healthcarereimagined

March 23, 2022

Acquisition, Army ALT Magazine

STAND-IN: In January 2020, the U.S. Army tested Advanced Running Gear on existing Bradley vehicles for potential use on the future Optionally Manned Fighting Vehicle at Yuma Proving Ground, Arizona. (Photo by Mark Schauer, Yuma Proving Ground)

Behavioral biases have played a significant role in acquisition program decision-making, specifically hampering the Army’s efforts to modernize and upgrade infantry combat vehicles.

by Robert F. Mortlock, Ph.D., Col., USA (Ret.)

This is the second in a series of articles focused on behavioral acquisition—a topic first introduced in the Fall 2021 Army AL&T magazine.

Behavioral acquisition explores defense acquisition from a behavioral standpoint, including the impact of psychology, organizational behavior and organizational politics on decision-making in acquisition programs that ultimately affect the delivery of capability to the warfighter. Behavioral acquisition studies how acquisition professionals think, manage and lead acquisition programs—and addresses organizations, hierarchies and the intersection of individual behavior, leadership, culture and decision-making.

One aspect in particular, behavioral biases, is the focus of this article. These biases have a common root in people’s limited ability to process large amounts of information, resulting in poor decision-making. That, in turn, contributes to acquisition program failures. A case study is the Army’s efforts to modernize its infantry combat fighting vehicles. The decadeslong effort has shown evidence of multiple decision-making biases: planning fallacy bias, overoptimism bias, recency bias and trade-off bias.

A HISTORY OF DECISIONS

The Bradley Fighting Vehicle remains the backbone of Army mechanized infantry warfighter formations. Developed in the 1960s, the Bradley (see Figure 1) was initially fielded in the early 1970s and has been upgraded several times to offer Soldiers enhanced capabilities. Since the early 2000s, the Army has been trying to replace the Bradley because size, weight and power constraints severely restrict potential upgrade options. After an 11-year development effort, the Bradley has been in production for 50 years.

EVOLUTION OF THE BRADLEY: After an 11-year development effort, the Bradley Fighting Vehicle has been in production for 50 years. (Graphic by USAASC adapted from “Then and now: Next generation on track,” Army AL&T magazine, Spring 2019.)

One attempt at a Bradley replacement was the Infantry Carrier Vehicle (ICV), part of a family of manned ground vehicles within the planned Future Combat Systems program. (See Figure 2) Future Combat Systems entered the acquisition framework as an official program of record at milestone B to begin engineering and manufacturing development (EMD) efforts in 2003 with a planned milestone C (low-rate initial production) in 2009, later shifted to 2013. The 10-year time frame for technology development, design, prototyping and engineering and manufacturing development was similar to the Bradley program and other efforts of similar complexity and risk. However, the Infantry Carrier Vehicle effort (along with the entire Future Combat Systems program) was canceled in 2009.

Defense acquisition experts have referenced Future Combat Systems as an example of everything wrong with defense acquisition—a canceled program that wasted billions of dollars and delivered no capability to warfighters. A 374-page 2012 RAND Corp. report, “Lessons From the Army’s Future Combat Systems Program,” highlighted hundreds of lessons from different aspects of the program, including requirements management, program management, contracting and technology management.

INFANTRY CARRIER VEHICLE: One attempt at a Bradley replacement was the Infantry Carrier Vehicle (ICV). It was part of the ill-fated Future Combat Systems program and canceled in 2009. (Graphic by USAASC)

The Future Combat Systems program attempted to integrate critical technologies using a system-of-systems management approach. The program started as a Defense Advanced Research Projects Agency effort contracted through other-transaction authority (OTA) with Boeing and its industry partners. The OTA incentivized Boeing to get the Army to an approved milestone B and establish a baseline for the formal program of record as quickly as possible.

Boeing and the Army achieved a successful milestone B in 2003. The OTA also enabled Boeing to become the lead system integrator for the Future Combat Systems program. Despite warnings from the Government Accountability Office (GAO) in a 2004 report titled “Defense Acquisitions: The Army’s Future Combat Systems’ Features, Risks, and Alternatives,” which warned of immature technologies and lack of adequate funding, the Army marched forward. The Future Combat Systems program was canceled in 2009 primarily for being unaffordable, overly ambitious from a technology maturity standpoint (integration of too many critical technologies with low maturity), overly complex from a program management standpoint (the system-of-systems approach), and for failing to reflect current emerging threat requirements from conflicts in Iraq and Afghanistan.

