SunStream is a managed security services provider. Our mission is to simplify cybersecurity while enhancing organizational resilience—offering strategic value through deep domain expertise, transparency, and proactive service delivery.

SunStream specializes in delivering robust and scalable cybersecurity services coupled with strategic guidance, enabling customers to stay ahead of evolving threats, industry adaptations, and Farm Credit Administration (FCA) regulation changes. Our security portfolio is designed to meet the unique operational, compliance, and risk management requirements of institutions that operate within the Farm Credit System.

Security services are offered a-la-carte. SunStream will work with you to evaluate your cyber needs, and design a bespoke, cost-effective service package to meet the specific needs of your business.

Service Value and Key Benefits

• Offers flexible selection of security controls tailored to Farm Credit’s unique needs
• Reduces cybersecurity risk from threats like ransomware
• Provides trained cybersecurity experts who play a crucial role in protecting computer systems, networks, and data from unauthorized access
• Continually evolves to safeguard information from novel threats or potential vulnerabilities

Detailed Description

Virtual Chief Information Security Officer Service (vCISO)

Our vCISO service offers access to experienced cybersecurity leadership without the expense of a full-time executive. We assess your current program maturity, design strategic roadmaps, develop governance policies, assist with audits, and ensure alignment with the Farm Credit Administration (FCA) Cyber Rule 609, Federal Finance Institutions Examination Council (FFIEC), Gramm-Leach-Bliley Act (GLBA), and National Institute of Standards and Technology (NIST) standards. Our ongoing advisory services facilitate the continuous improvement of your cybersecurity program, enabling you to more effectively manage evolving threats and risks.

Security Awareness Training and Phishing Simulation

Cybersecurity starts with people. Our engaging, web-based training modules are designed to foster a culture of security within your organization. Delivered quarterly or as needed, training is complemented with simulated phishing tests to measure preparedness and identify user behavior trends.

Security Operations

Cloud Security (Microsoft 365 Hardening)
Many organizations underestimate the complexities of configuring Microsoft 365. SunStream collaborates with IT teams to establish secure baseline configurations and advanced controls (such as Conditional Access Reviews) to safeguard user data, communications, and endpoints in alignment with Center for Internet Security (CIS) and National Institute of Standards and Technology (NIST) standards where applicable.

Data Loss Prevention (DLP)
Our DLP solution inspects outbound network and email communications to detect and prevent improper transmission of sensitive information. Flexible rule sets allow identification of Personally Identifiable Information (PII), account data, and financial records, with alerts centrally monitored and addressed based on their severity.

Email Gateway Security
Email is one of the most targeted attack vector in financial services. Our managed secure email gateway filters threats through threat intelligence, sandboxing, and AI-driven detection, with rules finely tuned to your business environment.

Advanced Endpoint Security
Endpoints present a critical frontline in the battle against cyber threats. Our Endpoint Detection and Response (EDR) service continuously monitors endpoints for malicious activity, automates responses, and isolates compromised assets to minimize impact. Alerts are reviewed and triaged by cybersecurity experts.

Security Information and Event Management system (SIEM)
Our SIEM platform collects and analyzes log data from across IT environments to detect threats in real time. Utilizing machine learning and behavioral analytics for incident detection and prioritization, it features automated responses, funnel dashboards, reporting, one-year data retention, and integration with a wide variety of log sources.

Managed Security Operations Center (SOC)
Our 24/7 managed security service monitors and responds to cyber threats using expert analysts and AI-driven tools. Covering networks, endpoints, cloud services, and applications, it offers monitoring and alerting, periodic threat hunting, incident investigation, and compliance support.

Mass Notification System (Everbridge MNS)
Effective communication is vital during emergencies. Our mass notification system enables real-time alerts via voice, email, and text. Optional features include message confirmation, polling, and automated workflows, supporting incident management, remote worker outage communications, bad weather alerts, and crisis response.

Web Access Filtering
Our web filtering solution enforces acceptable use policies by restricting access to risky or non-compliant websites, supporting FCA regulations.

Cyber Tabletop Simulations

SunStream offers tailored, scenario-based simulations to test your organization’s cyber incident response in a safe, guided environment. Led by expert facilitators, these exercises engage key stakeholders to evaluate readiness, communication, and decision-making during a simulated cyberattack. A post-exercise report with actionable insights is included.

Vulnerability Scanning, Management and Remediation Assistance

Our vulnerability scanning and management service regularly scans workstations, servers, and infrastructure to identify vulnerabilities and prioritize fixes based on exploitability and business impact. We provide prioritization and remediation consultation following security best practices.

Penetration Testing and Remediation Prioritization

Simulating a real-world attack is the best way to understand your vulnerabilities. We conduct tests across networks, systems, and physical environments using industry-standard Penetration Testing Execution Standard (PTES) methodology. Following the tests, we provide consulting services that include action plans and remediation recommendations.

Identity and Access Management (IAM)

Our IAM services manage the identity lifecycle to ensure the right individuals have the right access at the right time. This includes fulfilling provisioning and deprovisioning requests, facilitating regular entitlement reviews, and enforcing policies to uphold the principle of least privilege.

Business Service Manager

Dave Johnson

Risk Information Security Officer
[email protected]