Programmes, evidence and the numbers that followed

Challenge

Meridian Bank operated 214 production workloads across two ageing data centres, one of which was approaching end of lease with no renewal option. The estate carried a heavy compliance burden: PCI DSS scope covered 41 systems, and an incoming DORA assessment required demonstrable operational resilience testing that the existing architecture could not support.

Two prior attempts at migration had stalled. Application dependencies were undocumented, change-freeze windows around month-end and regulatory reporting left narrow migration slots, and the board had explicitly ruled out any customer-visible outage.

Solution

NexaCore began with an eleven-week discovery that produced a dependency map for all 214 workloads and a disposition register agreed line by line with application owners. Thirty-one systems were retired outright; 46 were re-platformed onto managed database and container services; the remainder were rehosted into a hardened multi-account landing zone.

• Regulated landing zone with enforced data residency and segregated PCI scope
• Nine migration waves scheduled around close and reporting calendars
• Full rehearsal of every wave in a production-parity environment
• Automated resilience testing evidencing DORA scenario requirements
• Transition to a NexaCore 24×7 managed service at wave five

Challenge

Following two acquisitions, Halcyon Health operated nine clinical and administrative source systems with no common patient identifier. Quality reporting for CMS submissions was assembled manually across 31 spreadsheets each quarter, taking a team of six analysts eleven working days and producing figures that clinical leadership did not trust.

A prior internal data-warehouse initiative had been paused after an information-governance review found that protected health information was being replicated into environments without documented access controls or audit logging.

Solution

NexaCore established the data governance model first — domain ownership, a certified metric catalogue and a documented lawful basis for every data flow — before any platform build began. A HIPAA-aligned lakehouse was then implemented with field-level encryption, tokenised patient identifiers and full audit logging.

• FHIR R4 interoperability layer across all nine source systems
• Enterprise master patient index with deterministic and probabilistic matching
• Automated CMS quality-measure pipelines with reconciliation controls
• Role-based clinical dashboards approved by the medical executive committee
• Six-month dual-run before the manual process was retired

Challenge

Vertex Industries ran four regional ERP instances inherited through twenty years of acquisition. Group consolidation required 340 manual journal adjustments each month, the financial close took fourteen working days, and the audit committee had formally recorded consolidation risk on the corporate risk register for three consecutive years.

Master data was the deeper problem: the same physical component carried up to seven distinct material numbers across instances, making group-level spend analysis and inventory optimisation effectively impossible.

Solution

The programme ran master-data remediation ahead of, not alongside, the technical migration. NexaCore built a governed material and vendor master with automated deduplication, then designed a single global S/4HANA template with a controlled localisation layer for statutory requirements in eleven countries.

• 1.4 million master records cleansed, deduplicated and governed
• Interface estate rationalised from 291 point-to-point links to 96 managed APIs
• Global template with localisation for 11 statutory jurisdictions
• Four full cutover rehearsals including finance reconciliation steps
• Three-month hypercare covering two complete month-end closes

Challenge

Caldera Energy operated 63 substations and four generation sites on operational technology networks that had been progressively, and informally, connected to the corporate network over a decade. A national regulator's NIS2 readiness assessment identified flat network architecture, shared engineering credentials and no monitoring coverage of OT protocols as material findings requiring remediation within eighteen months.

Any remediation had to be delivered without interrupting generation or distribution, and without requiring changes to safety-instrumented systems that could not be re-certified within the window.

Solution

NexaCore delivered a phased segmentation and monitoring programme built on passive discovery first — six weeks of read-only traffic analysis established a verified asset inventory before any network change was proposed. Segmentation followed IEC 62443 zone and conduit modelling, with every change approved by site engineering leads.

• Passive asset discovery identifying 4,180 previously uninventoried OT devices
• IEC 62443 zone and conduit segmentation across all 67 sites
• Privileged access management replacing shared engineering credentials
• OT-aware monitoring integrated into NexaCore's 24×7 security operations centre
• Tabletop and live incident rehearsals with the national regulator observing