Future Combat Systems can be studied with a behavioral acquisition lens. The Army did not appreciate the effects of the planning fallacy bias, and the result was a gap between plans and outcomes. The Army built an unrealistic “insider view” of a program, with detailed plans for implementation, to gain program-of-record approval. These detailed plans enhanced the Army’s perception of control over the program and confidence in its success that were unwarranted when the full context of the program was considered.

The effects of the planning fallacy are not unique to the Infantry Carrier Vehicle effort within Future Combat Systems or to Army acquisition programs in general. A 2015 GAO report titled “Defense Acquisitions: Joint Action Needed by DOD and Congress to Improve Outcomes,” highlighted that program managers (PMs) are incentivized to develop acquisition strategies focused on program approval at the milestone review but not acquisition strategies that could later be executed and deliver capabilities.

MOVING OUT: Idaho Army National Guard Staff Sgt. Daniel Bistriceanu checks his communications equipment before moving out to fuel up a Bradley Fighting Vehicle. The Army has been trying to replace the Bradley since the early 2000s because of its size, weight and power constraints. (Photo by Thomas Alvarez, Idaho Army National Guard)

It is ironic that the planning fallacy has roots in what are perceived to be good management practices. Program planning efforts tend to reinforce idealized perceptions of control, resulting in PMs typically thinking they have more control over outcomes than they have in reality. The planning fallacy creates biased expectations that will impact the cost, schedule and performance baseline over the course of most programs.

Future Combat Systems was also hampered by overoptimism bias—the tendency to see the world through “rose-colored glasses” or expect positive outcomes even when not justified. The Army’s “can do” mentality, combined with the general observation that the program management field generally rewards optimistic individuals, led to a Future Combat Systems Infantry Carrier Vehicle program plan that was overly optimistic. In this case, the Army underestimated the technical maturity level of the critical technologies, the complexity of the development effort and the difficulty in transforming the way the mechanized infantry fights (concept of operations as well as tactics, techniques and procedures).

Recency bias is the widely recognized bias wherein recent data are given disproportionate emphasis in making judgments. Recency bias occurs when individuals process large amounts of information and rely on intuition. This helps them sort through the information but also introduces biases and leads to suboptimal decisions.

Future Combat Systems was plagued with recency bias from its inception—specifically from the tendency to incorporate as many of the latest acquisition reform initiatives as possible.

The program was initiated by leveraging a Defense Advanced Projects Research Agency effort. Future Combat Systems chose the innovative, non-Federal Acquisition Regulation (FAR)-based contracting approach with the use of an OTA. Finally, the program incorporated the use of a contractor to act as the lead system integrator as well as a system-of-systems approach (rather than separate programs).

The use of any one of these recent acquisition reform initiatives would have been a significant shift in acquisition management, but the Army felt obligated to incorporate multiple initiatives, despite the availability of more appropriate, less risky acquisition management approaches like a longer incremental development.

Finally, Future Combat Systems was saddled with a difficulty in making trade-offs. The trade-off bias is central to program management, particularly trade-offs among program cost, schedule and performance that form the acquisition program baseline.

Decision theory has proposed rational methodologies for making trade-offs by confronting them systematically, typically through some version of cost-benefit analysis. But the models based on rationality bump up against the realities of the complex defense acquisition environment.

Typically, rational, reason-based models make conflicting choices easier to evaluate. By constructing reasons, individuals turn difficult-to-reconcile characteristics of options into a problem that is more comprehensible.

ROLLING ALONG: A U.S. Army Stryker infantry carrier vehicle rolls off a C-17 cargo plane in India Feb. 1, 2021. (Photo by Staff Sgt. Joseph Tolliver, 1-2 Stryker Brigade Combat Team)

Furthermore, it is likely that reason-based choice may be even more difficult when groups are making decisions, reflecting the fact that programs involve numerous stakeholders and significant resources, and that decisions have to be justified and approved by oversight groups.

Therefore, while individuals typically choose using rational models, groups may prefer reasons based on social, organizational or political dynamics.

The Future Combat Systems operational requirements document approved by the Army Requirements Oversight Council and the Joint Requirements Oversight Council was 475 pages long and contained hundreds of key performance parameters, key system attributes, and additional performance attributes, leading to thousands of design specifications for the Infantry Carrier Vehicle. The vehicle simply had too many requirements placed on it, making the trade-offs of performance, cost and schedule beyond the cognitive capability of individual PMs and Army leaders and too difficult for the Army from an organizational perspective. Basically, all the requirements were treated as important—too difficult to trade off.

