healthcarereimagined

by The Dalai Lama with Rasmus Hougaard

February 20, 2019

Summary.   The Dalai Lama shares his observations on leadership and describes how our “strong focus on material development and accumulating wealth has led us to neglect our basic human need for kindness and care.” He offers leaders three recommendations. First, to be mindful: “When we’re under the sway of anger or attachment, we’re limited in our ability to take a full and realistic view of the situation.” Also, to be selfless: “Once you have a genuine sense of concern for others, there’s no room for cheating, bullying, or exploitation; instead you can be honest, truthful, and transparent in your conduct.” And finally, to be compassionate: “When the mind is compassionate, it is calm and we’re able to use our sense of reason practically, realistically, and with determination.”close

Over the past nearly 60 years, I have engaged with many leaders of governments, companies, and other organizations, and I have observed how our societies have developed and changed. I am happy to share some of my observations in case others may benefit from what I have learned.

Leaders, whatever field they work in, have a strong impact on people’s lives and on how the world develops. We should remember that we are visitors on this planet. We are here for 90 or 100 years at the most. During this time, we should work to leave the world a better place.

What might a better world look like? I believe the answer is straightforward: A better world is one where people are happier. Why? Because all human beings want to be happy, and no one wants to suffer. Our desire for happiness is something we all have in common.

But today, the world seems to be facing an emotional crisis. Rates of stress, anxiety, and depression are higher than ever. The gap between rich and poor and between CEOs and employees is at a historic high. And the focus on turning a profit often overrules a commitment to people, the environment, or society.

I consider our tendency to see each other in terms of “us” and “them” as stemming from ignorance of our interdependence. As participants in the same global economy, we depend on each other, while changes in the climate and the global environment affect us all. What’s more, as human beings, we are physically, mentally, and emotionally the same.

Look at bees. They have no constitution, police, or moral training, but they work together in order to survive. Though they may occasionally squabble, the colony survives on the basis of cooperation. Human beings, on the other hand, have constitutions, complex legal systems, and police forces; we have remarkable intelligence and a great capacity for love and affection. Yet, despite our many extraordinary qualities, we seem less able to cooperate.

In organizations, people work closely together every day. But despite working together, many feel lonely and stressed. Even though we are social animals, there is a lack of responsibility toward each other. We need to ask ourselves what’s going wrong.

I believe that our strong focus on material development and accumulating wealth has led us to neglect our basic human need for kindness and care. Reinstating a commitment to the oneness of humanity and altruism toward our brothers and sisters is fundamental for societies and organizations and their individuals to thrive in the long run. Every one of us has a responsibility to make this happen.

What can leaders do?

Be mindful

Cultivate peace of mind. As human beings, we have a remarkable intelligence that allows us to analyze and plan for the future. We have language that enables us to communicate what we have understood to others. Since destructive emotions like anger and attachment cloud our ability to use our intelligence clearly, we need to tackle them.

Fear and anxiety easily give way to anger and violence. The opposite of fear is trust, which, related to warmheartedness, boosts our self-confidence. Compassion also reduces fear, reflecting as it does a concern for others’ well-being. This, not money and power, is what really attracts friends. When we’re under the sway of anger or attachment, we’re limited in our ability to take a full and realistic view of the situation. When the mind is compassionate, it is calm and we’re able to use our sense of reason practically, realistically, and with determination.

Be selfless

We are naturally driven by self-interest; it’s necessary to survive. But we need wise self-interest that is generous and cooperative, taking others’ interests into account. Cooperation comes from friendship, friendship comes from trust, and trust comes from kindheartedness. Once you have a genuine sense of concern for others, there’s no room for cheating, bullying, or exploitation; instead, you can be honest, truthful, and transparent in your conduct.

Be compassionate

The ultimate source of a happy life is warmheartedness. Even animals display some sense of compassion. When it comes to human beings, compassion can be combined with intelligence. Through the application of reason, compassion can be extended to all 7 billion human beings. Destructive emotions are related to ignorance, while compassion is a constructive emotion related to intelligence. Consequently, it can be taught and learned.

The source of a happy life is within us. Troublemakers in many parts of the world are often quite well-educated, so it is not just education that we need. What we need is to pay attention to inner values.

The distinction between violence and nonviolence lies less in the nature of a particular action and more in the motivation behind the action. Actions motivated by anger and greed tend to be violent, whereas those motivated by compassion and concern for others are generally peaceful. We won’t bring about peace in the world merely by praying for it; we have to take steps to tackle the violence and corruption that disrupt peace. We can’t expect change if we don’t take action.

Peace also means being undisturbed, free from danger. It relates to our mental attitude and whether we have a calm mind. What is crucial to realize is that, ultimately, peace of mind is within us; it requires that we develop a warm heart and use our intelligence. People often don’t realize that warmheartedness, compassion, and love are actually factors for our survival.

Buddhist tradition describes three styles of compassionate leadership: the trailblazer, who leads from the front, takes risks, and sets an example; the ferryman, who accompanies those in his care and shapes the ups and downs of the crossing; and the shepherd, who sees every one of his flock into safety before himself. Three styles, three approaches, but what they have in common is an all-encompassing concern for the welfare of those they lead.

Article link: https://hbr-org.cdn.ampproject.org/c/s/hbr.org/amp/2019/02/the-dalai-lama-on-why-leaders-should-be-mindful-selfless-and-compassionate

• The Dalai Lama is the spiritual leader of the Tibetan People. He was awarded the Nobel Peace Prize in 1989 and the U.S. Congressional Gold Medal in 2007. Rasmus Hougaard is the founder and managing director of Potential Project, a global leadership and organizational development firm, and the coauthor of the new book, The Mind of the Leader: How to Lead Yourself, Your People, and Your Organization for Extraordinary Results. He has created an app that will help you develop mindfulness, selflessness, and compassion in your leadership

Please share with friends and colleagues that might have an interest in Market Research for VA Supply Chain Modernization – part 3

Greetings,

You are invited to a Zoom webinar.
When: Mar 21, 2022 01:00 PM Eastern Time (US and Canada)
Topic: Market Research for VA Supply Chain Modernization – Part 3

Register in advance for this webinar:
https://us02web.zoom.us/webinar/register/WN_RZgFjt5JS6aU5ehv2xNxjg

After registering, you will receive a confirmation email containing information about joining the webinar.

---

Webinar Speakers

Ross A. Davidson (Associate Executive Director, Office of Facilities Planning Office of Construction and Facilities Management @Department of Veterans affairs)
Mr. Davidson serves as the principal advisor to the Executive Director, CFM on planning, architectural, engineering, and estimating disciplines, and assists and manages the development and maintenance of VA A/E quality standards for VA’s built environment; State Nursing Home Grant and Homeless Grant Programs’ facility quality control; cost estimating; and value engineering, and historic preservation and National Environmental Policy Act (NEPA) compliance issues.
Mr. Davidson is a retired U.S. Army Colonel with an extensive and successful background of service.

Mr. Davidson has a Bachelor of Architecture from the University of Notre Dame, a Master of Urban Design, a Master of Urban Planning, and a Graduate Certificate in Real Estate Development from the University of Michigan, and Master of Strategic Studies from the U.S Army War College. He is a Design Build Institute of America (DBIA) professional and Fellow with the Health Facility Institute.

Matthew J. Manning (Assistant Director, HCA Acquisition Division Office of Mission Support @Veterans Benefits Administration)

Vincent S. Calabrese (National Program Manager, Customer Service Consolidated Mail Outpatient Pharmacy National Office @Department of Veterans Affairs)

Michael Parrish (Principal Executive Director for the Office of Acquisition, Logistics, and Construction (OALC). Head of Contracts. @Department of Veterans Affairs)
Mr. Parrish has over 35 years of senior leadership experience in military, government, corporate, and non-profit organizations. After graduating in 1985 with a Bachelor’s Degree in Mechanical Engineering from the U.S. Military Academy, Mr. Parrish served for 14 years on active duty and 21 years in the in the U.S. Army Reserves where he held various leadership positions of increasing responsibility as an Army Aviator, serving as an Air Operations Officer during Desert Storm and culminating as a member of the Army Acquisition Corps. Mr. Parrish has been Chairman & CEO of several publicly traded companies and was founder and CEO for several start-ups. Mr. Parrish holds a Master’s Degree in Aeronautical and Astronautical Engineering from Stanford University and an MBA with honors from the Wharton School at the University of Pennsylvania.

