healthcarereimagined

By AARON BOYDAUGUST 19, 2022

Commissioners are split on whether new regulations—and even the act of gathering information on a proposed new regulation—is the right way forward.

The Federal Trade Commission is considering establishing new rules for how companies collect, secure, use and sell consumers’ data that go beyond asking users to agree to opaque and often misleading terms of service.

On Monday, the commission will post an advanced notice of proposed rulemaking, or ANPR, that outlines current consumer data issues and asks for public feedback on creating new regulations that focus on baseline privacy, data security and corporate accountability rather than user consent.

“Specifically, the commission invites comment on whether it should implement new trade regulation rules or other regulatory alternatives concerning the ways in which companies collect, aggregate, protect, use, analyze, and retain consumer data, as well as transfer, share, sell, or otherwise monetize that data in ways that are unfair or deceptive,” states the notice set to publish Aug. 22 in the Federal Register.

“Whether they know it or not, most Americans today surrender their personal information to engage in the most basic aspects of modern life,” commissioners wrote. “When they buy groceries, do homework or apply for car insurance, for example, consumers today likely give a wide range of personal information about themselves to companies, including their movements, prayers, friends, menstrual cycles, web-browsing and faces, among other basic aspects of their lives.”

The agency notes data collection is “an elaborate and lucrative market,” both in trading information and using it to target consumers and maximize sales and profits.

“While, in theory, these personalization practices have the potential to benefit consumers, reports note that they have facilitated consumer harms that can be difficult if not impossible for any one person to avoid,” the notice states.

And while companies are required by law to get consumers’ consent—usually through lengthy terms of service documents—necessity and fatigue often lead people to accept those terms whether or not they would like to, or even fully understand what they are agreeing to.

Further, “The commission’s enforcement actions have targeted several pernicious dark pattern practices, including burying privacy settings behind multiple layers of the user interface and making misleading representations to ‘trick or trap’ consumers into providing personal information,” the notice states. “Given the reported scale and pervasiveness of such practices, individual consumer consent may be irrelevant.”

Even harder to avoid are data uses outside of the agreed upon terms of service, whether by the company collecting the data or after it gets bundled and sold to third parties not bound by the original terms.

“These practices also appear to exist outside of the retail consumer setting,” the FTC wrote. “Some employers, for example, reportedly collect an assortment of worker data to evaluate productivity, among other reasons—a practice that has become far more pervasive since the onset of the COVID-19 pandemic.”

And the harms are real.

At the individual level, the agency cites a wealth of research showing how data collection is used to push fraudulent or harmful products and services to vulnerable users, enabling “cyber bullying, cyberstalking and the distribution of child sexual abuse material,” as well as exacerbating underlying issues such as “depression, anxiety, eating disorders and suicidal ideation among kids and teens.”

On a societal scale, “companies’ growing reliance on automated systems is creating new forms and mechanisms for discrimination based on statutorily protected categories, including in critical areas such as housing, employment and health care,” FTC wrote, citing several recent examples.

As the commission considers new regulatory options, FTC is using this comment period and an upcoming virtual public forum on Sept. 8 “to generate a public record about prevalent commercial surveillance practices or lax data security practices that are unfair or deceptive, as well as about efficient, effective, and adaptive regulatory responses.”

Commissions said they want to build this record as Congress debates enacting the American Data Privacy and Protection Act.

“Given the uncertainty of the legislative process and the time … rulemaking necessarily takes, the commission should not wait any longer than it already has to develop a public record that could support enforceable rules,” FTC Commissioner Rebecca Kelly Slaughter said in a statement. “Case-by-case enforcement has not systemically deterred unlawful behavior in this market. As our own reports make clear, the prevailing notice-and-choice regime has failed to protect users, and the modes by which sensitive information can be discovered, derived, and disclosed have only grown in number and complexity.”

The notice asks 95 specific questions across 11 subject areas, including:

• To what extent do commercial surveillance practices or lax security measures harm consumers?
• To what extent do commercial surveillance practices or lax data security measures harm children, including teenagers?
• How should the commission balance costs and benefits?
• How, if at all, should the commission regulate harmful commercial surveillance or data security practices that are prevalent?
• Information on collection, use, retention and transfer of consumer data.
• Information on automated decision-making systems.
• Information on discrimination based on protected categories.
• Information on consumer consent.
• Information on notice, transparency and disclosure.
• Potential remedies.
• Obsolescence of past rulemaking.

The notice also includes a rundown of how the FTC monitors and regulates these issues now and the extent of the agency’s statutory authority to make new rules in this space.

Comments are due no later than Oct. 21.

Dissenting Opinions

While the Democratic commissioners wrote statements in favor of updating data privacy rules, Republican commissioners dissented, citing potential adverse economic impacts and a preference for letting Congress legislate over administrative regulations.