After cancellation of Future Combat Systems in 2009, the Army embarked on the Ground Combat Vehicle (GCV) program (see Figure 3) to replace the Bradley. All resources that had been supporting the oversight and management of the development of a family of FCS-manned ground vehicles (including the Infantry Carrier Vehicle) were now applied to the development of the Ground Combat Vehicle. This program achieved a materiel-development decision in 2010 and milestone A in 2011 to award technical maturation and risk reduction contracts to industry.

GROUND COMBAT VEHICLE: Ground Combat Vehicle (GCV) also attempted to replace the Bradley. In 2014, the Army canceled the program because the vehicle was going to be too big and heavy and had too many requirements. (Graphic by USAASC)

The same two industry partners that were teamed together in the Future Combat Systems Infantry Carrier Vehicle program now competed against each other in a technical maturation and risk reduction phase for the Ground Combat Vehicle. The program had an aggressive schedule to get to milestone C within six years of milestone A—influenced by planning fallacy and overoptimism bias like the Infantry Carrier Vehicle program. The Army began the Ground Combat Vehicle program and awarded firm fixed price-type research and development contracts to BAE Systems and General Dynamics for designs and prototypes. The new vehicle’s requirements called for a heavy reliance on mature commercial technologies. In an example of recency bias, Better Buying Powerinitiatives strongly encouraged the use of firm fixed-price research and development contracts despite the lack of appropriateness based on the level of system integration complexity and risk.

The Ground Combat Vehicle requirements included a mixture from the Bradley, the Future Combat Systems Infantry Carrier Vehicle, the recently fielded Mine Resistant Ambush Protected vehicles, and the M1A2 Abrams tank. Based on the GCV requirements, the program office, industry competitors and the research, development and engineering center at the U.S. Army Tank-automotive and Armaments Command (TACOM) determined that the GCV would weigh between 50 and 70 tons—nearing the weight of the 72-ton M1A2 Abrams tank and almost twice as heavy as the Bradley or the planned 30-ton Infantry Carrier Vehicle. The GCV had force protection, survivability and lethality requirements for a mechanized infantry vehicle that more resembled an armored tank.

In subsequent reviews with Army senior leaders, the potential weight of the Ground Combat Vehicle and excessive requirements were highlighted. However, the Army pushed ahead and approved the requirements—heavily affected by a difficulty in making trade-offs. The technical maturation and risk reduction contracts seemed to be based primarily on a need to protect the planned and programmed resources from the old Future Combat Systems Manned Ground Vehicles program (schedule-driven). In 2014, three years into the development effort, the Army canceled the Ground Combat Vehicle program because the vehicle was going to be too big and heavy and had an excessive number of requirements.

In recent years, after several failed attempts of initiating the Next Generation Combat Vehicle because of aggressive requirements and a lack of interest by industry, the Army is trying again—this time calling the Bradley replacement the Optionally Manned Fighting Vehicle.

The Optionally Manned Fighting Vehicle program plan is presented in Figure 4. The program is leveraging the newly established middle tier of acquisition pathway and begins not with a milestone A or B, but with an acquisition decision memorandum from the milestone decision authority. After the prototyping phase, a materiel-development decision will continue the design effort and start build and integration efforts. The program plan specifically avoids using the technical maturation and risk reduction and engineering and manufacturing development phases of a major-capability acquisition. Again, as with the Ground Combat Vehicle program schedule, the Army plans to achieve the milestone C within seven years of program initiation. Interestingly, the program uses the terms “characteristics of need” to describe the requirements to competing contractors rather than more traditional terms like key performance parameters.

OPTIONALLY MANNED FIGHTING VEHICLE: The Optionally Manned Fighting Vehicle (OMFV) program leverages the newly established middle tier of acquisition but is susceptible to the same behavior acquisition biases that contributed to the failures of the predecessor Bradley replacement vehicles. (Graphic by USAASC)

The Optionally Manned Fighting Vehicle program is susceptible to the same behavior acquisition biases (planning fallacy, overoptimism bias, recency bias, and difficulty in making trade-offs) as contributed to the failures of the predecessor Bradley-replacement acquisition efforts. How can the design and development of a mechanized infantry vehicle be optimized for troop transport and protection, lethality and remote autonomous operations simultaneously? Unfortunately, the answer is that it can’t—this will require difficult requirement trade-offs to avoid the planning fallacy and overoptimism bias. A vehicle that is optimized to protect the crew and dismounted troops being transported would be an inefficient combat vehicle for lethal autonomous operations (too big and heavy).

