Situation: Preparing for a major OnGuard Enterprise system upgrade

CITGO, a major petroleum refiner and distributor headquartered in Houston, Texas, operates three major refineries in the U.S. plus various other terminals and pipelines, along with the corporate headquarters office, all running on an Enterprise system of OnGuard, comprising a total of four corporate regions. Prior to upgrading to OnGuard Enterprise, the CITGO team had historically done their own periodic OnGuard upgrades, with assistance from their LenelS2 Value-Added Reseller (VAR) during the process.

CITGO had been running OnGuard 7.5 before electing to go to OnGuard Enterprise, and had initially planned to continue the approach of performing upgrades internally once they upgraded to Enterprise. With a combination of new features, new integrations, and enhancements to cybersecurity capabilities, ensuring that CITGO was on the latest version of OnGuard was critical to their long term vision of Security Technology. There was, however, a increasing sense that every upgrade had been a growing challenge for the team, with internal support structure model challenges and a corporate culture that gave members of the IT team the discretion to adopt policies they viewed as best suited to each individual location.

Charlie Seigle, CITGO’s Information Analyst charged with maintaining security across the company, noted that performing system-wide upgrades already was a challenge based on the operating structure. The technical sophistication of OnGuard-- where getting replication to work is an essential aspect of a successful upgrade--raised the caliber and volume of resources needed to ensure success.

Reflecting on previous OnGuard upgrades, Mr. Seigle shared:

“In the past we had a minimum of eight people tied up during the OnGuard installs and these upgrades with significant hours going in. We would go through, do the test environment, we would reset it, refresh it, do it again, do it again, do it again, and we were just spending countless hours. But after we adopted the OnGuard Enterprise system, we realized we needed to have more synergy there.”

Historically each location had a minimum of two or three LenelS2-certified technicians on-staff who had been supporting OnGuard since it got installed. But in the last 5-7 years, the IT department has experienced staff departures alongside employee attrition, resulting in CITGO losing over 100 years of internal OnGuard experience. Ultimately there was recognition that upgrading the OnGuard Enterprise system running at CITGO across multiple locations would require additional expertise and support to ensure an optimal outcome.

Task: Devising a strategy to simplify the OnGuard Enterprise system upgrade

In early 2025, CITGO was ready to upgrade its OnGuard Enterprise system from version 7.6 to version 8.2. With the recognition that the upgrade process had become a strain on internal processes and limited resources, CITGO and Mr. Seigle began to look for a better way to achieve the upgrade with minimal disruptions to daily operations.

Historically, the upgrade process was a delicate one with respect to ensuring continuity of operations at all the locations, especially the refineries. For operations running 24 hours a day, the “nightmare scenario” was having a refinery site’s security system go down at shift change, preventing people from coming in and getting out. Mr. Seigle explained:

“We’re limited in certain things that we can do. We upgrade all the regions… the whole system’s down, and then the whole system comes back up. And that takes the better part of a day, doing it ourselves.”

Not surprisingly, there was a lot of internal reluctance to give over that type of control and let someone else drive CITGO’s security upgrades; Mr. Seigle shared that internal policies and controls limited even his access to the regional and site servers where OnGuard resides.

Through professional networking and benchmarking with other energy and petroleum industry security professionals, Mr. Seigle was introduced to LenelS2’s Professional Engineering Services (PES).

Action: Entrusting LenelS2’s PES team with the OnGuard Enterprise system upgrade

As it came time for CITGO’s most recent upgrade to OnGuard Enterprise, the team decided to use LenelS2’s Professional Engineering Services. Mr. Seigle and the CITGO team worked with a dedicated LenelS2 PES project manager who lined up and coordinated all the needed resources after a couple of scoping and planning meetings up front.

One of the first steps was developing the overall upgrade strategy for all the CITGO locations. Historically, CITGO had employed an upgrade strategy that effectively brought down all four regions at once. During that outage, people could continue to badge in and out, but it was not possible to create any new badges.

LenelS2’s PES team, however, suggested the approach of looking at the four regions that need to be upgraded with the global server individually. This translated into upgrading one region to OnGuard Enterprise Global on one day, activating two more regions the next day, and the fourth and final region the last day.

PES suggested for the upgrade that CITGO simply turn off the replication within OnGuard during each site upgrade rather than taking the whole system down. This maximized each site’s uptime during the upgrade. Ultimately CITGO didn’t have a single site that was down more than just two to three hours with respect to the ability to print new badges and perform cardholder changes.

Result: A smooth, confident, cost-effective OnGuard Enterprise upgrade

Through the LenelS2 PES upgrade support for CITGO’s OnGuard Enterprise systems, when it was time for each of the four regions to get upgraded, they went offline and while most of the sites were completed in two hours or less, one region took all of three hours to complete. In total, the entire upgrade of the four regions occurred over three days.

The CITGO team contrasted a relaxed OnGuard upgrade spread over three days against their previous experience having everything down everywhere across all the company’s locations for the better part of a day. And rather than having ten IT resources consumed for the entirety of the full OnGuard upgrade, only the IT team members who needed to be involved while their site was being upgraded needed to be involved on any given day.

Mr. Seigle shared that CITGO’s VARs have increasingly focused on breadth of available security solutions. In contrast, the insights and depth of OnGuard product knowledge that the LenelS2 PES team shared was very educational for the CITGO team:

“We picked up a lot of extra little things that were not part of the upgrade – if you follow just the way the PES engineer went about troubleshooting things—we learned so much more from working with a true OnGuard expert versus someone who’s ‘pretty good’ at it like we get with the VARs. Sometimes we can find a VAR that’s got a really good OnGuard tech, but they’re never going to be at the same level as someone that we get from LenelS2’s PES team. We have confidence from going through the process that by using LenelS2’s PES team, we’re always going to get ‘the guy’.”

Ultimately CITGO was able to get its OnGuard Enterprise upgrade done in a much more efficient manner, while conserving much internal overhead and person-hours, but also picked up tips and additional skills for troubleshooting, especially for certain replication issues that crop up from time to time and how to correct them.

And while there had been initial resistance, it turned out that everyone on the CITGO team with the OnGuard upgrade agreed they would never do another upgrade again without the support of LenelS2’s Professional Engineering Services. Mr. Seigle shared:

“It was the smoothest, probably most cost-effective upgrade that we have ever done. By using LenelS2 PES, we cut down a significant amount of wasted man hours and we got it done right the first time. We didn’t have to wipe out and refresh our test environment again and try it again. We didn’t have to go through those learning-as-you-go challenges. While you gain a lot from that, when things go wrong and you learn something and you figure out how to correct it, it still costs a lot of money. Now with PES involved we learn those same things in less time.”