All posts by : admin-stone

The theme of the inaugural StateRAMP Cyber Summit could be summed up in two ways. The first was federal, state and local government leaders and private sector executives all recognized the need to harmonize the growing assortment of cyber regulations. The second was the underlying benefits of having a set of cybers standards that every agency take advantage of and vendor can achieve.

Over the course of the last four-plus years, it’s become clear that without this baseline of cyber requirements, state and local agencies would have a harder time protecting their systems and data from cyber threats.

“I think everyone has recognized the time, the effort and the expense to properly staff and deliver the assessment and continuous monitoring that comes through StateRAMP, which makes it a great value for the states,” said JR Sloan, the Arizona state chief information officer and co-founder of StateRAMP. “We call it StateRAMP, but it’s really not just states. This goes all the way down to the local and municipal level. And I’ll tell you that I see the same problem with cities, counties, local municipalities, again, they’re trying to get all the advantages of these emerging technologies and the advantage of cloud solutions, but they got to solve the same problem with the data. They were looking to us to say, ‘well, who have you reviewed?’ They started leveraging our list. Well, that’s the same thing with StateRAMP. That great value for them, and in terms of the supplier value proposition, it’s not just being able to sell to states, it’s being able to sell through that entire continuum, down the state, local and education (SLED) markets.”

About 25 states are part of StateRAMP and a few others like Texas have adjacent programs that follow almost the same set of standards. Additionally, StateRAMP now has over 400 vendors who have been certified, many of which also have met the federal standards under the FedRAMP program.

Defending critical infrastructure

A shared service like StateRAMP came into being almost at the perfect time as the cyber threats were becoming more complex and harder to defend against.

Joe Bielawski, the president of Knowledge Services and co-founder of StateRAMP, added back in 2020 when they started talking about this concept, the cyber threats were mostly data breaches. Today, he said, it’s ransomware and attacks against critical infrastructure like water systems and electric grids.

Ken Weeks, the chief information security officer for the state of New Hampshire, said he’s seeing those threats first hand.

“What we’ve come to realize is that some of our most vulnerable systems are in critical infrastructure, and especially in community drinking water systems and wastewater systems. Some of these systems are very small. They may only serve 60 customers. Some serve thousands of customers. But over time, there has been no attention paid whatsoever to the security of these systems,” Weeks said. “We’ve used a program that we have called the Municipal Cyber Defense Program that’s run by a private organization, and they go out and provide hands-on training for SCADA operators. They give seminar type training for elected officials as well as for town employees to teach them what’s important about cybersecurity, what things to budget for, what things to not worry about so that it can be sustained. I think through the awareness campaign, as well as actually delivering real solutions and outcomes, we’ve made tremendous progress.”

Nikki Rosecrans, the CISO for Arapahoe County, Colorado, said her county is one of those areas that is playing cybersecurity catch up.

Arapahoe County just issued its first information security policy in June.

She said before the policy came out, the county practiced strong information security, but the new policy was more about educating its non-cyber and IT workers more broadly about how to protect data and systems.

“Now that our employees are apprised of the policy, they’re starting to understand what this means. I feel like we can feel better about how our employees are processing and handling sensitive data,” Rosecrans said. “Arapahoe County has chosen to follow the Center for Internet Security (CIS) framework. It’s a set of 20 controls based off of the NIST framework. It’s a little bit more palatable for us to implement.”

The benefit of cyber harmonization

Rosecrans said she’d rather be able to rely on a more standardized set of controls where cybersecurity requirements for CIS and StateRAMP, for example, were more harmonized.

That desire for harmonization resonated time and again with state and local leaders and private sector executives.

Dan Lohrmann, the field CISO for Presidio and a former CISO for the state of Michigan, said harmonization through programs like StateRAMP drives huge value for vendors.