It appears that recency bias has also played a significant role in the Optionally Manned Fighting Vehicle program planning. Is the Army more interested in riding the autonomous vehicle hype wave? Or does the Army have other priorities like proving that major-capability acquisition can be done differently or innovatively in the newly established Army Futures Command?

The Optionally Manned Fighting Vehicle acquisition strategy leverages the middle-tier of acquisition pathway to avoid forming a program of record to enter the engineering and manufacturing development phase after a successful milestone B. The Optionally Manned Fighting Vehicle program will use middle-tier authorities to rapidly prototype vehicles for experimentation and demonstration and then establish a formal acquisition program of record at milestone C to enter low-rate initial production. For requirements, the Army initiated the Optionally Manned Fighting Vehicle program with a general characteristics of need document to avoid the approval of an initial capability document.

The exact opposite strategy has been recommended by the GAO for more than three decades for major defense acquisition programs—knowledge-based acquisition strategies with incremental development. Defense acquisition programs have routinely rushed to production decisions without well-defined requirements, complete detailed design drawings, fully mature technologies and mature manufacturing processes, and without demonstrating production-representative systems in an operationally relevant environment. The Optionally Manned Fighting Vehicle program is attempting to do in a middle tier of acquisition rapid prototyping effort what a major defense acquisition program achieves in a formal engineering and manufacturing development effort—a classic “schedule-driven” rush to failure with suboptimal decision-making that appears to be dominated by biases similar to those biases that plagued previous attempts to replace and modernize the infantry combat vehicles.

CONCLUSION

The behavioral biases of planning fallacy, overoptimism, recency and trade-offs difficulty have contributed to repeated failures in the Army infantry combat vehicle acquisition programs. Figure 5 summarizes the behavioral biases observed in the Future Combat Systems Infantry Carrying Vehicle, the Ground Combat Vehicle and the Optionally Manned Fighting Vehicle programs. Acquisition management has been highlighted on the GAO’s high-risk list for excessive waste and mismanagement for the past three decades. Notable programs have failed to deliver capability and have failed to meet performance, cost and schedule management targets. The reasons for program failure vary from ill-defined requirements, immature technologies, integration challenges, poor cost and schedule estimating, and the acceptance of too much development risk.

But the effect that the behavioral biases have in poor decision-making may be an even bigger contributor to acquisition program failures—the true root causes. The better acquisition professionals understand the effect of these systemic behavioral biases, the better DOD can mitigate the risks of program failures. The key is a better understanding of the people within big “A” defense acquisition.

ROBERT F. MORTLOCK, Ph.D., Col., USA (Ret.) managed defense systems development and acquisition efforts for the last 15 of his 27 years in the U.S. Army. He is now a professor of the practice and principal investigator of the Acquisition Research Program, teaching defense acquisition sciences and program management at the Naval Postgraduate School. He holds a Ph.D. in chemical engineering from the University of California, Berkeley, an MBA from Webster University, an M.S. in national resource strategy from the Industrial College of the Armed Forces, and a B.S. in chemical engineering from Lehigh University. He holds Level III certifications in program management, test and evaluation, and engineering, as well as the Professional Engineering, Project Management Professional and Program Management Professional credentials. His most recent column for Army AL&T appeared in the Summer 2021 issue.

Read the full article in the Spring 2022 issue of Army AL&T magazine.

Subscribe to Army AL&T – the premier source of Army acquisition news and information.

For question, concerns, or more information, contact us here.

March 21, 2022 | Article

By Anas El Turabi, Anjali Menon, Lucy Pérez, and Gila Tolub

Pharmaceutical and life sciences companies can unlock new opportunities, help underserved patients, and build a cycle of trust.

DOWNLOADS

 Article (8 pages)

Chances are, you’ve been hearing a lot about health equity. In the months and years ahead, you’ll probably hear more: beyond the obvious benefits to patients, health equity is an enormous opportunity for almost every pharmaceutical and life sciences company. Social factors can significantly affect the epidemiology of disease, often in ways that are not readily apparent. Companies can identify these social determinants across different markets, map how they affect different groups, identify which health conditions are undertreated or underfunded, and pinpoint when intervention is most effective.