“Any law our nation adopts will have vast economic significance,” Commissioner Noah Joshua Phillips wrote. “It will impact many thousands of companies, millions of citizens and billions upon billions of dollars in commerce. It will involve real trade-offs between, for example, innovation, jobs and economic growth on the one hand and protection from privacy harms on the other.”

Phillips said the proposed rulemaking is an overstep for the FTC, calling the notice for public comment an attempt to “recast the commission as a legislature,” and chided the commission for not including specifics on the “scope and parameters of what rule or rules might follow.”

“So I don’t think we should do this,” Phillips said. “But if you’re going to do it, do it right.”

The commission’s other Republican member, Christine Wilson, also dissented, preferring to see Congress pass “a sound, comprehensive and nuanced approach to consumer privacy and data security” that she says will be better for companies, consumers and the economy as a whole.

Article link; https://www.nextgov.com/emerging-tech/2022/08/ftc-considering-new-data-privacy-regulations-go-beyond-asking-users-consent/376081/

8/23/2022By: Rebecca Hill, MHS Communications

Recommended Content:Health Care Technology | Defense Health Information Technology Symposium

Gone are the days where you need a paper trail to connect with your health care. 

Advances in technology has vastly improved the accessibility to beneficiaries’ electronic health records. The Defense Health Agency is tapping into this technology to improve the patient experience by bringing together key professionals and streamlining services. 

Through a symposium for the Military Health System−and by the ongoing promotion of services and resources−DHA is putting the intersection of health care and technology at the forefront.

In August 2022, Department of Defense health care professionals met at the Defense Health Information Technology Symposium to discuss the transformation of the MHS to ensure high-quality, patient-centered care. Topics included improving virtual health, transforming health care delivery, and the future of cybersecurity.

Across the DHA, information technology systems, programs, and apps are designed to make health care more streamlined and accessible to service members and families. 

Eventually, the Department of Defense, Department of Veterans Affairs and the U.S. Coast Guard will be able to seamlessly transition your health care files throughout your service and as you transition into the VA medical system. 

“I don’t think we’ve even scratched the surface of what we can do with a single system and the benefits it will bring,” said Holly Joers, program executive officer for the Program Executive Office, Defense Healthcare Management Systems. 

Advancing Technology to Fit Patient Care

As the DOD, the VA and U.S. Coast Guard are working on a more integrated system, there are programs available right now to access records online, get answers about your health, and check on your own well-being. Here are just a few:

• MHS GENESIS Patient Portal: This electronic health record gives you 24/7 access to your information and allows you to send messages to your care team and oversee appointments. This secure site will help integrate patient care, keeping your health care professionals updated with your latest information. No matter where you are stationed in the world, MHS GENESIS will be available to you. 

“Specialists can provide care via video or other electronic media and consult with providers in theater to help facilitate care and a quicker return to duty,” Army Col. (Dr.) Robert Cornfeld, chief health information officer and pediatric gastroenterologist at Madigan Army Medical Center at Joint Base Lewis-McChord in Washington, stated. 

• Nurse Advice Linegoes tot he MHS Nurse Advice Line: With every medical issue, there are questions. By utilizing the Nurse Advice Line, you can get answers, find the proper medical treatment facilities, schedule appointments, and so much more. This option is available 24/7 through web or video chat, or phone, giving you peace of mind with sound medical advice.

Discover More with Mobile Health Apps

In addition to these DHA programs, there are DHA Mobile Apps available on your smartphone. These mobile apps can help service members and families with their health, help set goals, and stay on track. Access these apps with a tap of your finger.

• Decide + Be Ready: This app provides an interactive way for service members to learn about birth control options and help think through what is important to them about the method they choose.

• My Prosperity Plan: Set goals for your personal life, in relationships, to meet spiritual needs, and more. This app helps you reach your potential and keeps you on track.

• MissionFit: Get into shape with this 12-week exercise program! You get different options and various exercises. Video, text, and images help you through these programs.

• Visit the DHA app pageDHA Mobile App page to see the other available apps on your mobile device.

Through these events, services, and resources, the DHA is furthering their focus in integrating technology to make your lives easier. 

“DHA is pivoting to meet the digital native generation with care that meets their expectations,” said Cornfeld.

Article link: https://health.mil/News/Articles/2022/08/23/Department-of-Defense-Streamlining-Health-Tech-for-Beneficiaries

Written by Mark Pomerleau
Aug 17, 2022 | FEDSCOOP

AUGUSTA, Ga. — Army Cyber Command’s new intelligence unit blending historical military intelligence activities with commercial data and public information is providing critical insights in a rapid manner to a newly established “triad” between the service’s cyber, missile defense and special operations organizations.

