Project Overview
In November 2016, an Export Controls business analyst identified a critical compliance gap threatening $2 billion in government contract revenue. Cummins' export-controlled intellectual property resided in systems that failed to meet NIST SP 800-171—federal standards mandating specific controls for any non-federal system storing, processing, or transmitting Controlled Unclassified Information (CUI). Without a compliant content management platform deployed by October 1, 2017, Cummins would be disqualified from prime and subcontractor government contracts representing 5% of global revenue—damaging both revenue and relationships with federal agency partners.
I led the end-to-end program: vendor evaluation, solution selection, contract negotiation, and implementation of a dual-environment platform built on Box for Government (a FedRAMP Authorized cloud environment for export-controlled operations) and Box for Enterprise (a commercial instance for broader collaboration). We delivered the compliant environment ahead of the October deadline. The commercial platform scaled to support over 10,000 global users within two years.
Project Scope
The initiative encompassed vendor evaluation and selection, contract negotiation, and parallel deployment of two distinct cloud environments — a compliance-focused platform for export-controlled operations and a commercial collaboration platform for broader enterprise use. The scope extended beyond immediate regulatory requirements to establish a strategic collaboration capability serving joint ventures, field operations, and international partnerships.
- FedRAMP Authorized Environment — Deployed within a federally authorized cloud service meeting rigorous security standards for government data
- NIST SP 800-171 Compliance — Satisfied all 110 security controls required for systems storing, processing, or transmitting Controlled Unclassified Information
- U.S. Geo-Located Servers — Ensured all export-controlled data resided on servers physically located within United States borders
- Large File Support — Enabled secure sharing of files up to 2GB to support engineering documentation and technical specifications
- CUI Access Controls — Restricted environment access to personnel authorized to handle Controlled Unclassified Information
- Global User Scale — Supported 10,000+ internal users and unlimited external collaborators within two years of launch
- Joint Venture Support — Enabled secure collaboration with external partners on co-development projects and strategic partnerships
- Field Technician Access — Provided mobile-first solutions for service technicians accessing technical documentation in the field
- International Operations — Supported collaboration in foreign-constrained environments with appropriate data sovereignty controls
- External Sharing — Facilitated controlled information exchange with suppliers, customers, and partners outside the Cummins network
- Custom Workflows — Designed information governance processes aligned with Cummins operational requirements
- Box Platform API Integration — Leveraged Box Platform APIs to extend native functionality for Cummins-specific use cases
- Controlled Content Access — Developed tailored permission structures for field technician guide distribution
- Mobile Optimization — Created mobile-first experiences for users accessing content from tablets and smartphones in field environments
My Role
I served as Project Lead and Product Owner for Cummins' Box cloud collaboration platform initiative, owning end-to-end responsibility for vendor selection, implementation, and ongoing platform evolution — balancing urgent compliance requirements with long-term strategic platform vision across a complex cross-functional stakeholder environment.
My primary responsibility centered on protecting $2 billion in government contract revenue by implementing a NIST SP 800-171 compliant content management system before the October 1, 2017 regulatory deadline. I led comprehensive requirements gathering by analyzing all 110 security controls and engaging stakeholders across Export Controls, Cybersecurity, Product Engineering, and Quality to identify needs beyond baseline compliance. I conducted enterprise-wide discovery to confirm no existing Cummins platforms satisfied requirements, validating the business case for external procurement.
I owned the vendor evaluation and selection process from RFI through contract execution. After identifying three FedRAMP Authorized vendors meeting DFARS 252.204-7012 requirements, I developed detailed RFI and RFP documentation articulating Cummins' technical specifications and business requirements. I coordinated vendor demonstrations, ensuring each showcased capabilities relevant to our specific use cases. I assembled a cross-functional source selection committee and developed evaluation criteria using a Cause & Effect (C&E) Matrix to enable objective, weighted scoring across proposals. As primary vendor point of contact, I orchestrated evaluation sessions, managed communications, and facilitated the decision to select Box for both compliance and commercial environments.
Following vendor selection, I navigated the $2.5 million contract through Legal and Procurement approval processes and shepherded the solution through Cummins' SDLC onboarding procedures. I partnered closely with Box's implementation team to complete deployment in under one month — meeting the critical October deadline and protecting $2 billion in government contract eligibility.
Beyond initial implementation, I evolved into the strategic platform owner, curating a product backlog that extended Box's native capabilities through Box Platform API integrations. I prioritized enhancements including controlled access frameworks for field technician documentation and mobile-first experiences, addressing operational efficiency opportunities across diverse user segments. Within two years, the commercial platform scaled to support over 10,000 global users and enabled unlimited external partnerships for joint ventures and international operations.