Joe Grace, Captain USN (Retired) (President and CEO (Moderator for this event) @Grace and Associates)
Captain Joe Grace, USN (Retired), is the President and CEO of Grace & Associates. Mr. Grace is a graduate of the United States Naval Academy, a former nuclear submarine officer, and earned his MBA from the University of New Orleans. During his active and reserve military career, he worked a variety of military assignments, including his final tour as the Chief Information Officer for Navy Medicine. Mr. Grace has worked for multiple companies and held many positions in industry. He is a serial entrepreneur, venture construction leader and long time business owner. He now works as a connector between industry and government, with an emphasis on Military Health and the Department of Veterans Affairs. His many roles include Moderator, Facilitator, a key trusted advisor to leadership and a mentor to industry and government. As an entrepreneur, Mr. Grace has started many technology-based companies and taken three public. Grace & Associates holds no government contracts

Dr. Angela Billups (Executive Director, Office of Acquisition and Logistics @Department of Veterans Affairs)
Dr. Angela Billups was appointed as the Executive Director, Office of Acquisition and Logistics at the Department of Veterans Affairs (VA) on November 26, 2018. As the Executive Director of one of the largest acquisition and logistics programs in the Federal government, Dr. Billups manages and oversees the development and implementation of policies and procedures for department-wide acquisition and logistics programs supporting all VA facilities and the VA Acquisition Academy in Frederick, Maryland. She is the primary advisor to the Chief Acquisition Officer and to the Secretary of Veterans Affairs for matters related to enterprise business strategies and acquisition management. Dr. Billups also serves as the VA Senior Procurement Executive and VA Suspension and Debarment Official. Dr. Billups is a seasoned acquisition professional with years of experience advising and assisting senior officials, government and industry, with the goal of helping them realize the acquisition life cycle.

Greg McLean (Special Projects Manager @Department of Veterans Affairs)
Gregory “Greg” McLean Special Project Manager Reported to APS (on detail) in May 2020. Gregory McLean is Vice-Chancellor of the VA Acquisition Academy (VAAA) Program Management (PM) School, where he oversees the training of VA program managers. The Program Management curriculum is intended to ensure that VA has the most qualified program managers and includes competency assessment, classroom and online learning, coaching and mentoring, on-the-job qualification development, assignment-specific courses, training toward Federal Acquisition Certification in Program/Project Management (FAC-P/PM), and continuing education. Mr. McLean previously served as Director of Program Management Policy in the Department of Veterans Affairs Office of Policy and Planning. Mr. McLean has more than 22 years of industry and Government experience, including developing and implementing national training and certification programs for major and critical acquisition initiatives.

Phillip Christy (Deputy Executive Director, Office of Acquisition, Logistics, and Construction (OALC) @Department of Veterans Affairs)
Mr. Christy serves as an advisor to OALCs Principal Executive Director on acquisition, logistics, and construction issues. His responsibilities include the day to day operational management of OALCs three major organizational elements: the Office of Acquisition and Logistics, the Office of Procurement, Acquisition and Logistics and the Office of Construction and Facilities Management. Mr. Christy is a retired U.S. Army Medical Service Corps Officer, and he served in multiple senior acquisition, construction and logistics positions during his 20-year career. Mr. Christy is a native of Renton, Washington. He holds an Executive Juris Doctorate in Health Law from the Concord University of Law, a Master of Science in Health Care Administration from Central Michigan University, and a Bachelor of Arts in Spanish and Business from Washington State University

President Joe Biden signed a law that requires critical infrastructure entities to report cyber attacks within 72 hours and report ransom payments in 24 hours.

Peyton Doyle

Published: 16 Mar 2022

On Tuesday, President Joe Biden signed into law a federal cyber attack reporting requirement aimed at protecting critical infrastructure in the United States.

The Strengthening American Cybersecurity Act of 2022 was created to shore up cyberdefenses and increase the power of agencies investigating cybersecurity incidents. The Cyber Incident Reporting for Critical Infrastructure Act of 2022 is a part of the new law that focuses on how critical infrastructure organizations must report cyber attacks to the federal government, specifically the Cybersecurity and Infrastructure Security Agency (CISA).

The Critical Infrastructure Act states that an entity in the critical infrastructure sector “shall report the covered cyber incident to the Agency not later than 72 hours after the covered entity reasonably believes that the covered cyber incident has occurred.” It also says that the director of CISA may not require a report any earlier than that 72-hour mark.

Peter Guffin, chair of law firm Pierce Atwood’s privacy and data security practice, discussed the aim of the law with SearchSecurity.

“As its name suggests, the Strengthening American Cybersecurity Act, passed by the U.S. Senate last week, aims to bolster the defenses of federal government agencies and critical infrastructure owners, such as energy and healthcare facilities, against major cyberthreats and cyber incidents, including ransomware attacks,” Guffin said. “The expectation is that the prompt reporting and subsequent sharing of such information will arm federal agencies and critical infrastructure owners with the information they need to be able to defend themselves against major cyberthreats and incidents.”

On top of the initial report, any entity that submits a ransom payment to a threat actor must also report that they did so to CISA within 24 hours of delivering the payment.

The law details not only the timeline for reporting cyber attacks and specifically ransomware attacks on critical infrastructure, but also outlines the new powers and responsibilities given to CISA.

The law identifies CISA as the head agency in charge of collecting and analyzing the data on cyber incidents, but it also dictates that the agency must “coordinate and share information with appropriate Federal departments and agencies to identify and track ransom payments, including those utilizing virtual currencies.”

Sharing information with other agencies was a sticking point when the bill got to Congress, as it did not explicitly require CISA to assist other agencies, something that the Department of Justice took issue with.

The bill was passed by the House, however, and was adjusted so that all federal agencies were able to see what reported incidents CISA was handling if they wished. It also stated that CISA was required to share relevant findings with not just federal departments, but local entities as well.

Subsection (a)(4-5) of section 2241 states that the agency must provide “timely, actionable, and anonymized reports of cyber incident campaigns and trends, including, to the maximum extent practicable, related contextual information, cyber threat indicators, and defensive measures,” to all “appropriate entities, including sector coordinating councils, Information Sharing and Analysis Organizations, State, local, Tribal, and territorial governments, technology providers, cybersecurity and cyber incident response firms, and security researchers.”

Another key part of the law comes from a subsection titled “Periodic Briefing,” which states that on the first day of each month, the director of CISA must collaborate with the national cyber director, attorney general and the director of national intelligence to give a briefing on the “national cyber threat landscape.” This briefing would feature the total number of reports received by CISA in the previous month, new trends in cyber incidents and ransomware attacks, and how the past month compares to the month before it. It also says that the briefing must have a summary of how the information in the received reports was used by CISA.

The law requires the briefings to be delivered to the majority and minority leaders of the Senate, the speaker of the House and the minority leader of the House, the Senate Committee on Homeland Security and Governmental Affairs and the House Committee on Homeland Security.

What is still left

As far as how this new critical infrastructure law relates to state data breach notification requirements, Guffin said that it borrows from and enhances some of the laws produced by state legislatures.

“By requiring the prompt reporting of and sharing of information regarding actual data security incidents, the Act adopts, but vastly strengthens and improves upon, a sound regulatory model found in most existing data breach notification laws in the U.S.,” he said.

While this law focuses on critical infrastructure attacks and informing federal agencies, it does differ in how American citizens receive data breach notifications under different state laws. The federal law does not require critical infrastructure entities to inform U.S. citizens of cyber attacks. The only requirement is to inform federal agencies, and that leaves millions of Americans potentially in the dark about cyber attacks.

As of 2018, each state within the U.S. has some form of data breach notification law. While they all differ as far as how data breaches are reported to federal agencies and state governments, they all have one thing in common: They require entities to notify victims if their personal information may have been exposed or stolen.

Heidi Shey, a principal analyst at Forrester Research, discussed obstacles that are holding the U.S. back from enacting a federal data breach notification law.

“I think some of this stems from how the U.S. as a whole thinks about privacy and consumer privacy, because compared to a place like Europe, which looks at it as a fundamental right, you have a right to privacy,” Shey told SearchSecurity. “Whereas I think in the U.S., it’s more of this perspective of a trade-off. Because of that, I think there’s greater tie into this environment of what is considered a business-friendly type of policy or regulation versus what is about protecting consumers and their privacy.”

Article link: https://www-techtarget-com.cdn.ampproject.org/c/s/www.techtarget.com/searchsecurity/news/252514713/Biden-signs-law-on-reporting-critical-infrastructure-cyber-attacks?