Last week, the Army announced this new triad between Army Cyber Command, Army Space and Missile Defense Command and Army Special Operations Command, which aims to to deliver more options to commanders in an integrated fashion.

“Probably the biggest contribution was one being able to take a fusion of traditional intelligence and what we were seeing publicly available information, in order to inform the commander forward of what we were seeing,” Lt. Gen. Maria Barrett, commander of Army Cyber Command, said during a presentation at the TechNet Augusta conference Wednesday.

Adversaries are globally focused, and so is the Army.

“Three operational units with unique authorities and capabilities — and we see the globe,” she said. “We were seeing some things in the electromagnetic spectrum, we were seeing things in the information environment and we were able to provide that back very quickly because of the Big Data Platform and the [Cyber Military Intelligence Group], that intelligence group, being able to turn that pretty quickly.”

The Cyber Military Intelligence Group (CMIG) directs, synchronizes and coordinates intelligence support for cyber, information and electronic warfare operations while also providing support to U.S. Cyber Command and other combatant commands. It was created to perform functions not found anywhere else within the Army or intel community, and blend open source information with military intelligence.

Big data platforms exist across U.S. Cyber Command, the Defense Information Systems Agency, Army Cyber Command and the Marine Corps. They are essentially hybrid cloud environments that allow for storage, computation and analytics across networked sensors. When forces conduct cyber missions, they collect data and use high-powered analytics to make sense of it. Big data platforms do just that, but also share that analysis in an easy-to-access repository for other forces. The Army’s version is called Gabriel Nimbus.

The CMIG is already having tangible effects despite being so new.

“I have been absolutely impressed with how quickly they can take an RFI from myself or from Cyber Command on a particular subject and pull that information together into a report,” Barrett said. “You might think that serialized reporting takes a long time. These guys are turning this pretty quick. [It’s] pretty valuable.”

Article link: https://www.fedscoop.com/new-army-intel-unit-having-big-impact-on-recently-established-triad/

-In this Story- 

Army, Army Cyber Command, Army Special Operations Command, cyber, Cyber Military Intelligence Group, intelligence, Maria Barrett, Space and Missile Defense Command

By PATRICK TUCKERAUGUST 18, 2022 08:41 AM ET

The Defense Department’s current “checklist” approach can’t keep its networks safe.

Two years ago, a pair of Navy information leaders decided to attack their own networks—and not just once or twice a year during scheduled exercises, but far more frequently, and unannounced. Now they’re trying to get the rest of the Navy—and the Pentagon—to follow suit.

Their experiment showed that frequent, automated red-teaming reveals which vulnerabilities are the most dangerous, the easiest for an attacker to exploit with the highest impact—information they wouldn’t have otherwise, said Aaron Weis, the Navy’s chief information officer, or CIO, and Scott Bischoff, the command information officer at the Naval Postgraduate School.

And it’s far more effective than the way the Defense Department currently handles cybersecurity: with checklists of steps taken, patches implemented, and so on.

“It’s a very compliance-driven mentality, like an audit… and it’s wrong,” Weis told Defense One. “Cybersecurity is not a compliance problem.” 

Treating cybersecurity like a checklist does answer one question: whether the officer, team, or company charged with “cybersecurity” has done their job to some agreed-upon level of performance—basically, whether they’ve fulfilled the terms of a contract or the parameters of an assignment. It’s an approach that works well for a bureaucracy, but it’s not the best way to actually secure your networks, Weis said.

“We’ve got…15 to 20 years of track record using a compliance mentality that says it doesn’t work, right? Because we continue to be exercised by our adversaries in cyberspace,” he said.

Related articles

The US Military Should Red-Team Open Source Code

A Navy Cyber Effort Is Fixing Thousands of Holes—and Building Tech Talent

Weis says the Pentagon needs to measure its networks’ suitability for combat the same way it does for soldiers, sailors, tanks, and ships: through the concept of military readiness.

Such an approach would mean prioritizing the biggest problems first, with second-tier or complicated ones set on slower paths to fixing.

“There’s ‘ready to fight tonight.’ But if you are a carrier strike group and you’re deploying in three months, are you on a path to being ready? You manage your readiness on a day-to-day basis and it’s a function of a whole bunch of things,” he said. “Do we have the right people? Are they trained? Are they qualified, or deficient? Do we have the equipment?”

But Weis had to show that getting to a state of “readiness” in cyberspace is a matter of constant testing and drilling, not filling out compliance forms. 

He needed a safe space where he could understand readiness without exposing huge problems to adversaries or taking essential naval networks offline. He went to the Naval Postgraduate School, or NPS, in Monterey, California.

NPS’ Bischoff says the school lends itself to experimentation because it’s on the California research and education network, not a Navy network. 

