Cloud Security Platform for a Genomics Laboratory
Petabytes of patient genomes locked behind one set of guardrails, with no slowdown in sequencing turnaround.
Client name withheld by agreement- Client
- Clinical genomics diagnostics laboratory
- Region
- Houston, Texas
- Year
- 2024
- Duration
- 24 weeks
- Scope
- 3.2 PB of sequencing data · 140 AWS accounts
- Practice
- AI, Cloud & Digital Trust
The challenge
What was at stake.
A clinical genomics laboratory sequences tumor and hereditary samples for oncologists across the country, generating 3.2 petabytes of patient data in AWS. Research teams had spun up 140 accounts, and several sequencing buckets were readable far more widely than anyone intended.
The lab is held to HIPAA and CLIA, and its pharma partners audit data handling. Turnaround time is how it wins business, so security could not add hours to a sample.
What we did
The approach, step by step.
- 01
Data classified at the bucket
Every storage location was tagged by data type and sensitivity, and public or cross-account access was removed or justified in writing.
- 02
Account structure rebuilt
Production clinical pipelines, research and partner sharing moved into separate organizational units, each with its own service control policies.
- 03
Encryption the lab controls
Customer-managed keys with per-environment separation, and partner data shares delivered through time-limited, logged access instead of copies.
- 04
Checks before deploy
Policy-as-code scanning in the pipeline blocks insecure storage, open security groups and unencrypted volumes before they reach an account.
- 05
Detection tied to response
Unusual data access and egress now page the on-call security engineer with the bucket, owner and runbook attached.
Outcomes
What changed, in numbers.
- 140
- AWS accounts under central guardrails
- 3.2 PB
- of genomic data encrypted with lab-held keys
- 0
- publicly readable storage locations remaining
- 0 hrs
- added to sample turnaround
Our scientists did not notice the change. Our auditors did, and they liked what they saw.
Services delivered
Related engagements
More work in AI, Cloud & Digital Trust.
-
Denver, Colorado · 15 weeks
AI, Cloud & Digital Trust · 2025SOC 2 Type II for a Legal E-Discovery PlatformAn unqualified Type II report covering Security and Confidentiality, delivered before the Am Law 100 renewal cycle.
-
Seattle, Washington · 22 weeks
AI, Cloud & Digital Trust · 2026 · OngoingISO/IEC 42001 and Adversarial Testing for a Contact-Center AI ProviderVoice agents that can no longer be talked into reading back card numbers, and an AI management system heading for certification.
-
Huntsville, Alabama · 18 weeks
AI, Cloud & Digital Trust · 2025CMMC Level 2 for a Satellite Communications IntegratorEvery practice met at the C3PAO assessment, with no POA&M items carried forward.
Let’s talk about your version of this.
Share what you are up against. A senior practitioner who has delivered this kind of work will reply within one business day.