The findings of a rigorous health equity analysis—the groups that bear a disparate burden, the health conditions treated inadequately, and the oppor­tunities to invest more effectively—will vary from region to region. But the framework for a health equity analysis is the same, and can therefore be repeated across regions. The value proposition from approaching health equity in a robust way is compelling globally, particularly in large, advanced economies.

There is also a values proposition: the benefits to patients and the holistic impact on society. Many studies find that higher levels of trust in doctors and treatments are associated with better health outcomes. Significant research that does not disaggregate outcomes among levels of economic advantage nonetheless supports the assertion that the relationship between trust and health outcomes applies to all groups.¹ Greater trust among disadvantaged communities can therefore be expected to contribute to better health outcomes for their members and to drive, in turn, a virtuous cycle—from higher-quality data to more expansive problem solving to better-targeted approaches, and to greater collaboration throughout the health­care ecosystem (Exhibit 1). A cycle of trust is particularly important to achieve better and more rapid diagnoses, which can be the greatest “unlock” in the epidemiology of care.

In this article, we’ll present a framework for pharma­ceutical and life sciences companies to approach health equity, to recognize its limits, and to sharpen their investment decisions. We’ll also suggest steps a variety of players can take across communities to make the impact even greater.

Definitions and opportunities

The first step is to define key terms and to keep those definitions constant across different markets. As a general principle, disadvantaged groups vary from region to region—for example, Black people in the United States and people of Turkish descent in Germany have health outcomes different from those of each country’s majority.² We should also expect diseases to spread differently in different social contexts; the progression of health conditions can be intricately complex, and health inequities can manifest themselves as limited access, unmet needs, or underserved communities (Exhibit 2). Unclear terms can make precise analysis even harder. Health equity is not the same as health disparity or disease burden, and the differences are not academic.

Keeping terms constant

Although different institutions may define the term in subtly different ways (see sidebar, “Defining health equity”), health equity means, as a foundational matter, that everyone in a given country or region has the opportunity to be as healthy as possible, regardless of social determinants. Health disparities are differences in health outcomes among groups in a given region: for example, there is a disparity in COVID-19 mortality rates—the disease is more likely to be fatal for people older than 70. Health or disease burden is the distribution of a given disease or health condition among different populations within a given area. In the United States, for instance, the disease burden for cystic fibrosis is borne primarily by White people, that for sickle cell disease overwhelmingly by Black people.

Defining health equity

Although the core concepts of health equity are fundamentally similar across different organizations and institutions, exact definitions can differ.

The World Health Organization defines health equity as “the absence of unfair and avoidable or remediable differences in health among population groups defined socially, economically, demographically, or geographically.” The US Centers for Disease Control and Prevention (CDC) says that “Health equity is achieved when every person has the opportunity to ‘attain his or her full health potential’ and no one is ‘disadvantaged from achieving this potential because of social position or other socially determined circumstances.’” And the National Center for Biotechnology Information (NCBI), also located in the United States, calls health equity “the principle underlying a commitment to reduce—and, ultimately, eliminate—disparities in health and in its determinants, including social determinants.”

Each of these definitions prominently includes social disparities. Social differences have evolved over years and often centuries but can change as societies themselves evolve. Thus it is important not only to embed the principle of health equity in organizations and keep it as a guiding star but also to continually correct course. The goal is to ensure that all people, regardless of social determinants, have a fair and abiding opportunity to realize their full health potential.

It is a fact of the human condition that different diseases spread unevenly among many different populations. Not all differences are matters of fairness, at least insofar as the definition of “fair” is reflected in different social outcomes. Breast cancer, for example disproportionally affects people born as biological women, just as hemophilia, a sex-linked recessive disorder, overwhelmingly affects people born as biological men.

Other burdens are unfair and socially determined, but not treatable by therapeutics. The European conquest of lands previously populated solely by Native Americans, for example, has had a continuing effect over time: Native Americans get a poorer education, live in worse housing, and drink dirtier water than other segments of society. Likewise, the island of Hispaniola (Haiti in the west, the Dominican Republic in the east), with its long and often tragic past, is divided by a border as superficial as a pen stroke but also by differences in culture and history that run far deeper. The average life expectancy for people in Haiti is under 66 years; for people in the Dominican Republic, it is more than six-and-a-half years higher. Such different outcomes—which are unfair by any definition—can be improved and, it’s to be hoped, eventually surmounted. But they can’t be solved (at least primarily) by pills, vaccines, or therapies.