“I have a lot of authorities here that other naval units wouldn’t have. It provides the Navy a small chunk of terrain here to do things,” like test new cybersecurity concepts, he said. “We have a somewhat unique terrain here to maybe take a little bit of risk on and try some things. That’s important for a STEM school, you know. We’re very research-intensive, so it’s right up our alley.”

So NPS forged a cooperative R&D agreement with Rebellion, a defense-focused software startup founded by Chris Lynch, the former head of the Defense Department’s Digital Service.

Rebellion brought in a tool called Nova that does automated red-teaming on networks. But it doesn’t just hammer away at the vulnerabilities it finds like it’s running through a checklist. 

“It can identify the system, understand its patch level, catalog its vulnerabilities according to what’s generally available, and then try to run an automated exploit against it, based on what it knows,” said Weis.

The process revealed a lot more information than just a list of vulnerabilities to be patched. They learned which vulnerabilities were the most important, the easiest to attack, which ones let the attacker gain wider network access, things they would have learned only if a real attacker was hitting the system and strategizing its next move. That means that different vulnerabilities had a priority that a checklist completely missed. 

Said Weis: “Right now, because of our compliance approach, we focus on patching every vulnerability, right?…In no particular order, by the way. We just line them up and knock them down. And what that approach…disregards is the question: Can that vulnerability actually be exploited?”

Some vulnerabilities that seemed large were very difficult to exploit, and some that seemed small were a lot more dire than their position on the checklist would indicate. Running similar experiments on actual DOD networks would probably reveal a similar result: that the Department is not managing its cyber vulnerabilities with a real-world understanding of how an attacker would actually approach the network. 

Bischoff said similar red-team experiments involving humans are great, but they happen once or twice a year. “It’s a snapshot, right. I don’t want a snapshot. I want a movie throughout the year.”

Weis said he’s building off of that experiment. 

“We’re in the process of…nominating a set of [Navy] programs that are volunteering to go first and to start to use this different approach,” he said. “We’ve been having leadership-level discussions here since kind of before the holidays last year. It started with a one-on-one with the [Chief Naval Officer] and it’s kind of moved up from there.”

Said Lynch: “Aaron [Weis] is trying to completely change what they’re doing,” not only in the Navy, but potentially across the military. 

That is going to be important if the Defense Department is going to move toward the highly-networked joint all-domain command and control, or JADC2, vision at the heart of its plans for the next decade. The more networks, computers, drones, satellites, etc.. are all linked together, the more unmanageable a checklist approach becomes. The only solution will be to assume your enormous networked war machine is under attack at its weakest points—because it is.

Article link: https://www.nextgov.com/cybersecurity/2022/08/experiment-showed-military-must-change-its-cybersecurity-approach/376003/

January 6, 2021

Drug companies charge more for insulin in the United States than in nearly three dozen other countries RAND researchers examined—and it’s not even close. The average list price for a vial of insulin in Canada was $12. Step across the border into America, and it’s $98.70.

Those differences help explain why insulin has become a symbol of the high cost of American health care. Its prices have shot up in recent years, for reasons that are opaque at best, with those who can least afford it often paying the most. Reining in those prices has become the rare political cause embraced by Democrats and Republicans alike.

“This isn’t just some academic question: ‘How do our prices compare with those in other countries?’” said Andrew Mulcahy, a senior policy researcher at RAND who specializes in health care economics and led the study. “It’s becoming a very practical question, because there are ideas out there to do something about it, and they can benefit from this kind of analysis.”

Diabetes is one of the most pervasive, deadly, and expensive diseases in the United States. More than 30 million people have it, and nearly a quarter of them use insulin to manage their symptoms and prevent life-threatening complications. Per-person spending on insulin, for those with employer-paid health insurance, doubled between 2012 and 2016.

The U.S. Department of Health and Human Services asked RAND to investigate how American insulin prices compare with those in other parts of the world. Researchers obtained list prices for all types of insulin from 33 countries in Europe, Asia, Australia, and the Americas. Plotted on a graph, the U.S. prices stand alone.

The average price in America, across all types of insulin, was more than ten times higher than the average for all of the other countries combined. In fact, the closest any country came to paying the $98.70 American average was the $21.48 average that Chile pays.

The differences were especially stark when the researchers looked at rapid-acting insulin, which makes up about a third of the U.S. market. Its average price in other countries was just over $8. In America, it was $119.

“It comes at a high cost, and not just financially, but in terms of your life,” said Mila Clarke Buckley, 30, whose autoimmune diabetes is slowly shutting down her pancreas. She runs a top-rated blog for fellow diabetics, “Hangry Woman,” from her home in Houston. She has more than 30,000 readers.

“It’s not like one day you can just stop taking insulin,” she said. “You really have to manage your life thinking, OK, this is my No. 1 priority, to be able to get this little pen of liquid so that I can live.”

