Refresh cycles, acquisitions, carve-outs, site standups, workforce changes, vendor replacements — at enterprise scale, every one of these becomes a device program. Most enterprises run each one as a separate scramble with a separate vendor. Surya runs them all through one operating model: wave-based, ticket-driven inside your ITSM, and auditable from receiving dock to disposition certificate.
4,000 endpoints
Operated at scale for a private equity-backed national accounting and advisory firm.
FTSE 100
Global enterprise networking operated across every region by one operator.
90% target
Remote device recovery with full chain of custody.
/ 01 The Program Catalog
Every one of these arrives at your desk looking like a different problem, owned by a different executive, on a different clock. Underneath, they are the same physical work: devices imaged, moved, recovered, and accounted for — at a scale and cadence your internal team was never staffed for. We run all eight through the same waves, the same tickets, the same chain of custody.
Program / 01
Replacing the fleet without an eighteen-month project.
Cohort-based waves by role, site, and region. Swap-in-place with prepaid returns. The old fleet exits through certified disposition while the new one enters through persona imaging — and your team never touches a box.
Program / 02
The deal closed. The clock started.
Thousands of devices re-imaged, re-domained, and reconciled against target-company inventory — on a TSA deadline, not a comfortable one. Identity cutover coordinated with your integration team. Separations run the same play in reverse.
Program / 03
Recovery at reduction scale.
When headcount moves by the hundreds, device recovery becomes the program. Prepaid return kits, guided workflows, a 90% remote-recovery target, automated escalation on non-returns, and Conditional Access cutover coordinated with offboarding — no chase spreadsheet.
Program / 04
A plant opens. An office closes. Both are waves.
New sites come online with pre-staged, persona-imaged devices on a schedule you can plan against. Closing sites are swept, reconciled serial-by-serial, and dispositioned with certificates — nothing walks out unaccounted for.
Program / 05
Intern classes, seasonal waves, project cohorts.
Demand that spikes from dozens to hundreds of ships a month breaks fixed-fee vendors and buries internal teams. Our model is metered — surge months bill for surge work, quiet months don't, and the invoice reconciles to your records either way.
Program / 06
When the incumbent depot is the problem.
We step into live programs mid-stream: inventory reconciled, in-flight waves absorbed, SLAs restored. Enterprises also qualify us as a second source before the incumbent fails — the pilot exists precisely for that.
Program / 07
The end of life is a compliance event.
NIST 800-88 sanitization on-site, certified destruction, disposition certificates per serial, and value-reclaim on remarketable assets — with the recovery and sustainability reporting your ESG and audit teams actually need.
Program / 08
When the CMDB stopped telling the truth.
Physical inventory reconciled against your system of record. Ghost devices found or written off with evidence. Lifecycle states corrected. And because our logistics layer writes to your ITSM directly, the data stays true after we fix it.
/ 02 The Operating Model
/ The Project Model
Each of the eight becomes its own scramble: its own vendor, its own tracker, its own version of how things should work. The depot ships hardware; your internal team absorbs everything else — imaging exceptions, user scheduling, asset reconciliation, returns that never come back. When the project ends, nothing carries forward. The next event starts from zero.
/ The Operating Model
Every device that enters your fleet — through refresh, acquisition, surge, or site standup — moves through one model. Every device that exits leaves through the same model. Imaging happens once, to a persona baseline. Recovery is automatic, not chased. Chain of custody is a system property, not a spreadsheet column. When one program ends, the model stays — and the next event is just another wave.
/ 03 How A Wave Runs
Programs are scoped in waves matched to facility capacity and your business calendar — by division, site, or business unit. Every wave, regardless of program type, runs the same five-step cycle, and every step is a ticket in your system of record.
Inbound fleet received, serialized, and asset-tagged. Every unit enters your ITSM before it enters our racks.
Role-based gold images, BIOS lockdown, peripherals kitted and serialized. Imaging happens once, to the enterprise baseline your persona model defines.
Direct-to-employee shipping for distributed staff, bench swaps and in-place refresh for sites. Users scheduled through your ITSM, not a vendor portal.
Prepaid return kits and guided workflows targeting 90% remote recovery. Non-returns escalate automatically instead of aging in a spreadsheet.
NIST 800-88 wipe, refurbishment for redeployment, or certified destruction — disposition certificate and complete custody record filed against every serial number.
/ 04 ServiceNow Integration
Depot vendors give you a portal and a weekly spreadsheet. Surya operates against your ServiceNow estate under one of three integration models — the same models documented across our enterprise practice.
/ Model 01
Surya operates directly inside your instance as a domain of your multi-tenant architecture. Your incidents, your assets, and our work in one source of truth.
/ Model 02
Surya runs in our own instance, federated to yours via ServiceBridge. Vendor isolation with real-time visibility — built for strict data-segregation requirements.
/ Model 03
A Surya-managed instance fully isolated from your primary estate, for regulated environments that require it.
Whichever model your governance selects, the property that matters holds: every device event is a ticket, and your CMDB stays accurate because the logistics layer writes to it directly.
ServiceNow · Microsoft Entra · Intune · Autopilot · SmartDeploy · Workday and major HRIS platforms
/ 05 Compliance & Assurance
At enterprise scale, the program office doesn't approve a logistics vendor — third-party risk management does. Surya is built for that gate: audited controls, documented policies, and evidence on demand. Send the questionnaire; answering it is standard practice here, not a special request.
/ 01
Audit in progress under continuous control monitoring via Vanta. Report available August 2026. Control evidence and interim attestation available under NDA today.
/ 02
27,000 sq ft access-logged floor with HIPAA-aligned and NIST 800-171-aligned handling, storage, and disposal. Climate-controlled staging. Serialized chain of custody from receiving dock to disposition certificate.
/ 03
NIST 800-88 sanitization on-site, certified destruction, and a disposition certificate filed against every serial number. A 30-day secure hold protects late-arriving legal and data requests before any wipe.
/ 04
Written information security policies — business continuity and disaster recovery, security roles and responsibilities — maintained as living documents and available for review under NDA.
/ 05
Business associate agreements for HIPAA-scoped work. Audit and evidence rights under the master service agreement. Security questionnaires and vendor assessments answered as a standard motion.
Compliance here isn't a checkbox page — it's the same chain-of-custody discipline the operating model runs on every day, made legible to your auditors.
/ 06 Program Pricing
Our rate card is published, and the rates are floors — they do not descend with volume, because they were never inflated to fund the discount. What changes at program scale is structure, not price: master agreement commercials, named service levels, and program governance. The same pricing serves all eight program types, because underneath they are the same movements.
/ Platform access
Program management, wave planning, staging capacity, and real-time inventory across the covered fleet.
/ Movements
Every deployment, recovery, reprovision, and disposition event is billed per movement at the published rate card. The invoice reconciles line by line to your program records — refresh wave, integration cohort, or recovery sweep alike.
/ Device Response Coverage
Same-day swap coverage for your whole population or any HRIS-defined segment, so a failed device mid-program never becomes a help-desk saga.
/ 07 Start With One Wave
Enterprise programs don't start with the whole fleet. They start with a pilot — $2,500, 30 devices, one gold image, one HRIS connector, full ops report at day 60, credited on conversion — or with a single division-scale wave scoped to defined capacity. Measured against the numbers your program office reports up: day-one readiness, recovery rate, custody completeness, and cost per movement. When the wave holds, the model scales — to the next wave, or to the next program type entirely.
/ 08 Scope A Program
Tell us what's driving it — fleet size, sites, ITSM model, and timeline — and our team will respond within one business day.