Be focused . . . and curious

Because doctors, hospitals, and drugs are so closely related to health outcomes, people tend to overestimate both their authority and their importance. The provision of healthcare services, including doctors and drugs, typically explains only about 20 percent of the health of populations³ as measured by standards such as quality-adjusted life years (QALYs) and disability-adjusted life years (DALYs). Doctors and drugs are typically not the major determinants of health; factors such as clean water, clean air, and good nutrition are far more important in the aggregate. For pharmaceutical and life sciences players seeking to unlock health equity opportunities, one of the most important simplifiers for investing in health equity is therefore to think about burdens amenable to vaccines, therapeutics, or diagnostics, and to ask frankly about your organization’s expertise, the markets it may be missing, and, what the data say.

Data-driven solutions

It’s easy to be data driven—if there are quality data. But often there aren’t. Indeed, too many managers assume that there is some easily obtainable document or database that displays health burdens, in a precise and sortable way, by disease and population group. Yet why should there be? A consistent, comprehensive initiative to track global disease burdens was launched only in 2010. It’s an initiative to celebrate, to be grateful for, and to support. It’s also a work in progress, and not something that would or could come into being immediately and completely. The first step for a CEO or brand president is therefore to be relentlessly curious about data. Ask your teams what your company really has and how well they really know the burdens of a given disease.

The gaps in what we actually know, as compared with what we’ve arrived at through estimates and best guesses, can be profound. The majority of births and deaths in sub-Saharan Africa, for example, are not officially registered.⁴ Even in developed regions, including Western Europe and the United States, some populations can be significantly undercounted. These may be the very people most at risk, even if many of them are insured. Since we lack definitive information about how many patients overall are living with stage IV lung cancer in, for instance, Germany, identifying how many of them are of Turkish descent is even more challenging.

What’s more, the geographical rounding up that goes into measuring, on a consolidated basis, a disease or health condition by country or regional market can obscure the large disparities that may exist among the consolidated regions.⁵ In the United States, focusing on the national average of effective medical interventions for heart valve disease, for example, can frustrate efforts to identify compelling disparities among different regions and different states, counties, and cities—and even different hospitals in the same city. Sometimes, subsets can be on the order of millions of people, an overwhelming majority of whom are already insured and who live in close proximity to doctors or other health providers. Finally, even the way diseases are identified can be a form of guesswork or reflect unconscious or socialized bias. Women, for example, often have heart attack symptoms different from those of men, so women are at higher risk of misdiagnosis.⁶

Mapping the opportunity

Once teams have taken account of gaps in the data—and have invested to fill those gaps or at least to make more informed estimates—they can map opportunities in a revelatory way. This, in fact, is the stuff of “ah-hah moments.” One such moment comes when companies identify areas, in a market they already serve, where people are not receiving an existing therapy or medicine. Another comes from identifying populations with a health need a company could address, if only it knew that a treatment that it has already developed could be expanded to help those populations.

One useful approach is to think about whose problems a company is looking to solve. Protein supplements, for example, are often designed and developed by (and marketed to) men. Yet women, too, need protein and lose significant muscle mass as they age. Artificial hearts are a miracle of modern medicine—but one developed about ten years ago was too big for women. In large part, such problems exist because companies begin their knowledge journey by thinking that they are trying to solve a specific group’s problems. Even if they succeed, they may miss opportunities to help even more people and to tap new markets.

Of course, it’s natural for companies to focus on segments, to drill into subsegments, and to refine treatments to capture subsegments of those subsegments. But it’s also helpful to step back. Take a five-year audit. Whose problems has the company been solving? Who has it been missing? Data and a wider perspective help a company to better identify unmet needs and to compare the populations that have benefited more from its R&D spending and pipeline development with those that have benefited less.

That approach opens up the possibility of discovering significant white spaces. Is there a condition that does not have an effective intervention or has a set of patients who aren’t being included? Is there a condition that is being underfunded when the impact of investing in a medicine or therapy could be just as high, if not even higher, than the returns achieved from a similar medicine or therapy that the company is already developing or providing?

For example, hepatocellular carcinoma, among the most common cancers in Egypt (a country of more than 100 million people), currently has no adjuvant therapies on the market. Endometriosis, a condition in which tissue similar to the lining of the uterus grows in other parts of a woman’s body, affects about 10 percent of all women of reproductive age around the world but lacks more efficacious, nonhormonal treatments. Sickle cell disease, which disproportionally affects Black Americans, is three times more prevalent than cystic fibrosis, which disproportionally affects White Americans. Yet cystic fibrosis receives about 3.5 times more funding (in federal expenditures) and 75 times more foundation funding than sickle cell disease.⁷

Why epidemiology of care is the greatest unlock

Once companies have identified a white space—the gap between a need and their allocated resources—they can begin to play a distinctive role. The greatest unlock is addressing unwarranted variations in how patients are treated—the epidemiology of care. With sophisticated digital tools, advanced analytics, and relentless critical thinking, care gaps can now be mapped across the patient journey, taking into account what may be critical differences that affect different social groups.