Insulin prices in the United States are higher than prices in nearly three dozen other countries RAND researchers examined—and it’s not even close.Share on Twitter

The prices RAND used in its study—the list prices, set by drug manufacturers—were the most available for comparison across different countries. They’re a good starting point for understanding the true cost of insulin. In the cryptic world of drug-price setting, the list price is like an opening bid.

The companies that manage the drug formularies that you might see on your insurance plan then enter the picture. They negotiate discounts and rebates in a closed-door process that yields a second, lower price that insurers ultimately pay. Drug manufacturers compete for their business by offering generous discounts, which gives them every reason to set their initial prices high. Even if those discounts cut 50 percent from the price, RAND’s study noted, Americans would still be paying several times more for insulin than what people in other countries pay.

It’s hard to track the final prices that patients like Buckley actually pay at the pharmacy counter. Those who have insurance still have to cover deductibles and copays, which can be significant. Those who don’t have insurance can find themselves paying the full list price.

Drug companies have started to introduce lower-priced insulins and discount cards to help those struggling to pay. But nearly a third of the people who responded to an American Diabetes Association survey said they had postponed doctors’ appointments or put off paying bills to afford their insulin. A quarter had skipped a rent or mortgage payment.

Buckley has been there. When her husband lost his job a few years ago—and with it, their health insurance—she, too, found herself caught between paying their bills and paying for insulin. She paid the bills.

“It was an impossible choice, but we had nothing left to give,” she said. For several weeks, she watched her blood-sugar levels creep up as she rationed what little insulin she had, until her husband could find another job. “It was terrifying,” she said. “That’s why we need to really force this conversation to stay open. It’s important to live in a country where insulin is accessible and affordable and people don’t have to make choices to go without just so they can get their insulin.”

Several states have capped how much their residents can be asked to pay out of pocket for insulin. A few have filed lawsuits against the major drugmakers. At the federal level, policymakers have talked about—but not yet acted on—ideas to allow the importation of cheaper insulin, or to peg prices here to those in other countries. One proposal would cut back the middlemen so that list prices can more closely reflect the final pharmacy prices.

You really have to manage your life thinking, OK, this is my No. 1 priority, to be able to get this little pen of liquid so that I can live.

Mila Clarke Buckley

Rep. Earl “Buddy” Carter of Georgia offered a backhanded thank-you to industry executives during a 2019 hearing on the soaring price of insulin. “You have done something here today that we have been trying to do in Congress [for years],” he told them. “And that is to create bipartisanship.”

Researchers at RAND are now starting to look at how American prices for other prescription drugs compare with those in other countries. “We really need to have a better sense of just how much more we’re paying,” RAND’s Mulcahy said. “It’s not just insulin; it’s across the board. My hope is that this insulin report is the start of a long string of analyses doing this kind of international drug-price comparison.”

Mila Clarke Buckley knows her insulin costs will go up. The type of diabetes she has—latent autoimmune diabetes in adults, or LADA—is a progressive disease, breaking down her body’s ability to function without increasing doses of insulin. Sooner or later, she will become completely insulin dependent. She has a separate tab on her household budget for when that day comes: “Mila’s Diabetes Care.”

“It happened to me; it can happen to you any day,” she said. “That’s why we need to have this conversation, because the prices are astronomical, and it affects real lives. One day, I didn’t have diabetes, and the next day, I found out I did, and it changed my entire life.”

— Doug Irving

Article link: https://www.rand.org/blog/rand-review/2021/01/the-astronomical-price-of-insulin-hurts-american-families.html?

By PATIENCE WAITAUGUST 18, 2022 09:22 AM ET

The memorandum sets up budget expectations for previously established cyber goals.

The Office of Management and Budget in July quietly issued a memorandum to all federal civilian agencies outlining the administration’s “cross-agency cyber investment priorities” for the fiscal year 2024 budget, emphasizing that implementing zero trust and IT modernization must be at the top of the list.

“The Federal Zero Trust Strategy … requires agencies to achieve specific zero trust security goals by the end of FY 2024; budget submissions are expected to prioritize ensuring this work is completed,” the memo states. “Agencies have submitted [their] zero trust implementation plans to OMB, and a cross-government team of cybersecurity experts from OMB, [Office of the National Cyber Director], and Cybersecurity and Infrastructure Security Agency … is engaging with agencies to refine these plans and define ambitious, achievable goals.”

OMB noted that the goals of a zero trust implementation are about achieving a consistent enterprise-wide baseline for cybersecurity “grounded in principles of least privilege, minimizing attack surface and designing protections around an assumption that agency perimeters should be considered compromised.”

The budget directive is aimed at ensuring that agencies demonstrate their commitment to zero trust by reflecting it in their budget requests. 