March 2022 
Topics: Strategic Planning, Communications Technology (General), Computer Security, Policy

Charles Clancy Ph.D., The MITRE Corporation

DOWNLOAD PDF (1.31 MB) The internet is on the verge of the next fundamental change. The third generation of the World Wide Web, known as Web3, is bringing an entirely new technology stack built on blockchain. This new epoch of social interconnectivity blurs the lines between telecommunications and finance, compounding an already complex regulatory ecosystem.While Web3 is creating tremendous new opportunities, it is also at the center of major social, economic, and national security issues. A national strategy for Web3 is essential to the U.S. building on its early lead in the technology and to mitigate potential detrimental outcomes.In this paper, MITRE’s Charles Clancy, Ph.D., describes the generational arc of web technologies and the new, unique features of Web3, as well as policy objectives and specific recommendations for a national strategy.

Related Sections

Focus Areas

• Information Systems

Browse Topics

Air Traffic Management  (79)

Artificial Intelligence  (62)

Community Impact  (18)

Cybersecurity  (138)

Computer Security  (81)

Economic and Cost Analysis  (15)

Emergency Preparedness and Response  (27)

Intelligence After Next  (11)

Modeling and Simulation  (96)

National Security  (9)

Public Health  (62)

Risk Management (26)

Article link: https://www.mitre.org/publications/technical-papers/call-to-action-developing-national-strategy-web3

Related Publications

Beyond Thin Clients: Limiting Cybersecurity Vulnerabilities

By Design: Integrating Privacy into Information Systems

Mission Not Impossible: Defending IT Systems Through Mission Assurance

The Human Factor: Using Behavioral Science to Counter Insider Threats

Helping the FAA Adapt to Evolving Cyber Threats

NEWS PROVIDED BYChenega Applied Solutions

Mar 15, 2022, 08:51 ET

STAFFORD, Va., March 15, 2022/PRNewswire/ — Chenega Applied Solutions (CAS), a subsidiary of Chenega Corporation’s Military, Intelligence, and Operations Support (MIOS) Strategic Business Unit and the Cyber Bytes Foundation (CBF), a 501(c)3 organization working to establish a sustainable cyber community through education, innovation, and outreach programs, are proud to announce their partnership to develop a showcase software factory at the Quantico Cyber Hub called “Nebula.” The goal of Nebula is to become a “birthplace” of software factories throughout the Department of Defense (DoD) and the US Government (USG) by providing a fully operational software factory with best-in-class tools, development platforms, and cloud access for Government programs to come up with successful “Proofs of Concepts (POCs)” and “Minimal Viable Products (MVPs)” free of charge to help fuel-inject the Government’s innovation progress.

Since 2017, Chenega Applied Solutions has become a leader in Department of Defense’s (DoD’s) budding DevSecOps movement by providing fully managed turn-key software factories and innovation environments to notable DoD programs such as Kessel Run, LevelUP, and Project Synergy, through its innovative Modernization as a Service (MaaS) offering. Using their best-in-class MaaScapability, Chenega Applied Solutions will be building the Nebula Software Factory on the second floor of the Cyber Bytes Foundation’s Quantico Cyber Hub, which hosted its Grand Opening in September 2021. The Quantico Cyber Hub (QCH) is the largest Cyber Security Center of Excellence in a Virginia HUBZone. It was designed as an agnostic “Cyber Domain Ecosystem,” making it the perfect place for CAS to showcase the state-of-the-art software factories produced by MaaS for the DOD around the country. Current projects being worked on at the QCH include the Cooperative Research and Development Agreement (CRADA) with the U.S. Marine Corps as well as projects with the Department of Homeland Security, and Department of State.

“Cyber Bytes Foundation is committed to bringing technology and solutions to the Warfighter at the local, State, Federal and DoD levels at the speed of Innovation,” says Jonathan Payton of the Cyber Bytes Foundation. “The Nebula Software Factory, in partnership with Chenega Applied Solutions, is the latest representation of that commitment.” 

The Nebula Software Factory will support QCH’s mission of being a place where subject matter experts come together with processes and capabilities to customize solutions to accelerate the implementation of Advanced Cyber Technologies through experimentation, innovation, research, and application. CAS will provide all aspects of a modern software factory, including but not limited to computers, hardware, software, furniture, and collaboration equipment.  Additionally, CAS has partnered with Cornerstone to provide free access to their cutting edge TruStacks DevSecOps Orchestration Platform, a deployable “software factory in a box” providing full end-to-end DevSecOps orchestration. Further partners include Insight Public Sector, Red Hat, and GitLab as contributors to the development platform.

“True to its name, we want Nebula to be the birthplace of software factories for the DoD and USG. Despite all the press and attention, the DevSecOps movement within the DoD and USG is currently a disrupter movement and needs more support. Our goal with Nebula is to provide a place where foundling, bootstrap software development groups across the DoD and USG can come, free of charge, to use the best-in-class tools and technologies, create meaningful MVPs, and get the proof of concepts they need to go back to their leadership and say ‘This works! Look what we can accomplish if we leverage the right tools and methods! Support this!'” says Mike Masten, Vice President of Operations for CAS and founder of MaaS.

If you work within a government or DOD agency and would like to be considered as a beta user group for the Nebula Software Factory please fill out the form linked here.

Both CAS and CBF are committed to providing a top-of-the-line cyber ecosystem at the Quantico Cyber Hub and look forward to sharing the process of building the Nebula Software Factory. Follow along on the Chenega Applied Solutions Linkedin and Cyber Bytes Foundation’s social channels as well. A grand opening is expected in May 2022.

About Cyber Bytes Foundation:

The Cyber Bytes Foundation (CBF) is a 501(c)3 organization working to establish and sustain a unique “Cyber Ecosystem” to produce education, innovation, and outreach programs to enhance developers for the cyber workforce.

About Chenega Applied Solutions:

Chenega Applied Solutions (CAS) is an Alaska Native-Owned Company operating under Chenega Corporation’s Military, Intelligence, and Operations Support (MIOS) Strategic Business Unit. For the better part of a decade, CAS has served federal agencies and the DOD as trusted advisors in IT, Records Management, Language Services, and more. CAS is proud to now support the DOD in its efforts to modernize through Modernization as a Service (MaaS).

Article link: https://www.prnewswire.com/news-releases/chenega-applied-solutions-to-build-nebula-software-factory-at-quantico-cyber-hub-301502872.html?tc=eml_cleartimeu

Contact Information:
Chenega Applied Solutions
Caleb Thompson
202.602.2039
331918@email4pr.com 

Cyber Bytes Foundation
Jonathan Payton
331918@email4pr.com

NCSC works with its partners to assess and mitigate the activities of foreign intelligence entities and other adversaries who attempt to compromise the supply chains of our government and industry. These adversaries exploit supply chain vulnerabilities to steal America’s intellectual property, corrupt our software, surveil our critical infrastructure, and carry out other malicious activities. They infiltrate trusted suppliers and vendors to target equipment, systems, and information used every day by the government, businesses, and individuals. The cost to our nation comes not only in lost innovation, jobs, and economic advantage, but also in reduced U.S. military strength.

RELEVANT REPORTS, BRIEFINGS & READING MATERIAL

Executive Orders

• EO 13636 Improving Critical Infrastructure Cybersecurity
• EO 13806 Assessing and Strengthening the Manufacturing and Defense Industrial Base and Supply Chain Resiliency of the United States (PDF)
• EO 13873 Securing the Information and Communications Technology and Services Supply Chain
• EO 13913 Establishing the Committee for the Assessment of Foreign Participation in the United States Telecommunications Services Sector
• EO 13984 Taking Additional Steps to Address the National Emergency with Respect to Significant Malicious Cyber-Enabled Activities
• EO 14005 Ensuring the Future Is Made in All of America by All of America’s Workers
• EO 14017 America’s Supply Chains
• EO 14024 Blocking Property with Respect to Specified Foreign Activities of the Government of the Russian Federation
• EO 14028 Improving the Nation’s Cybersecurity
  •  NIST: Security Measures for “EO-Critical Software” Use
  •  NIST: Recommended Minimum Standards for Vendor or Developer Verification (Testing) of Software Under Executive Order (EO) 14028
• EO 14034 Protecting Americans’ Sensitive Data from Foreign Adversaries

Supply Chain Risk Management – Authorities, Policies, and

      Standards

• Executive Order 13806 report (PDF)
• Executive Order 14017 – America’s Supply Chains (PDF)
• SECURE Technology Act: Establishment of the Federal Acquisition Security Council

          –  Federal Acquisition Security Council overview (PDF)

          –  Federal Acquisition Supply Chain Security Act graphic (PDF)

          –  H.R.7327 SECURE Technology Act (PDF)