Capabilities exist not only to consider everything that should happen in patient care and to map what effective treatments look like at each step but also to quantify them, at the level of individual patients and physicians. It is possible, as well, to measure what did not happen: how many patients are not receiving the right treatments, how many are receiving a late diagnosis, the percentage of patients receiving less effective therapies, the percentage who don’t receive follow-up scans, and more. In many cases, it is feasible to map and visualize these opportunities within a given city, or even within specific institutions.

In the United States, sophisticated extrapolations can often supplement ready data to allow for detailed analyses of the race and ethnicity of a patient, and almost always the gender. It’s also possible to extrapolate factors such as wealth and social level of deprivation, based on an area in which a doctor is practicing. This enables teams to develop both a more granular and a more comprehensive understanding of where the wrong outcomes are happening, and to whom. One study, for example, revealed that for a certain type of breast cancer, Black women had a lower likelihood of being prescribed the optimal therapy.⁸ That’s perhaps not surprising, particularly with overall averages.

Yet studies have also showed that racial differences in treatment and outcomes can vary significantly by geography. In some regions, outcomes are essentially the same for White and Black women, but there is a pronounced disparity in certain counties. Using appropriate real-world data, life sciences companies can measure and track these disparities with considerable geographic specificity, which allows both for more targeted interventions and a deeper understanding of the factors at work. Often, these factors lie at the intersection of multiple variables, such as race, socioeconomic conditions, and historical trends.

As patterns emerge across social groups and geographies, companies can zero in for more effective interventions—sometimes, even before a failure unfolds—to ensure that treatments are provided at (or at least closer to) the diagnosis stage and to avoid the effects of what can happen if they aren’t. In assessments of the epidemiology of care, the greatest opportunities for better health outcomes often come early. Depending upon the disease, getting to the right diagnosis quickly can have outsize effects on health outcomes.

The greatest opportunities for better health outcomes often come early. Depending upon the disease, getting to the right diagnosis quickly can have outsize effects on health outcomes.

Conversely, failing to make the right diagnosis, or sometimes even delaying it by an incremental period of time, will have cascading effects not only with respect to the initial condition but also from secondary and tertiary consequences that can result from misdiagnoses or delays. For example, the blood cancer multiple myeloma, which is more than twice as likely to strike Black as White Americans, can lead to severe kidney problems and, in turn, to heart failure.⁹ Doctors and health providers can forestall those consequences if the disease is diagnosed early but must be proactive to make the right diagnosis quickly. The consequences of delay increase in a nonlinear way.

Acting for health equity

Recognizing the importance of health equity and identifying opportunities to promote it are essential first steps but hardly the end of the journey. Players across the pharmaceutical and life sciences value chain can think about partnering both at the industry and community levels and begin to create a virtuous cycle that improves the epidemiology of care.

Industry engagement

Pharmaceutical and life sciences companies are well-positioned to advance health equity and to realize better outcomes for more patients, to reduce health system costs, and to innovate more—and more profitably. Although the social determinants of health (SDOH) are hyperlocal, pharmaceutical products are among the few constants across geographies.

The industry, which is already beginning to act collaboratively, can build on its momentum by taking several steps. For starters, companies can institute uniform industry standards to identify and track unmet needs—a move that will help calibrate R&D investments against the global disease burden. It will also galvanize the industry and other ecosystem players (such as governments and nongovernmental organizations) to fill gaps, and provide regulatory support for key initiatives. In addition, companies can agree on common metrics to track clinical trials and determine how well they match the underlying epidemiology of disease and develop codes of AI conduct to address the needs of different subpopulations.

In addition, individual companies or groups of companies can share their unique capabilities by partnering in specific regions. Abdul Latif Jameel Health and Butterfly Network, for example, are partnering to bring an advanced ultrasound device to underserved people across the Middle East, North Africa, and India. Best Buy Health, Boston Children’s Hospital, Alphabet, Microsoft, Validi, and others have joined the Health Equity and Access Leadership (HEAL) Coalition to mitigate health disparities through technology.