Similarly, the memo points out that obsolete systems and the resulting technical debt have limited both the government’s ability to deliver modern services to customers and also in the implementation of modern security best practices. As a result, the memo emphasizes that agencies “should prioritize technology modernizations that lead with security integrated during the design phase, as well as throughout the system lifecycle.” This includes:

• Accelerating adoption and use of secure cloud infrastructure and services, leveraging zero trust architecture.
• Developing and deploying federal shared products, services and standards that empower secure customer experiences.
• Using shared security technologies, including the Department of Homeland Security’s Continuous Diagnostics and Mitigation program.
• Sharing awareness between security and IT operations teams across the federal enterprise.
• Using agile development practices and integrating NIST’s Secure Software Development Framework and Software Supply Chain Security Guidance into agencies’ software procurement and development practices.

The memo also directs the civilian agencies to increase their collaboration with the private sector to protect critical infrastructure. Sector Risk Management Agencies “must ensure their [budget] requests reflect adequate resources to fulfill their responsibilities,” including building mechanisms to collaborate with critical infrastructure owners and operators to “identify, understand and mitigate threats, vulnerabilities and risks to respective sectors.” Budget submissions for FY 2024 should prioritize specific proposals that will provide SRMAs adequate resources to meet those responsibilities.

OMB also points out that supply chain risk management is a “critical capability to manage cybersecurity risk.” While agencies have been required to establish formal SCRM programs for their own acquisitions—especially for information and communications technology and services—the requirements are slated to sunset at the end of 2023. OMB advises the agencies that legislation is pending to extend the requirement through 2026, so agencies should continue their investments in their FY 2024 budget submissions.

And agencies’ responsibilities for supply chain risk management extend beyond their own acquisitions, the memo says.

“The federal government also plays a role in addressing national level ICTS supply chain risk,” it states. “In FY 2024 budget submissions, agencies should highlight investments that support a national effort to mitigate undue or unacceptable levels of risk to [the] economic security and national security of the United States.”

This OMB memo is a real ratcheting-up of pressure on federal civilian agencies to implement zero trust. Since last year’s cybersecurity EO, some agencies have grumbled that it represented another “unfunded mandate”—an IT directive without the budget attached to achieve it.

James F.X. Payne, vice president, business development with SecureG, a Sterling, Virginia, company developing secure machine identity management for 5G wireless services, said the OMB memorandum shows the agency is making sure that excuses for a lack of progress will not stand up to scrutiny.

OMB “is embracing zero trust architecture in a serious way. It’s a wake-up call across the government,” he said.

Payne compared it to the way the White House stepped up pressure on agencies to adopt cloud computing more than a decade ago. “First it was a suggestion. Then it was a directive. And then it was, ‘We’ll audit you for compliance,’” he said. “Moving to zero trust is important enough, OMB is moving faster this time.”

Article link: https://www.nextgov.com/cybersecurity/2022/08/omb-memo-places-zero-trust-top-civilian-agency-priorities/375948/

by Andrew White, Michael Smets, Adam Canwell

July 18, 2022

Summary. It’s not news that organizational transformations are prone to failure. To understand the skills, mindsets, and capabilities behind successful transformations in today’s dynamic environment, EY and Oxford University formed a research collaboration to investigate what it takes to lead a successful transformation. One of the authors’ most important findings is that, in order for transformation to be successful, leaders must approach it in ways designed to mitigate emotional harm to — and drive emotional commitment from — employees. The workforce bears the brunt of failed transformations, and the emotional damage can be substantial as employees lose confidence in leaders and become skeptical of further attempts at transformation. Drawn from their research, the authors present seven ways for leaders to set their transformations up for success by prioritizing their employees’— and their own — emotions.

The road is littered with failed transformation programs that were set up in the traditional way: Leaders define objectives, design a project plan, agree on KPIs, and recruit the right people. As many executives, academics, and consultants can relate to, the rate of failure in transformations is still far too high, and one that organizations can ill afford in these disruptive times.

To understand the skills, mindsets, and capabilities behind successful transformations in today’s dynamic environment, EY and Oxford University formed a research collaboration to investigate what it takes to lead a successful transformation. We surveyed 935 CXOs and 1,127 members of the workforce. Approximately 50% of them represented a successful transformation project and 50% an unsuccessful one. The respondents came from 23 countries, seven industries, and 16 sub-industry sectors. We also conducted 25 in-depth interviews with CXOs from multiple global companies. Before their interviews, each leader was asked to identify three critical turning points in their transformation. The interviews then focused on each turning point to understand when and why it happened, what actions were taken, and how they impacted the outcome of the transformation.

One of our most important findings is that, in order for transformation to be successful, leaders must approach it in ways designed to mitigate emotional harm to — and drive emotional commitment from — employees.