   –  (New) FASC Final Rule(PDF)

• NIST Special Publication 800-161 (PDF)
• ICD 731, Supply chain Risk Management for the Intelligence Community (PDF)

 Tools

•  User Manual: The Outsourcing Network Services Assessment Tool (ONSAT) (PDF)
• (New) ONSAT Tool

National Supply Chain Integrity Month – A Call to Action

• Press Release: National Supply Chain Integrity Month – A Call to Action
• Software Supply Chain Attacks – 2021
• Supply Chain Risk Management: Best Practices in One Page – 2021
• Framework for Assessing Risks – 2021

Supply Chain Risk Management: Reducing Threats to Key U.S. Supply Chains

• NTIA Releases Minimum Elements for a Software Bill of Materials
• NCSC Supply Chain Risk Management Tri-Fold: Reducing Threats to Key U.S. Supply Chains (PDF)

Sector-Specific Supply Chain Best Practices

• Information and Communications Technology Sector
• Manufacturing and Production Sector
• Health Care Sector
• Energy Sector
• Ongoing Cyber Threats to U.S. Water and Wastewater Systems Joint Cybersecurity Advisory (PDF)

Podcasts

• Podcast on How One Federal Program Worked to Enhance its Supply Chain Security
• Podcast on Cyber & Supply Chain Threats to the Health Care Sector

Supply Chain Risk Management (SCRM) – Don’t Be the Weakest 

      Link!

• NCSC Bakers’ Dozen – 13 Elements of an Effective SCRM Program (PDF)
• NCSC SCRM Best Practices(PDF)
• Intelligence Community Logistics and SCRM (PDF)
• NCSC Supply Chain Risk Management video
• 2018 Foreign Economic Espionage in Cyberspace report (PDF)
• NCSC Federal Partner Newsletter : National Supply Chain Integrity Month (PDF)
• MITRE report: Deliver Uncompromised (PDF)

Thought Leaders: Supply Chain Security 

• The Emerging Cyber Threat to Industrial Control Systems (London: United Kingdom, Lloyd’s, February 2021) [Article characterized as a “Call to Action”]
• CSIS Working Group on Trust and Security in 5G Networks, Criteria for Security and Trust in Telecommunications Networks and Services (Washington, D.C.: Center for Strategic & International Studies, May 2020)
• Assessing SCRM Capabilities and Perspectives of the IT Vendor Community: Toward a Cyber-Supply Chain Code of Practice (College Park: University of Maryland, Robert H. Smith School of Business, 2011)
• Cyber Supply Chain Risk Management: Toward a Global Vision of Transparency and Trust (Redmond, WA: Microsoft, 2011). [also Political and Legal]
• Defense Science Board Task Force on Cyber Supply Chain (Washington, D.C.: U.S. Department of Defense, April 2017)
• Deliver Uncompromised: A Strategy for Supply Chain Security and Resilience in Response to the Changing Character of War (McLean, Virginia: MITRE Corporation, August 2018)
• How Chinese Cybersecurity Standards Impact Doing Business in China (Washington, D.C.: Center for Strategic & International Studies, August 2018)
• Supplier Assurance Framework: Good Practice Guide (London: United Kingdom Cabinet Office, May 2018)
• Breaking Trust: Shades of Crisis across an Insecure Software Supply Chain (Washington, D.C.: Atlantic Council, July 2020)

5G Wireless Technology

• Potential Threat Vectors to 5G Infrastructure – CISA, NSA, ODNI Report
• State Department 5G Technology Website
• State Department Fact Sheet: 5G Security – What is Trust?
• State Department Fact Sheet: 5G Security – Incredible Promise, Significant Risk
• State Department 5G Technology Video
• DHS 5G Wireless Networks Graphic: Market Penetration and Risk Factors

Supply Chain Resources 

• (New) General Services Administration (GSA) and Federal Acquisition Institute (FAI) training course FAC-093: “Introduction to Supply Chain Risk Management”
  • Requires Defense Acquisition University (DAU) account or Department of Defense (DoD) Common Access Card (CAC)
• Department of Defense resources
• Department of Homeland Security resources
• UK National Cyber Security Centre resources

Additional Resources

• National Cyber Strategy of the United States – September 2018(PDF)
• National Security Strategy 2017 (PDF)
• National Counterintelligence Strategy 2016 (PDF)
• Supply Chain Risk Management Practices for Federal Information Systems and Organizations (PDF)
• (New) Committee on National Security Systems Directive Supply Chain Risk Management, CNSSD 505 (PDF)
• Defense Science Board (DSB) Task Force Report on Cyber Supply Chain
• DNI ICD 731 Supply Chain Risk Management 20131207 (PDF)
• DNI ICS 731-01 Supply Chain Criticality Assessment 20151002 (PDF)
• DNI ICS 731-02 Supply Chain Threat Assessments 20160517 (PDF)
• DNI ICS 731-03 Supply Chain Information Sharing (PDF)

Article link: https://www.dni.gov/index.php/ncsc-what-we-do/ncsc-supply-chain-threats

RELATED LINKS

NCSC Awareness Materials

Your Personal Information: Protecting it from Exploitation

RELATED CONTENT

National Counterintelligence Strategy for the United States

National Insider Threat Task Force Fact Sheet

NCSC Strategic Plan

Michael Orlando, Senior Official Performing The Duties Of The Director, NCSC

BY: Ki Lee

Mar 11, 2022 | 9:00 am

The Department of Defense (DoD) last month released its Software Modernization Strategy, an important step to unifying existing technology and directing a more joint approach to systems of the future. It notes that our competitive posture is “reliant on strategic insight, proactive innovation, and effective technology integration enabled through software capabilities.” Further, it asks DoD entities that are driving software development to address management and governance of the 29 software factories spread across the services.

The promise of software factories is significant. The construct has quickly demonstrated agile development of critical capabilities, while also delivering the speed and flexibility that DoD requires. This has been achieved with commitment to automation, modular and open architecture, and continuous authority to operate (cATO). Given how much progress has been achieved, software factories will undoubtedly play an important role in modernizing DoD technology, through a common framework which will drive efficiencies and provide oversight, best practices, and baseline software for reuse.

Industry’s Role  

The industry can offer lessons learned and best practices from supporting software factories over the past five years, and the Software Modernization Strategy makes several mentions of the role of industry within the acquisition process. Booz Allen has worked in partnership with the DoD to rapidly develop, integrate and field cutting edge mission capabilities. We know what works, and what it will take to mature the software factory ecosystem to bring more efficient, innovative software to the DoD.

The software factory ecosystem cannot be a one-size-fits-all approach. Given different mission requirements (i.e., from IT to OT), acquisition strategy and program maturity (i.e., inception to sustainment), bringing all of these software factories into a single factory or even entity will likely be both inefficient and ineffective.

DoD leaders would benefit from establishing an ecosystem that streamlines across today’s software factories and those that will exist in the future. We would offer that the DoD Chief Information Office should consider the following as a construct aligning software factories within a framework for governance:

Mission Purpose. Each software factory was purposefully designed to cover a broad spectrum of mission requirements. Some entities support complex combat requirements and require deep hardware integration for use on the battlefield driving additional layers of policy, cyber, security and technical specifications. Others focus on IT system development that requires less hardware integration, but instead requires standards for open architecture and system interoperability. Aligning against a core set of mission categories will help streamline baseline software and regulations.

Developmental Maturity of System. DoD must also consider the maturity of the software that’s being developed in applying governance to the software factories. For instance, a software factory for a system as mature as the F-35 program has very different needs (e.g., cyber regulations) than an entity that is incubating new software for prototyping and testing capabilities with more pipeline requirements (e.g., Navy’s Rapid Autonomy Integration Lab (RAIL) software factory).

Operations Model. Finally, the framework should address the variety of different models of ownership and accountability. Depending on how the DoD and industry partner together, the risks and benefits can vary significantly. In our experience, there are three broad models for operations that work effectively for managing cost, risk, and innovation: Government-Owned, Government-Operated (GoGo); Government-Owned, Contractor-Operated (GoCo); and Contractor-Owned, Contractor-Operated (CoCo). We have supported all of these models across the federal government and have lessons learned from each, including retaining government data rights, ensuring accountability and driving a culture of collaboration.

As the DoD works on the implementation plan for the Software Modernization Strategy and creates a framework for how to manage and govern its software factory ecosystem, aligning and categorizing its existing resources will be critical for delivering agile, mission critical software to current and future weapons systems.

