a standard network supplicant. Access had to depend on who the user is and whether the device is healthy, without ever interrupting patient care. A national IT solutions partner engaged VeeMost to take the lead on the program and re-plan it end to end.

Our approach

1. Took the lead and re-planned: VeeMost led the identity services program from design through go-live, redesigning the deployment and migrating the medical center off its legacy Cisco ISE environment onto a new, highly available ISE deployment.
2. Designed policy around the departments: worked with Help Desk, Server, Network, End-User Computing, Field Services and Clinical Engineering to understand how each group actually works, then built 802.1X access policy to match.
3. Strong device identity: authenticated managed Windows and Mac devices with EAP-TEAP and certificate-based EAP-TLS, issuing and deploying certificates through GPO and Jamf, so a corporate device proves what it is before it is trusted.
4. Health before access: enforced posture compliance so a device only reaches the network if it meets policy, including up-to-date antivirus, disk encryption and current patches; non-compliant devices are redirected to remediation.
5. Secured every path, including vendors: applied the same identity and posture rules to wired, wireless, guest, BYOD and remote-access VPN (Cisco AnyConnect with Duo MFA), so third-party vendors get least-privilege access whether onsite or remote.
6. Solved the medical-device problem: integrated a third-party medical-device visibility platform with Cisco ISE over its API, importing a live inventory of clinical equipment so each device is classified and authorized by profile instead of left as an unmanaged risk.
7. Tested, piloted and handed over: ran detailed wired, wireless and VPN test plans, piloted with a controlled group, rolled out in phases, upgraded the ISE platform with no service outage, and delivered operational runbooks and escalation playbooks so the client’s own teams can run it.

The solution

VeeMost delivered a hospital-wide Zero Trust access model on Cisco ISE. Every user and device is authenticated and health-checked before it reaches the network, across wired, wireless and VPN. Corporate devices are identified by certificate; personal, guest and vendor devices get least-privilege access; and non-compliant devices are kept out until they are remediated. Crucially, the clinical equipment that standard access control usually cannot handle is profiled by a third-party platform and authorized in ISE through an API integration, so medical devices are secured rather than exempted. The program was tested, piloted and rolled out in phases without disrupting clinical operations, and handed over with the documentation and escalation playbooks the medical center’s teams need to run it day to day.

Results