What makes transformations successful — and unsuccessful

In general, we found that leaders and workers started transformations at the same point emotionally: excited and optimistic. As the transformations got going, they all showed a reduction in positive emotions and an increase in negative emotions. All transformations are tough, and confidence is bound to dip. This is not only inevitable, it’s key to the transformation’s success: Heightened stress raises performance (up to a point), and leaders who learn from their emotions bring those lessons into the transformation. This maintains a zone of high performance, which is an accelerator for a transformation.

For emotions to be accelerators rather than inhibitors of transformation, leaders must put conditions in place in advance so that the transformation can come through this “pressure zone.” They must create psychological safety and construct mechanisms for all voices to be heard. And as the pressure increases, support, such as listening sessions and employee coaching, needs to increase along with it.

Without that corresponding increase in psychological safety and support, transformations spiral downward. The workforce is left feeling anxious and overworked. People lose faith in transformation when there’s no compelling vision, no visible progress, and no practical and emotional support from leaders. When key stakeholders and the leaders themselves lose faith in the transformation, they may start to distance themselves from it, looking to reduce damage to their own brands and jumping to different activities.

Seven steps for a successful transformation

The workforce bears the brunt of failed transformations, and the emotional damage can be substantial as employees lose confidence in leaders and become skeptical of further attempts at transformation.

Drawn from our research, here are seven ways for leaders to set their transformations up for success by prioritizing their employees’— and their own — emotions.

1. Address the unsustainable status quo.

The first step in any transformation is recognizing that the status quo is unsustainable. This takes courage and an ability to hold and facilitate the emotionally uncomfortable conversations that lead you to accept the delta between where you are today and where you need to be tomorrow. It’s about working on yourself first by becoming aware of what mindsets and assumptions underpin your view of success and beginning a transformational emotional journey.

Understanding the unsustainability of the status quo can mean putting yourself as a leader in a different place, often physically, in order to see yourself, your company, and the part of the world you operate in and impact differently. An executive from the consumer goods industry demonstrated this point in speaking about a 10-day executive trip to Silicon Valley: 

For me the key to the start of the transformation was the Silicon Valley trip. Those of us in the top team saw what the world looked like somewhere else and realized just how different and successful it was. We thought, if we don’t do this, we could be toast in 10 years’ time. Speaking for myself, personally, I came away from Silicon Valley thinking, I have to undergo a pretty profound re-education.

2. Detach from the status quo.

The next step is to consciously detach from the status quo. Embrace the unknown and adopt the humility required to challenge the mindsets and assumptions you have about your company and its current ways of working, as well as the industry and what constitutes success.

This step is about understanding your own ego’s need to be an expert and recognizing the importance of being open to learning during this time of transformation. This is where the real work of leaning into the emotions of anxiety, fear, and excitement occurs as your identity and status moves to the backburner. You must view not knowing what the future might look like as a key capability, rather than a sign of personal weakness.

This means understanding the system in which you’re located (beyond direct competitors), how it’s changing, and what opportunities and risks are being created. This can be uncomfortable. Embrace this discomfort; don’t shy away from it.

This step also requires exposure to new ideas that will inform and structure the future of the industry you’re in and therefore your company. For example, a CEO of a multinational retailer described to us how they attended an eight-week bootcamp on circular economics to understand how the idea would inform how their company needed to transform its operations to align with environmental challenges.

3. Develop a purposeful vision.

Embracing the unknown and adopting humility enables you to develop a purposeful vision because it allows you to see more clearly what needs to change and why. It allows you to understand why you exist, independent from the current mindsets and assumptions and the ways your company operates and creates value. You can then imagine how you might create value differently at a functional, product and service, or even entire business model level. The leader of a healthcare business reflected:

When we began the transformation, the mindset in the organization was that our business model was razors and razorblades. I said, no, that’s not our business, our business is that we give people much needed answers and we change people’s lives. Now our teams are connected to a purpose and show up with their heart, not an arrogant approach…It doesn’t matter who you report to, or what your status is, it’s having a purpose that you can connect to, such as to make people’s lives better, and coming to work every day with a great attitude and a growth mindset. That’s transformation for us in a nutshell.

4. Lead emotional transformation.

This step gets to the heart of our argument and is the key to leading the emotional journey of transformation. Transformation can be exciting and unsettling for employees at the same time. They may feel excitement about being part of a purposeful company but unsettled and anxious — for example, if they can’t see how their skills will be relevant.

Addressing these emotions is key. Bringing topics like anxiety and fear of the unknown as well as different ideas about what the organization’s future looks like into formal conversations allows them to be worked through, instead of just festering and creating resentment.