“The ability to for states to not have to reassess solutions every time they do a request for proposals (RFP) is a big deal. You really want to say is this product that we’re going to be using a cloud-based solution and is that even protected properly, and if so, can we use it?” he said “The ability to for the vendor not have to redo that for every state and have different requirements across the board, that’s a huge value. I can’t give you an exact number on the percentages, but it’s well over 50% to 70% [savings]. There are some unique requirements that are still going to be there like for criminal justice information or Medicare and Medicaid, but I think it’s 10% or 20% different and 80% of it is the same.”

John Lee, the vice president of cloud solutions at Carahsoft, which sponsored the StateRAMP Cyber Summit, said vendors also benefit once receiving their StateRAMP or FedRAMP certifications through increased revenue. He said they are seeing as much as a 60% increase in public sector revenue in that first year after achieving a cyber certification.

“Clearly government procurement officials feel more comfortable when they look at somebody who has achieved that authority to operate (ATO) across the board. With all the attacks that are occurring, people are looking at this for the Good Housekeeping seal of approval,” Lee said. “They know that nobody’s going to yell at them if they actually are utilizing somebody with an ATO in place. So I think that’s what’s driving and then, quite honestly, once you have that, that’s a great message to go out and sell and market.”

Coordination with acquisition leaders improving

That message is resonating with state procurement officials, mainly as a way to reduce risk and make up for a lack of resources to monitor cybersecurity companies.

Jamie Schorr, the chief cooperative procurement officer with the National Association of State Procurement Officials, said the relationship between CISOs and acquisition leaders is closer than ever.

“Our CISOs are able to rely on us to provide good guidance and feedback throughout the procurement process, to ultimately select those suppliers that will meet those minimum cybersecurity standards. It’s fantastic,” she said. “Not only do the CIOs, CISOs and business officials have more respect for procurement and what we do to follow our statutes and laws, but the chief procurement officers are also having a greater understanding for the CISOs and what their protections area and what their ultimate goal is.”

Those conversations are moving CISOs into a larger role that has less to do with just cybersecurity and more to do with protecting business and mission systems.

Meredith Ward, the deputy executive director of the National Association of State CIOs (NASCIO), said CISOs are doing more to build and maintain relationships with other state agency leaders.

“We know that the bad actors don’t care if you’re with this city or this state or this county, they’re attacking everyone. So no longer can we rest in these silos,” she said.

Discover more articles and videos now from the StateRAMP Cyber Summit in Indianapolis.

Copyright © 2024 Federal News Network. All rights reserved. This website is not intended for users located within the European Economic Area.

The Digital Twin Consortium has refreshed the definitions of “digital twin” and “digital thread.”

These changes are intended to better represent the relationship between these terms and key digital engineering principles, the organization said earlier this month.

Dan Isaacs, general manager and chief technology officer of the DTC, said the updates “reflect the evolving landscape of digital engineering” and will help create “a common understanding that bridges multiple sectors and applications over the digital twin lifecycle.”

The new digital twin definition describes the technology as “an integrated data-driven virtual representation of real-world entities and processes, with synchronized interaction at a specified frequency and fidelity.”

According to David McKee, co-chair of the DTC Capabilities and Technology Working Group and lead author of the organization’s definition team, the updated digital twin definition is grounded in physics and “emphasizes synchronization and data, with a model-based approach tied to engineering technology.”

A digital thread is defined as “a bidirectional, dependable and trustworthy interconnected information system that links multiple dimensions, including structure, behavior, space, time and lifecycle stages.”

“Intrinsically linked to the digital twin, the refined digital thread definition highlights critical elements, including seamless, secure data flow across the product lifecycle and all organizations, silos and stakeholders,” McKee said.

These revisions were informed by the 2024 Foundational Research Gaps and Future Directions for Digital Twins report, which was published by the National Academies of Science, Engineering and Medicine earlier this year and draws attention to the mirroring capabilities and other attributes of digital twins. 

Through the changes, DTC hopes to “foster greater understanding, more transparent communication for more effective collaboration and accelerated innovation and adoption throughout the digital twin ecosystem,” said Isaacs.