Further, it is incumbent on the industry to continue to streamline and drive efficiencies in its software development. Across the Defense Industrial Base, we must commit to building open, reusable baseline software that can be extended and augmented across multiple use cases. Whether we are developing software on corporate research and development budgets or on government use cases, creating software that can be refined to meet mission needs is absolutely critical. From our own experience, we are committed to taking our investments and integrating them to build for custom mission solutions. Our AI/ ML software factories and cyber software factories are built consistently from a horizontal perspective so that they can be leveraged and reapplied for more vertical mission sets.

Through both a more consistent government framework for software factories built on real use cases and industry commitment to re-baselining, executing this new strategy will be critical for continuing to modernize technology to support today and tomorrow’s warfighter.

Article link: https://www.meritalk.com/creating-an-effective-framework-for-dods-software-factories/

Written by Mark Pomerleau
Mar 11, 2022 | FEDSCOOP

U.S. Cyber Command is looking to more tightly link cyberspace “effects” operations with information operations, according to its deputy commander.

When asked where he sees the command headed in the next five to 10 years, Lt. Gen. Charles Moore said he hopes it will broaden the concept of a “truly synchronized and integrated information warfare approach.”

“Without a doubt, what we have learned is that cyber effects operations in … more of a combined arms approach with what we call traditionally information operations, is an extremely powerful tool,” he said Thursday at Cybercom’s legal conference.

Cybercom has reportedly begun engaging in some level of combined operations along these lines. It has been reported that the command has sent messages to Russian cyber operatives letting them know the U.S. military knows who they are and what they’re doing as a means of deterring their potential future malicious activity aimed against the U.S.

Many of the organization’s subordinate commands have taken on a larger rolein info warfare for their respective services, reorganizing and consolidating similar capabilities to provide an integrated approach.

Former officials have pushed for a stronger alignment of cyber ops and information ops.

“When you can perform information operations to influence adversaries’ perceptions and maybe their behavior in conjunction with those effects, you can position yourself to see real-time reflections on how they’re assessing what you’re conducting. And then you can stay ahead of their decision cycle, inside of their OODA loop: their observe, orient, decide and action [cycle]. And you can do that at speed over time,” Moore said. “That’s where we want to be. That’s an extremely powerful tool inside the Department of Defense’s toolkit.”

Previously, Moore had explained that under DOD’s authorities and ability to gain access to different types of networks and social media, it can be positioned to see what the adversary is thinking.

“What that allows us to do is in a very precise manner to target individuals or groups of messages that we know will have an effect. And then when you combine that with actual cyber effects itself in a very combined arms approach … [it allows Cybercom] to drive the enemy’s decision calculus and cycle,” he said during an event hosted by C4ISRNET last year.

While cyber operators are experts in networks, not information ops, the services have begun aligning information operations specialists to work alongside cyber operators.

Despite having the necessary policies and authorities in place to execute these types of operations, Moore said DOD will need to harness emerging technologies such as artificial intelligence, big data analytics and even quantum computing to truly be successful in the future.

“You’re going to need these types of capabilities to execute across the breadth, the scope, the depth and the speed that’s going to be necessary to stay ahead of the adversaries and really drive their decisions cycles, drive their perceptions as opposed to being driven,” he said.

A better grasp of information warfare and what that looks like across the federal government and Department of Defense is warranted, Moore said. He explained that the Pentagon and the nation need to focus on a strategy aimed at affecting adversary perceptions.

Such a strategy or an approach should inform the government on what types of things to invest in, what to reveal and conceal, what and when to exercise capabilities and concepts, and when to conduct troop movements.

“All of these types of things ought to be part of that broader information warfare strategy leading back to the specific objectives and goals that you hope to achieve,” Moore said. “I think in the department, a lot of times, we have [been] a little bit backwards. We have pockets of excellence and those pockets are getting bigger. That’s the good news. But I think in general, they’re not completely synchronized.”

Article link: https://www.fedscoop.com/cyber-command-moving-toward-an-integrated-information-warfare-approach/

By Timothy Prickett Morgan

Some of the most important luminaries in the HPC sector have spoken from on high, and their conclusions about the future of the HPC market are probably going to shock a lot of people.

In a paper called Reinventing High Performance Computing: Challenges and Opportunities, written by Jack Dongarra at the University of Tennessee and Oak Ridge National Laboratory – Jack, didn’t you retire? –  and Dan Reed at the University of Utah and Dennis Gannon formerly of Indiana University and Microsoft, we get a fascinating historical view of HPC systems and then some straight talk about how the HPC industry needs to collaborate more tightly with the hyperscalers and cloud builders for a lot of technical and economic reasons.

Many in the HPC market have no doubt been thinking along the same lines. It is in the zeitgeist, being transported on the cosmic Ethernet. (And sometimes InfiniBand where low latency matters.) And by the way, we are not happy about any of this, as we imagine you are not either. We like the diversity of architectures, techniques, and technologies that the HPC market has developed over the years. But we also have to admit that the technology trickle down effect where advanced designs eventually make their way down into large enterprises and then everywhere else did not happen at the speed or to the extent that we had hoped it might over the decades we have been watching this portion of the IT space.

As usual, the details of the scenario painted in this paper and the conclusions that the authors draw are many and insightful, and we agree wholeheartedly that there are tectonic forces at play in the upper echelons of computing. Frankly, we founded The Next Platform with this idea in mind and used the same language, and in recent years have also wondered how long the market for systems that are tuned specifically for HPC simulation and modeling would hold out against the scale of compute and investment by the hyperscalers and cloud builders of the world.

The paper’s authors have a much better metaphor for contrasting large-scale HPC system development, and that is to look at it like a chemical reaction. HPC investments, especially for capability-class machines, are endothermic, meaning they require infusions of capital from governments and academia to cover the engineering costs of designing and producing advanced systems. But investments in large-scale machinery at the hyperscalers and cloud builders are exothermic, meaning they generate cash – among the Magnificent Seven of Amazon, Microsoft, Google, Facebook, Alibaba, Baidu, and Tencent, it is enormous amounts of money. We would go so far as to say that the reaction is volcanic among the hyperscalers and cloud builders, which is exothermic with extreme attitude. Enough to melt rock and build mountains.

The geography of the IT sector has been utterly transformed by these seven continents of compute, and we all know it, and importantly, so does the HPC community that is trying to get to exascale and contemplating 10 exascale and even zettascale.

“Economies of scale first fueled commodity HPC clusters and attracted the interest of vendors as large-scale demonstrations of leading edge technology,” the authors write in the paper. “Today, the even larger economies of scale of cloud computing vendors has diminished the influence of high-performance computing on future chip and system designs. No longer do chip vendors look to HPC deployments of large clusters as flagship technology demonstrations that will drive larger market uptake.”

The list of truisms that Dongarra, Reed, and Gannon outline as they survey the landscape is unequivocal, and we quote:

• Advanced computing of all kinds, including high-performance computing, requires ongoing non-recurring engineering (NRE) investment to develop new technologies and systems.
• The smartphone and cloud services companies are cash rich (i.e., exothermic), and they are designing, building, and deploying their own hardware and software infrastructure at unprecedented scale.
• The software and services developed in the cloud world are rich, diverse, and rapidly expanding, though only some of them are used by the traditional high-performance computing community.
• The traditional computing vendors are now relatively small economic players in the computing ecosystem, and many are dependent on government investment (i.e., endothermic) for the NRE needed to advance the bleeding edge of advanced computing technologies.
• AI is fueling a revolution in how businesses and researchers think about problems and their computational solution.
• Dennard scaling has ended and continued performance advances increasingly depend on functional specialization via custom ASICs and chiplet-integrated packages.
• Moore’s Law is at or near an end, and transistor costs are likely to increase as features sizes continue to decrease.
• Nimble hardware startups are exploring new ideas, driven by the AI frenzy.
• Talent is following the money and the opportunities, which are increasingly in a small number of very large companies or creative startups.

There is no question that the HPC and hyperscaler/cloud camps have been somewhat allergic to each other over the past decade or two, although there has been some cross pollination in recent years, with both people and technologies from the HPC sector being employed by the hyperscalers and cloud – mostly to attract HPC simulation and modeling workloads, but also because of the inherent benefits of technologies such as MPI or InfiniBand when it comes to driving the key machine learning workloads that have made the hyperscalers and cloud builders standard bearers for the New HPC. They didn’t invent the ideas behind machine learning – the phone company did – but they did have the big data and the massive compute scale to perfect it, and they are also going to be the ones building the metaverse – or metaverses – that are really just humungous simulations, driven by the basic principles of physics, done in real time.