Our research suggests that listening skills are just as important as a project plan in a leaders’ toolkit of skills. Here are some psychotherapy-based steps to improve your listening. We found that these are remarkably similar to what leaders of successful transformations reported doing:

• Create the right space to actively encourage emotional awareness and expression through simple questions such as, “What are you feeling? Can you tell me more about that?” Silence and open questions allow people to explore their own emotions.
• Use techniques such as deep listening (to what is said and unsaid) and paraphrasing what you think you’ve heard to facilitate emotional regulation, which enables the exploration of primary emotions. Encouraging self-observation and self-compassion, focusing on breath and creating an environment free from judgement and reaction are all important here.
• Create workshops that enable active reflection on emotions (using tools such as meditation, poetry, journaling, and art). This will help facilitate conversations that focus on meaning making and the development of new narratives to explain past experiences and current situations.

5. Include both the rational and emotional. 

When executives begin a transformation, it’s not long before they reach for a project plan. More often than not, this focuses on a rational understanding of how long it will take to deliver key activities. These plans are often overly ambitious from a cost and time point of view, and our research suggests that they miss the critical listening component, which slows down the transformation process.

Conduct listening exercises via one-on-ones, small groups, and digital interventions and workshops across the organization that enable leaders and the workforce to understand their own purpose and values and how they integrate into the wider organizational purpose.

If you’re to integrate both the emotional and rational into your plans, you need to think of the process as a corkscrew rather than a straight line — in other words, a core focus on progress but a non-linear way of getting there. This requires a different approach to project planning that integrates the rational and emotional processes and activities by bringing together the need for patience and pace. An executive in the aerospace industry described it to us like this:

It is more like a spiral, where you just go up a little bit and the turning points are positive, and then a negative one. We came back a little bit and then we go up again and went to the second cycle.

6. Align KPIs, funding, resources, and people.

This is where the benefits of focusing on the emotional journey should come to fruition. Successful transformation requires major shifts in KPIs and performance management, funding, and resources. This new reality can be difficult for some people, as their lack of belief in the transformation becomes real as they lose power, status, and even their roles in the transformed organization. While losing people is more often than not an inevitable part of a successful transformation, our research shows that making decisions about practical matters like KPIs sooner rather than later enables people to transition from one emotional state to another — from reacting to the loss of the status quo to being creative about the future. This is a critical inflection point in the emotional journey.

This quote from a media industry executive illustrates how transformation creates a clear distinction between those who are aligned with the transformation and those who are not:

So, it probably did divide the business I think a little, between people who are here for the next evolutionary stage of what our industry is going through and those who are not. Not all of those who did not see this future have left the business, some are still doing what they do, but quite a few have. So, it’s accelerated a generational change inside our business, I think. I think people are leaders in our business earlier now. A good handful of years earlier than perhaps they would have been before, if they were able to grasp this more than their managers were able to grasp it.

What this step demonstrates in how new KPIs enable shifts in resources and make the transformation a concrete reality. This brings to light those people who are inspired and energized to bring the transformation to reality and those who are not.

7. Make transformation the new normal.

In the twentieth century, many organizations followed the model of being a “machine,” where predictability, stability, and hierarchy were the norm. This model was very good at delivering predictable performance but poor at coping with disruption. Many organizations still live with this legacy approach while their stakeholders demand something very different: a more “organic” organization where continual transformational is the norm.

Enabling transformation requires giving employees the information and resources they need to develop and innovate in other directions. One media executive described how knowledge and resource sharing allowed employees to develop in this way, which can enable the organization to move toward a state of continual transformation:

It’s definitely created a more entrepreneurial sense across the business that more people can participate in this, than perhaps they could previously. Some of the knowledge was quite esoteric. If you wanted to know how to do some of these things you needed to work in a certain department and you needed to be trained in certain ways by someone face to face or hand to hand, to actually show you how to do them. So, it was quite difficult for you to train yourself how to do the things that we do as an agency business. Now anybody who wants to, who has the time an inclination can access all of our tools and systems, discover online all the training that they need to know how to master them and can feedback and help work into what the next situation is likely to be.

. . .

Leaders are expected to deliver continual, rather than episodic, transformation and evolution. Transitioning to this state will not only require new leadership skills, organizational structures, processes, and KPIs — leaders need to bring all these things together to operate within this new paradigm.

• Andrew White is a senior fellow in management practice at Saïd Business School, University of Oxford, where he directs the advanced management and leadership program and conducts research into leadership and transformation. He is also a coach for CEOs and their senior teams.
• Michael Smets is a professor of management at Saïd Business School, University of Oxford. His work focuses on leadership, transformation, and institutional change.
• ACAdam Canwell is head of EY’s global leadership consulting practice. Adam has published extensively on leadership and strategic change. Adam has sold and delivered transformation programs across multiple industries in both the UK and Australia, working with FTSE 100 (or their equivalent) organizations

Article link: https://hbr.org/2022/07/organizational-transformation-is-an-emotional-journey?