Digital twins are one capability the Defense Department is exploring as it modernizes to meet the demands of today’s shifting national security landscape. Hear experts discuss digital twins and other key technologies at the Potomac Officers Club’s 2025 Defense R&D Summit on Jan. 23, where public and private sector leaders will weigh in on the Pentagon’s top technology priorities. Access all the insights they have to offer at the 2025 Defense R&D Summit.

National Institute of Standards and Technology Director Laurie Locascio will step down in early 2025 to serve as the new president and CEO of the American National Standards Institute.

ANSI announced Locascio’s election to the top post on Oct. 8 after the organization’s board meeting, noting that the incoming chief will take over from Joe Bhatia in January, Nextgov/FCW reported Thursday.

In a LinkedIn post, Locascio announced her upcoming transfer from government service to a nonprofit entity tasked with coordinating voluntary standards adoption across U.S. industries. The Department of Commerce undersecretary also thanked Bhatia for nearly “two decades of outstanding leadership” at ANSI.

A Commerce Department spokesperson confirmed on Thursday the NIST chief’s imminent departure, noting that Locascio will remain in her current posts until the scheduled move to ANSI.

Before she was appointed NIST head, Locascio served as vice president for research at the University of Maryland College Park and the University of Maryland Baltimore. Earlier, she worked as a research biomedical engineer at NIST, led the agency’s Material Measurement Laboratory and then served as its associate director for laboratory programs and principal deputy director.

Locascio earned a doctorate in toxicology from the University of Maryland Baltimore, a master’s in bioengineering from the University of Utah and a bachelor’s degree in chemistry from James Madison University.

A group of companies comprising Alteryx, Salesforce, Twilio, Box, Kyndryl and Peraton has sent the Artificial Intelligence Task Force within the House of Representatives a letter calling for legislation that more accurately reflects the complexity of the AI ecosystem.

Recognizing AI Integrators

Alteryx said Thursday that most current AI policy proposals focus exclusively on AI developers and deployers while failing to recognize the role that integrators play. Such companies work to integrate existing models and make them more specialized or otherwise enhanced.

By taking integrators into account, policies would be able to provide a framework to benefit companies working on generative AI that can be classified as neither developer nor deployer.

Realizing the Potential of AI

Commenting on the matter, Tommy Ross, the head of global public policy at Alteryx, said, “The AI value chain is a vastly complex and intricate ecosystem with players who fulfill a spectrum of different roles and responsibilities in deploying generative AI models.”

“To accurately capture this complexity and put forth a clear, comprehensive, and workable framework for AI policy, future debates should clarify the roles of AI actors beyond deployers and developers, to include the multiple actors that are heavily involved in AI,” Ross added.

For his part, Peraton Chief Innovation Officer Chris Valentino said, “To realize the full potential of AI, we need a regulatory framework that recognizes the complex roles within the AI value chain.”

NASA has formed a new strategy review team tasked with evaluating potential architecture changes to the Mars Sample Return Program, an initiative to bring scientifically selected samples from Mars to Earth with the goal of understanding the planet further.

The agency said Wednesday the new team will evaluate 11 design studies proposing methods of bringing the samples to Earth in the 2030s. These NASA-commissioned studies will aim for lower costs and higher efficiency with zero risks and mission complexity.

The team will furnish NASA with a report by the end of 2024 giving its recommendation on a primary architecture for a complete mission design, along with estimated expenses and schedule.

Former NASA administrator Jim Bridenstine, a former recipient of the Wash100 Award, will lead the Mars Sample Return Strategy Review team while David Mitchell, chief program management officer at NASA Headquarters, will head the NASA Analysis Team.

NASA Administrator Bill Nelson, a 2024 Wash100 Award winner, said the Mars Sample Return is vital to plans to launch a rocket off the planet and return safely to Earth.

“It is critical that Mars Sample Return is done in a cost-effective and efficient way, and we look forward to learning the recommendations from the strategy review team to achieve our goals for the benefit of humanity,” said the former senator.