What it comes down to is that standalone HPC in the national and academic labs takes money and has to constantly justify the architectures and funding for the machines that run their codes, and that the traditional HPC vendors – so many of them are gone now – could not generate enough revenue, much less profit, to stay in the game. HPC vendors were more of a public-private partnership than Wall Street ever wanted to think about or the vendors ever wanted to admit. And when they made any profits, it was never sustainable – just like being a server OEM is getting close to not being sustainable due to the enormous buying power of the hyperscalers and cloud builders.

We will bet a Cray-1 supercomputer assembled from parts acquired on eBay that the hyperscalers and cloud builders will figure out how to make money on HPC, and they will do it by offering applications as a service, not just infrastructure. National and academic labs will partner there and get their share of the cloud budget pool, and in some cases where data sovereignty and security are particularly high, the clouds will offer HPC outposts or whole dedicated datacenters, shared among the labs and securely away from other enterprise workloads. And moreover, the cloud makers will snap up the successful AI hardware vendors – or design their own AI accelerator chips as AWS and Google do – and the HPC community will learn to port their routines to these devices as well as CPUs, GPUs, and FPGAs. In the longest of runs, people will recode HPC algorithms to run on a Google TPU or an AWS Tranium. No, this will not be easy. But HPC will have to ride the coattails of AI because otherwise it will diverge from the same hardware path and not be an affordable endeavor.

As they prognosticate about the future of HPC, Dongarra, Reed, and Gannon outline the following six maxims that should be used to guide its evolution:

Maxim One: Semiconductor constraints dictate new approaches.There are constraints from Moore’s Law slowing and Dennard scaling stopping, but it is more than that. We have foundry capacity issues and geopolitical problems arising from chip manufacturing, as well as the high cost of building chip factories, and there will need to be standards of interconnecting chiplets to allow ease of integration of diverse components.

Maxim Two: End-to-end hardware/software co-design is essential. This is a given for HPC, and chiplet interconnect standards will help here. But we would counter that the hyperscalers and cloud builders limit the diversity of their server designs to drive up volumes. So just like AI learned to run on HPC iron back in the late 2000s, HPC will have to learn to run on AI iron of the 2020s. And that AI iron will be located on the clouds.

Maxim Three: Prototyping at scale is required to test new ideas. We are not as optimistic as Dongarra, Reed, and Gannon that HPC-specific systems will be created – much less prototyped at scale – unless one of the clouds corners the market on specific HPC applications. Hyperscalers bend their software to fit cheaper iron, and they only create unique iron with homegrown compute engines when they feel they have no choice. They will adopt mainstream HPC/AI technologies every time, and HPC researchers are going to have to make do. In fact, that will be largely what the HPC jobs of the future will be: Making legacy codes run on new clouds.

Maxim Four: The space of leading edge HPC applications is far broader now than in the past. And, as they point out, it is broader because of the injection of AI software and sometimes hardware technologies.

Maxim Five. Cloud economics have changed the supply chain ecosystem.Agreed, wholeheartedly, and this changes everything, even if cloud capacity costs 5X to 10X as much as running it on premises, the cloud builders have so much capacity that every national and academic lab could be pulling in the same direction as they modernize codes for cloud infrastructure – and where it is sitting doesn’t matter. What matters is changing from CapEx to OpEx.

Maxim Six: The societal implications of technical issues really matter. This has always been a hard sell to the public, even if scientists get it, and the politicians of all the districts where supercomputing labs exist certainly don’t want HPC centers to be Borged into the clouds. But, they will get to brag about clouds and foundries, so they will adapt.

“Investing in the future is never easy, but it is critical if we are to continue to develop and deploy new generations of high-performance computing systems, ones that leverage economic shifts, commercial practice, and emerging technologies. Let us be clear. The price of innovation keeps rising, the talent is following the money, and many of the traditional players – companies and countries – are struggling to keep up.”

Welcome to the New HPC.

Author’s Note: We read a certain amount of technical papers here at The Next Platform, and one of the games we like to play when we come across an interesting paper is to guess what it will conclude before we even read it.

This is an old – and perhaps bad – habit learned from a physics professor many decades ago, where he admonished us to figure out the nature of the problem and estimate an answer, in ours heads and out loud before the class, before we actually wrote down the first line to solve the problem. This was a form of error detection and correction, which is why we were taught to do this. And it kept you on your toes, too, because the class was at 8 am and you didn’t know you were going to have to solve a problem until the professor threw a piece of chalk to you. (Not at you, but to you.)

So when we came across the paper outlined above, we immediately went into speculative execution mode and this popped out:

“Just like we can’t really have a publicly funded mail service that works right or a publicly funded space program that works right, in the long run we will not be able to justify the cost and hassle of bespoke HPC systems. The hyperscalers and cloud builders can now support HPC simulation and modeling and have the tools, thanks to the metaverse, to not only calculate a digital twin of the physical world – and alternate universes with different laws of physics if we want to go down those myriad roads – but to allow us to immerse ourselves in it to explore it. In short, HPC centers are going to be priced out of their own market, and that is because of the fundamental economics of the contrast between hyperscaler and HPC center. The HPC centers of the world drive the highest performance possible for specific applications at the highest practical budget, whereas the hyperscalers always drive performance and thermals for a wider set of applications at the lowest cost possible. The good news is that in the future HPC sector, scientists will be focusing on driving collections of algorithms and libraries, not on trying to architect iron and fund it.”

We were pretty close.

Article link: https://www.nextplatform.com/2022/03/09/will-hpc-be-eaten-by-hyperscalers-and-clouds/

March 7, 2022 | Podcast

By Michael Chui and Mark Collins

McKinsey research shows that adoption of IoT technologies has increased exponentially the past five years—but successful implementation still eludes some. Here’s how to get it right.

DOWNLOADS

Open interactive popup

 Article (9 pages)

In this episode of The McKinsey Podcast, McKinsey partners Michael Chui and Mark Collins share their thoughts with Roberta Fusaro on the findings of McKinsey’s latest Internet of Things report, including how to successfully integrate IoT, the situations in which the most value is being created, and what companies continue to get wrong.

After, it’s expected a piece of space debris hit the moon on March 4, 2022. Hear about the implications of all the other pieces of space junk in orbit from McKinsey associate partner Chris Daehnick and podcast managing producer Laurel Moglen. The following transcript has been edited for clarity.

The McKinsey Podcast is cohosted by Roberta Fusaro and Lucia Rahilly.

Podcast link: https://f.bktrksfn.com/users/proj/84c9fcbe-9b03-11ec-b58b-0e001522e58d/src/.bt_download/mp-iot-comes-of-age.mp3?t=1646319998617

Defining the Internet of Things

Roberta Fusaro: How do you define the Internet of Things?

Michael Chui: The Internet of Things, or IoT, is when you embed digital technologies into the physical world. For example, we’re seeing digital technologies embedded in cars and in buildings. You connect those physical objects through digital network connections back to computers, and that simply is it. That’s the Internet of Things.

Roberta Fusaro: Mark, compared with McKinsey’s previous research on the technology, what were some of the most surprising findings from the new IoT research? What were the areas where you found great uptake or where the use cases were more prevalent than in others?

Mark Collins: Looking at the settings or physical locations where IoT is deployed, of 99 individual cases, we found five represented 52 percent of the value in 2020. So a really big concentration in terms of where value is created.

The second thing that I found surprising is the massive growth of the connected home. Rewind the clock back five years ago, and the average American house had one connected device in it. We fast forward five years, and homes have over five connected devices on average.

This shift has been born in part out of real innovation in technology with smart speakers, as well as us being caught in our homes for the last two years because of COVID-19. We’re investing in the area around us, both to improve and make our lives easier.

Roberta Fusaro: You talked about how five areas accounted for more than half of the value that’s being generated. What are the other four areas where you’re seeing value created?

Mark Collins: Consumer applications is one of the fastest-growing areas, but it’s not the largest as we think about it overall. And so when we look at the largest overall, what stood out to us were use cases related to human health in hospital, acute-care, and residential-care settings.

Also, we saw growth in operations and optimizations. So, how can we really drive greater efficiency, greater efficacy? And that was across the settings of factories, cities, and work sites. We also saw a real excitement around human productivity in the retail setting to really enhance what the experience can be for shoppers while also enabling companies to optimize both their revenue growth and their cost price.

Michael Chui: One of the remarkable things we’ve seen is that companies are deriving value from using these technologies. Whether it’s in the factory, in healthcare, or in the automotive industry, we’re seeing more and more cases where real value is growing and being created.

Getting the integration of IoT right

Roberta Fusaro: Are there examples of companies that are truly getting the integration of IoT right?

