Nightwing, a national security solutions provider, needed to meet stringent federal standards by aligning with CMMC Level 2 and NIST SP 800-171 certifications. They chose Okta Workforce Identity as their core identity solution to secure sensitive government data and automate access controls. With Universal Directory, Lifecycle Management, Single Sign-On, and Adaptive MFA, Nightwing has unified access and authorization and achieved compliance without sacrificing usability.
Challenge
Establishing identity to protect key government technology
Nightwing is a national security solutions company that delivers a comprehensive set of cutting-edge, technology-enabled capabilities to help its customers in the U.S. federal government and other sectors, execute any mission. The company provides cyber operations, technical collection mission technology, secure communications, and cyber defense. Providing this support means that Nightwing must meet (and exceed) federal cybersecurity requirements. It also means continuously proving they can safeguard sensitive government data inherent to their services.
“As a national security-focused organization, we have to be able to substantiate our security posture for auditors, customers, and prospects who entrust us with sensitive information,”
says Zachary Ostroff, senior manager of cybersecurity governance, risk, and compliance.
“Frameworks like CMMC and NIST SP 800-171 set the baseline, but Okta enables us to enforce those requirements in a consistent, measurable way.”
Having clear, centralized visibility into who is accessing which systems, from where, and under what conditions allows Nightwing to demonstrate compliance and reassure stakeholders that their controls are both robust and repeatable.
Decision Criteria
Leading compliance through consistent, automated identity controls
Nightwing needed to prioritize automation to make it as easy as possible to enforce authentication and authorization across the organization’s dozens of SaaS and on-premises tools. They needed tight, role- and project-based access controls to protect their sensitive systems and datasets. The company implemented Okta Workforce Identity as their core identity platform to centralize their user identity management and prepare for automating to the fullest possible extent.
Okta’s pre-existing FedRAMP authorization and alignment with federal cloud security guidelines gave Nightwing the confidence that the partnership would help them achieve their CMMC Level 2 certification quickly.
“Static security controls only get you so far; our risk profile changes from moment to moment based on the user, device, and location,”
says Andrea Dowling, senior manager of platform administration.
“Okta’s adaptive policies let us respond automatically by stepping up authentication when something looks unusual while keeping everyday access simple for our users. That balance between stronger security and less friction is essential to keeping our teams focused on mission, not on logins.”
By prioritizing identity at the start of their certification journey, Nightwing can easily enforce least-privilege access based on role and mission needs, apply consistent access policies, and maintain a comprehensive audit trail.
Solution
Strengthening trust with federal customers without sacrificing usability
By bringing all of Nightwing’s identity management into a centralized platform, the company has greater context and visibility across every facet of its identity infrastructure and its more than 180 active applications. This number includes not only core SaaS tools but also bookmarks that centralize access to additional cloud-based login URLs and other frequently used web resources, giving users one consistent place to start their work.
With Universal Directory, Lifecycle Management, and Workflows Nightwing has a single source of truth for identities while being able to automate provisioning and deprovisioning as people join, change roles, or leave, reducing manual effort, human error, and risks of data leakage. Now, when someone leaves the organization, access is revoked consistently and quickly across every application and related bookmark, strengthening security and compliance. All of these accounts are secured by Okta Single Sign-On (SSO) and Adaptive Multi-Factor Authentication (AMFA) to ensure only the right users have the right access at the right time.
With SSO available, the company can reduce credential sprawl for users by simplifying access, while Adaptive MFA policies allow Nightwing to use contextual signals to adjust authentication requirements. This means all of Nightwing’s teams have predictable, streamlined ways to access tools while still allowing them to enforce stronger controls for more sensitive assets. Streamlining also minimizes IT tickets related to access changes, allowing their IT team to focus on solving more complex problems.
Connecting all of these controls through Okta gave Nightwing the consistency and visibility into any identity and access-related action and simplified the process for sharing that data with customers and third-party assessors. “Demonstrating we can protect our customers’ most sensitive data is just as important as delivering mission capabilities. Okta allows us to operationalize compliance requirements consistently across our environment and clearly show how identities and access are secured,” says John Xereas, CIO. “Consistency and transparency are critical to earning and maintaining our government partners' trust.”
With this, the team could more quickly demonstrate CMMC Level 2 compliance with clear, technical evidence and map identity controls directly to NIST SP 800‑171 and other DoD requirements. The results are a security posture that meets stringent federal standards without sacrificing usability and reinforces the company’s role as a trusted, security-focused partner for national security missions.
About Customer
Nightwing is the cyber and national security solutions company defining the edge of possible to advance our national security interests. The company delivers the most advanced full-spectrum cyber, data operations, systems integration, and intelligence services for government agencies, businesses, and organizations. Nightwing is proud to partner with our government and commercial customers to protect their most critical information, systems, and operations with breakthrough technology and world-class talent. Headquartered in Dulles, Virginia and previously part of a leading Fortune 100 company, Nightwing became independent in April 2024. Learn more at Nightwing.com.