The Department of Energy has issued a solicitation for project proposals on its $900 million program to deploy Generation III+ small modular reactors, or Gen III+ SMRs, across the United States. 

The solicitation, which follows through on the department’s notice of intent for the program announced in June, seeks to support the private sector in installing domestic Gen III+ SMRs that promote environmental protection, benefit the community, create jobs and boost U.S. nuclear industry leadership, DOE said Wednesday.

In addition, the funding aims to promote the secure and responsible development of advanced U.S. nuclear reactor technologies and spur follow-on projects to meet the demand for reliable, affordable and clean power supporting U.S. climate goals.  

The DOE funding is open in two tiers, with the first allotted $800 million for two teams composed of utility, building and other plant contractors for the first two Gen III+ SMRs. The Office of Clean Energy Demonstrations will manage the first tier, which will also potentially involve the National Nuclear Security Administration for the projects’ safeguard and security design.

A $100 million funding is available for the second tier, which will be managed by the Office of Nuclear Energy, to fill key gaps seen as hindering domestic nuclear industry growth, such as design, supplier development and site preparation. 

According to the DOE’s solicitation, funding priority will be extended to proposals with the highest potential for successful deployment, development of a Gen III+ SMR orderbook and advancement of the U.S. nuclear industry’s resilience. The deadline for the submission of project proposals is Jan. 17, 2025.

The National Reconnaissance Office is enhancing its data-sharing capabilities by expanding its satellite network with over 100 additional payloads by the end of the year.

The expansion is intended to support warfighters, analysts and first responders by providing them with more reliable and efficient means of organizing and sharing unstructured data through advanced analytics and computing environments, the NRO said Thursday.

Speaking at the Mitchell Institute’s Schriever Spacepower Forum on Thursday, NRO Principal Deputy Director Troy Meink said the agency is leveraging whole-of-government and commercial partnerships to accelerate the adoption and development of new technologies necessary for increasing client demands.

According to Meink, the NRO is collaborating with more industry partners in the defense, intelligence, and commercial sectors to enhance its data science talent base. This has enabled the agency to access new tools such as advanced computing, digital engineering and data analytics, resulting in a boost in its supply chain and launch capabilities.

The NRO is working on expanding its proliferated overhead architecture to achieve what would reportedly be the largest government constellation in history. By increasing the number of satellites in orbit, the volume of data also increases.

“We have been dealing with rapidly growing data volumes almost since our inception more than 60 years ago,” said Meink. “The difference is the new tools we have available to apply to this challenge.”

The FBI and the Cybersecurity and Infrastructure Security Agency have released the Product Security Bad Practices catalog for public comment.

CISA said Wednesday the catalog details the risky practices that should be avoided by software manufacturers because of the potential threat they pose against critical infrastructure or national critical functions. The bad practices are categorized into three areas—product properties, security features and organizational processes and policies. The catalog also provides recommendations on how to build secure software.

Public comments will be accepted through the Federal Register at the request for comment on Product Security Bad Practices guidance page until Dec. 2. CISA will evaluate the feedback and make the necessary revisions to the catalog.

CISA Director Jen Easterly, a 2024 Wash100 Award winner, highlighted the risks posed by preventable software defects against critical infrastructure.

“These product security bad practices pose unacceptable risks in this day and age and yet are all too common. We hope that by following this clear-cut, voluntary guidance, software manufacturers can lead by example in taking ownership of their customers’ security outcomes and fostering a secure by design future,” said Easterly.

According to National Cyber Director Harry Coker, Jr., product security bad practices result in wide-ranging consequences often felt by Americans.

“Our private sector partners must shoulder their responsibility and build secure products and I’m glad to see this document as another tool to help software manufacturers do just that,” stated Coker Jr. “We need to work together to prioritize best practices to better protect our nation.”

Join the Potomac Officers Club’s 2024 Homeland Security Summit to learn more about the country’s most significant threats and what’s being done to thwart them.