Michael Chui: The World Economic Forum has identified a set of factories around the world that they describe as lighthouses. They are lighthouses in the sense that they are truly being forward-thinking in terms of the application of IoT within their factories.

For instance, they’ve deployed condition-based or predictive maintenance: rather than waiting for a tool in a factory to go down and bring down an entire assembly line, they’re continuously monitoring the performance of that tool so as to avoid unplanned downtime.

So that lowers cost in terms of the maintenance itself, but more importantly, you don’t lose the output of that entire line, which can be millions of dollars per day. And this is true in the chemicals industry as well.

Roberta Fusaro: I’m curious about one aspect of the consumer applications: It feels to me like one of the larger impediments to greater adoption is this privacy issue. How did that factor into the results of the research? And how can companies help resolve that tension?

Michael Chui: Privacy is absolutely a factor as we think about consumer preferences. And it’s one which has increasingly become top of mind as we’ve seen very public incidents over the last few years. Some companies make their value proposition based on privacy as they go forward. But what we also see is a tension for users because they want the convenience that many of these IoT devices can bring. They’re seeking to balance these trade-offs between privacy, ease of use, reliability, ease of installation, et cetera.

Some companies make their value proposition based on privacy as they go forward. But what we also see is a tension for users because they want the convenience that many of these IoT devices can bring.

Michael Chui 

The impact of IoT on cities

Roberta Fusaro: What impact have you seen IoT have on cities?

Michael Chui: Cities are near and dear to my heart as a former municipal CIO [chief information officer]. One of the challenges that we’ve seen in a number of large cities around the world is the amount of traffic congestion in the center of cities.

A number of different cities have applied congestion pricing. They are tracking when vehicles are in the center of the city and charging for the times when congestion is highest. That doesn’t necessarily make the driver happy, but we have seen material changes in traffic patterns within those cities that have invested in congestion pricing. You can think about a city being like a dynamic, living organism, and IoT can help it adjust.

Mark Collins: Taking the example of the living organism, we’re seeing a real trend toward environmental, social, and governance [ESG] and sustainability right now. As someone who lived through the days of orange skies in San Francisco as a result of the fires a few years ago, I think we’re seeing real focus now on things like air quality monitoring and water quality monitoring.

We’re seeing cities intervene by deploying sensors to detect these things. We’re also seeing democratization of that with private individuals paying for sensors that tell them the levels of air pollution in their region. These sensors allow governments to think about their response to pollution. And that can feed into decisions, such as what factories are going to be opened, where they’re going to be opened, and what their hours are.

What companies get wrong about IoT

Roberta Fusaro: So those are areas that show high promise and high activity. What are companies still getting wrong about IoT?

Mark Collins: I think one of the big findings when we looked back, relative to the research of five years ago, was that now largely we can say the technology is actually good enough. We’ve had huge maturation in things like network connectivity, battery power, computer advanced analytics, et cetera. What we saw happen all too often was IoT being treated as a technology project, often run by the CIO or by a small business unit or factory plant all by themselves.

And so the technology has changed, but the actual way of work has not. When we look at some of the lighthouse factories that Michael referenced earlier from the World Economic Forum, we see that they treat the integration of IoT as a holistic operating model transformation.

When they look at how systems and processes are going to change on the factory floor, for example, they think about how they may need to motivate individuals working within that system differently. And then to support that, they think about what are the KPIs and reporting that you need to be looking at on a forward basis. And we find when you bring these operating-model factors together with some of the fantastic technology that you have today, you really can produce some pretty magical results.

Michael Chui: As a former CIO, I feel the technology leadership is still important, though. We just need to make sure we have business leadership, too.

Roberta Fusaro: That’s a good point, Michael. How should technology and business leadership be working differently to enable IoT initiatives?

Michael Chui: This is an old story. In any business application of technology, you need business leaders to partner closely with the technology leaders. To ensure smooth integration of IoT—because the technology has advanced a lot, you really need that coleadership.

At the end of the day, you need the business leader also to be able to say what’s being targeted, for example, “We’re going to target unplanned downtime. We’re going to target inventory management cost. We’re going to target our employees’ safety.” Whatever it is. That’s the business result you’re going for. Hopefully, the technology people are learning about that at the same time that the business people are learning about technology.

Mark Collins: To build off that, one of the themes that we heard in our client service is that the integration of IoT is often easier in greenfield settings. It’s easy to build in the technology and the business icons from the start, or if you’re a new IoT company being set up from scratch. Where we see this being a challenge is when you’re trying to integrate it into legacy or brand field environments.

And that’s not just the case of where you have a factory that’s 50 years old that suddenly needs to be connected to the internet for the first time, but it’s also in terms of companies that have traditionally sold unconnected products. How do they now move to a world which is much more software-driven, where they want to sell connected products going forward? In these situations, the connection between business leaders and technology leaders can have stunning results.

The role of talent in the adoption of IoT

Roberta Fusaro: What role does talent play in the way that IoT is being adopted? Or is it holding the technology back?

Mark Collins: We see talent playing an absolutely critical role. And it’s not just in terms of core academic disciplines, where there’s a huge need for talent such as data engineers, data scientists, computer scientists, et cetera, who underpin all of the operations of analytics and IoT.

We also see it in terms of ways of working. We see companies doing really well when they’re taking a design thinking methodology and working backward from their customers’ needs all the way through to how they deliver it.

As we thought about the implications for governments or regulators, one of the key reflections that we had is how do governments and regulators think about turbocharging the talent that is needed to unlock this potential going forward. And that’s going to require a whole raft of interventions all the way from primary and secondary and tertiary education through to thinking about skill development.

Michael Chui: Folks who know how to implement IoT and capture value from it in a business are in high demand. It is one of the bases of competition. And because IoT is not exclusive to the technology industry, you see automotive companies vying for the same talent as the tech industry.

Avoid a fragmented approach to IoT

Roberta Fusaro: What’s a typical example of some things that companies get wrong when they try to use IoT or implement IoT into their corporate strategies?

Mark Collins: What we sometimes see with large multinational companies that have global footprints is that there isn’t a clear owner of IoT within the organization. And that leads to fragmented and decentralized decision making when it comes to IoT.

I remember an example: I was speaking with a colleague about a company that had multiple factories across the globe. And almost every factory had a bespoke application, a bespoke vendor for providing one single discrete use case.

Each of them worked well in terms of their individual silos, but when it came to looking across the company as a whole, it was next to impossible to get an aggregate view across the entirety of the company. It meant as you thought about scaling those solutions, you were structurally limited and almost had to go back to the start and reengineer.

I see a real theme around who owns the IoT agenda, particularly from multinational companies, and how being thoughtful about the short term and the long term, at a global and a local level, will allow you to capture value.

We’ve seen lots of examples where people buy a new piece of technology and it’s used for the first week and then sits idle. And it’s through uniting the business side and the technology side and changing the day-to-day ways of working that you get to real change for companies.

The classic example that Michael and I often talk about are the repairers, who, until recently, were the heroes of the hour when they fixed the repair. In the future, the hero of the hour will be the person who makes sure the repair is never needed in the first place. And so, you need to think totally differently about the KPIs, the incentives, and the performance management of people on a very practical level.

Michael Chui: Another thing that companies get wrong is they don’t ensure that the machines they buy are connected to each other. A lot of companies that sell connected equipment to factories say that they’ll do predictive maintenance, but unless all of the machines talk to each other, you’re often going to underoptimize the performance of the whole factory.

When we did the analysis, well over 50 percent of the value that IoT can unlock requires interoperability. Unless the factory manager or the procurement manager specifies that connectivity and interoperability occurs, you’ll have IoT devices that don’t talk to each other.

Business ecosystems are critical

Roberta Fusaro: What role do business ecosystems play in the changes you’ve seen? Is there more collaboration? Are these ecosystems bigger or better?

Mark Collins: I think ecosystems are absolutely critical as we think about the landscape going forward. And to give a very tangible example of this: One company I work with wants to deploy sensors within their production environment, and they want to make sure that those sensors are secure. Making sure those sensors are secure requires having security designed in from the start. How is the network on which those chipsets communicate information secured? In the servers where that data is stored, how do we ensure that they are secure as well? And so, no single vendor can secure an entire IoT value chain. Rather, we need people who work together to integrate almost each layer of the stack to bring this together.

We have seen the emergence of platforms that are at scale that everyone can integrate with. We have not seen that emerge in IoT as of yet. And the emergence of that through an ecosystem play or through some other play is an unlock that we would be excited about.

