PKI modernisation and make-or-buy decision for a logistics and service provider

Situation

A logistics and service provider relies on certificates to authenticate systems and secure communication. Its public key infrastructure (PKI) and certificate processes were due for modernisation. Management needed a sound basis for deciding whether to keep running a PKI in-house or to buy it as a service, and what the change would mean for operations, contracts and data protection.

Approach

Over six months, WCS took the following steps:

• Analysis of the existing PKI and certificate processes, with an assessment of technical and organisational risks.
• Vendor evaluation of four solutions, DigiCert ONE, Sectigo, KeyTalk and Microsoft PKI, against security, SLAs, integration and total cost of ownership.
• Business case for make or buy, with CapEx and OpEx, presented as a decision paper at director and C-level.
• Rollout plan for the target architecture, with milestones, responsibilities, change management and knowledge transfer.
• Requirements for licensing, data protection and ISO 27001, clarified with legal, procurement and the vendors.

Result

Management received a decision paper that compares four solutions on the same criteria and sets out capital and operating costs for both options. Licensing, data protection and ISO 27001 questions were clarified with legal, procurement and the vendors as part of the project. The rollout plan defines milestones, owners and the knowledge transfer to the internal team, so the change can be carried out in planned stages.