Applying IoT to supply chain and public-health issues

Roberta Fusaro: If we do this research again in another two to five years, what are some trends that you could imagine developing?

Michael Chui: We need our factories to be better performing. Look at all the supply chain issues that we’ve had. It has been, in some cases, a setting that ended up being slower growing than we thought back in 2015. At the same time, it actually is the largest potential source of value.

I’m not saying IoT can solve all of the problems, but if you have better visibility in your supply chain, if you have the ability to ramp up and down in volumes in your manufacturing, we can have a much more resilient and productive economy.

Hopefully, we will be able to manage the next pandemic, which I hope is a long way away, by better understanding how public health is doing and how we are all individually doing. Hopefully, our homes will become more energy efficient.

Mark Collins: We wrote this report in the middle of a pandemic. In many cases, the world is different now than when we started writing this report 18 months ago.

One CEO referred to there being a decade of progress in digital transformation in under ten months. And so, I think about how many of my clients are now achieving things at a speed that they would never have thought possible in equivalent time frames before. I also see the ambition levels increasing as they think about what they want to do, how they want to link the physical and digital worlds together and make concerted investments in things like digital twins and other technologies that not only would enable them to be better prepared for the future but also enable them to capture value and serve their customers better.

It’s time to go all in

Roberta Fusaro: What is one key takeaway you would offer business leaders to accelerate their adoption of IoT?

Michael Chui: I’d say, bring all of the innovation that you have in digital to the physical world using IoT. It turns out that to transform your business, you actually have to do a lot of things. It doesn’t come down to one thing. That’s what we’ve discovered. And so you really have to bring the whole playbook if you’re actually going to transform using IoT.

Mark Collins: For me, it would be about thinking about how to start to sell and deliver outcomes versus technology.

Roberta Fusaro: In the research, you say, “Don’t dip your toe in the water.” What does that look like if you’re an executive and you’re maybe a little bit hesitant?

Mark Collins: Doing more things together means that you force change. And so, in the research that we’ve done every year, we’ve seen that those companies that deploy more use cases together in parallel consistently capture more value per individual use case. And that’s because you force the rethink around your operating model, processes, incentives, and reporting. And it really serves as an unlock for the company.

Companies that deploy more use cases together in parallel consistently capture more value per individual use case. That’s because you force the rethink around your operating model, processes, incentives, and reporting. And it really serves as an unlock for the company.

Mark Collins 

Roberta Fusaro: What does it look like to deploy multiple use cases?

Mark Collins: Multiple use cases may be occurring, but they may be occurring from different perspectives on different systems in different areas. And that’s why I think it’s so important to think about who is the IoT champion within your company. Who is the person that’s going to take on this mantle and lead forward? Because just by the act of appointing someone as the lead, you automatically enable greater coordination and greater visibility, which, as we’ve seen in our research, gives you a multiplier in terms of the outcomes you get.

IoT and the metaverse

Roberta Fusaro: What role could IoT play in fostering the metaverse or challenging the metaverse?

Michael Chui: First, I want to recognize that there are a number of different opinions on what the metaverse is. So it’s hard to come up with a definitive answer that matches everyone’s definition. We tend to exclude user interface devices as part of the IoT, but nevertheless, those things are, from a very practical standpoint, metaverse related.

Mark Collins: Think about how you can create almost near-perfect replicas of things like telecom networks or electricity networks or factory floors, where you can trial and test and get real-time feedback.

Sensors and IoT devices within these environments will provide the information to enable those digital twins to run in real time and give you the ability to think about how you can optimize. And these deliver benefits not just in terms of cost opportunity savings optimization but also in terms of situations such as telecom networks in the face of mass weather events when cell towers are falling over.

Michael Chui: If you have a digital twin of a factory and you can go into the factory and simulate what the operators might be able to do, you can start to train and you can start to optimize all those sorts of things.

What IoT can do for construction and healthcare

Roberta Fusaro: Before we sign off, is there anything that you wanted to touch on that we’ve missed?

Michael Chui: One of the other settings that I’m excited about in which these technologies could be deployed is worksites. Productivity in construction has actually declined slightly over several years.

We badly need to do things such as building more housing. The hope is that IoT and other practices can improve the productivity of things like construction. That would be incredibly beneficial, not only to our economy but also for people.

Mark Collins: Michael, with you taking the efficiency angle, let me take the efficacy angle for a second. We spoke earlier about the impact of COVID-19 on the deployment of IoT. One area that has foundationally changed forever is the provision of healthcare.

The pandemic has reset how we interact with our healthcare providers. We’re now in a world where the default is, “I’ll engage with my primary care over unified communications (UC) or over my phone through videoconferencing. No longer am I going into a clinic or waiting room.”

If you think about what IoT is enabling off the back of that, it’s the ability to do diagnostic tests that were previously only possible in acute-care settings. Now, suddenly, I can do these with a wearable on my wrist and be done in 30 seconds. If I think about the potential for that not just to improve wellness but also for patients with acute and chronic diseases, it can make a real difference in terms of both quality of life and also detecting potential disease or deterioration earlier—helping to prolong life as well as expanding its quality.

Segment Two: Look out for space junk

Laurel Moglen: At the time of this recording, a piece of space debris is expected to hit Earth’s moon—if it hasn’t already. That piece is not alone. Chris Daehnick, a McKinsey associate partner in the Aerospace & Defense Practice, says many thousands more are in orbit.

Chris Daehnick: The US Space Force tracks about 27,000 pieces of debris.

Laurel Moglen: That’s 27,000 pieces of debris that are traceable. Chris says those pieces are—

Chris Daehnick: Roughly the size of a softball.

Laurel Moglen: What about the number of pieces that are not traceable?

Chris Daehnick: Several hundred thousand pieces, or at least a large multiple of the 27,000, are untraceable.

Laurel Moglen: What exactly are those thousands of pieces of junk?

Chris Daehnick: Space junk starts with pieces of rockets or old satellites that have outlived their usefulness. Everything from things that have fallen off the International Space Station, or the Space Shuttle in the past, or other spacecraft. In a few cases where someone has intentionally destroyed a satellite with an antisatellite weapon, that creates a huge amount of additional junk. You have things like paint flecks. There’s even an astronaut’s glove floating around out there.

Laurel Moglen: A paint fleck here on Earth is pretty innocent, but in space, it’s a projectile that packs a punch.

Chris Daehnick: Somewhat notoriously, one of the space shuttles got a chip in one of its windows. It was a noticeable defect in the window when it came back to Earth. But didn’t cause any greater damage.

Laurel Moglen: But greater damage is a possibility if space pollution increases?

Chris Daehnick: There is the potential over the long run that if you have enough pieces of junk in orbit and they begin to collide with each other, you could have almost a chain reaction. This was first theorized by a NASA scientist. It was called the Kessler Syndrome. We haven’t quite reached that critical level yet.

Laurel Moglen: To avoid getting to that critical level, Chris says there are a few things we can do.

Chris Daehnick: Don’t create debris intentionally. Improve the mechanisms for removing satellites once they’re no longer active and have requirements that enhance the ability to get things out of orbit when they’re a problem—when they’re dead, literally.

Laurel Moglen: A couple of entities are taking an interest in the issue.

Chris Daehnick: The United Nations has taken this on. NASA has proposed some standards. I think it’s safe to say there’s interest from any space-faring nation. This is a common problem. The question, perhaps, is more about who is willing to take any sort of action.

Laurel Moglen: For now, that action depends mostly on the willingness of companies and individual nations.

Chris Daehnick: About all I can say is that we still don’t have any agreement on that because now you’re getting into sovereign rights and what a country is willing to limit for itself.

Laurel Moglen: Looking forward, it’s expected there will be increased activity in space—from launching new communication constellations, greater human exploration, and space tourism. This heightens the chances of collisions.

Chris Daehnick: It’s not going to be enough in the future to just hope that nothing bad happens. We are going to have to take a more active role in limiting debris.

Laurel Moglen: And, what about that piece of debris hitting Earth’s moon? Chris says the moon will be okay. But it will spread a bunch of space debris around the surface and create a small impact crater.

Article link: https://www.mckinsey.com/business-functions/mckinsey-analytics/our-insights/iot-comes-of-age?

ABOUT THE AUTHOR(S)

Michael Chui and Mark Collins are partners in McKinsey’s Bay Area office. Chris Daehnick is an associate partner in the Denver office. Roberta Fusaro is an executive editor in the Waltham, Massachusetts, office. Laurel Moglen is a managing producer/editor in the Southern California office. Lucia Rahilly is the global editorial director based in New York City