Empower community pull

Unfairness impedes good health; it’s unrealistic to expect that people will seek out health solutions if they distrust medicines and providers. In the United States, 5 percent of White adults report that they have been treated unfairly while receiving healthcare—compared with 19 percent of Hispanic adults and 20 percent of Black adults. These differences reflect historical inequities. Yet companies can foster trust from underserved groups and create community pull by highlighting inequity forthrightly and considering medicines and healthcare access holistically.

Consider the case of diabetes—a disease twice as likely to kill non-Hispanic Blacks as non-Hispanic Whites. Researchers have found that “satisfied patients work as ‘customer evangelists,’ spreading the good word about appropriate and timely diabetes care modalities in the family and community.”¹⁰ US Supreme Court justice Sonia Sotomayor, for example, who is of Puerto Rican descent, lives with Type 1 diabetes. She has been among the most passionate and committed activists for sticking to a treatment regimen. Her voice, together with a chorus of others, helps educate populations, generate community pull, and improve health outcomes.

---

Health equity is a compelling opportunity—and a challenge that pharmaceutical and life sciences players, both individually and collectively, are uniquely positioned to address. By following a defined approach that relentlessly follows the data and by working together, organizations can not only meet significant unmet needs but also create a cycle of trust in underserved communities for even better outcomes.

Article link; https://www.mckinsey.com/industries/life-sciences/our-insights/health-equity-a-framework-for-the-epidemiology-of-care?

ABOUT THE AUTHOR(S)

Anas El Turabi is a partner in McKinsey’s Waltham office; Anjali Menon is a consultant in the New Jersey office; Lucy Pérez is a senior partner in the Boston office; and Gila Tolub is a partner in the Tel-Aviv office.

Kessel Run, DOD’s first software factory, is about to help one air combat command unit move all operations to a software environment designed via DevSecOps.

Kate Macri

Fri, 03/04/2022 – 20:43

The Defense Department announced a new software modernization strategy Feb. 8 to organize software development efforts throughout the department in line with current “software factory” efforts, such as Kessel Run, which are based on the DevSecOps philosophy of software development.

DOD’s new approach, which calls for a “department-wide software factory ecosystem,” will not only improve IT efficiency dramatically but also improve accuracy and response times, potentially resulting in more saved lives and less IT bloat and costs.

The announcement comes as Kessel Run, a software factory supporting the U.S. Air Force (USAF), is on the brink of reaching its first minimum viable capability release (MVCR1) for KRADOS, a suite of software applications designed to replace the 609th Air Operations Center’s Theater Battle Core Management Systems (TBCMS).

Kessel Run OpsC2 Product Line Chief Col. James Lotspeich said the goal of the MVCR1 milestone is to shift the 609th AOC’s reliance off of TBCMS and the Master Air Attack Planning Toolkit (MAAP-TK) entirely.

“It’s a big deal. A goal is to fully deprecate TBMCS in time, but for now, the 609th will be trading some inefficiencies for other improvements until we hit our milestone past MVCR1,” Lotspeich said in a statement to GovCIO Media & Research. “Before spring ends in 2022 with MVCR1, 609th will be able to plan, monitor and execute the Air Tasking Order/Air Combat Order (ATO/ACO) using only KRADOS for day-to-day operations with multi-tenant user bases and logically separated data and environments.”

Kessel Run currently has training plans for four KRADOS applications, as relayed by Lotspeich:

• Spacer, “an air space management tool that coordinates and deconflicts air spaces within a set area of responsibility;”
• MaiTai, which allows commanders to see available assets in a secure manner;
• Slapshot, which builds the Master Air Attack Plan (MAAP) and supports global users in the Combat Operations Division (COD); and
• Jigsaw, an interface that helps tank planners “save time, fuel and lives.”

According to Lotspeich, the Jigsaw application in KRADOS has saved DOD $500 million in fuel costs and is also used by NATO partners.

DOD’s software modernization strategy will make achievements like Kessel Run’s KRADOS the standard across all military service branches, potentially saving the department billions of dollars in IT costs each year.

“Kessel Run is more than a software factory,” Col. Brian Beachkofski, Kessel Run’s commander and CEO, told GovCIO Media & Research in a statement. “Kessel Run is a DevSecOps unit whose responsibilities are the full scope of DevSecOps. Our model is the right construct to implement the vision for the memo: ‘deliver resilient software capability at the speed of relevance.’ Our support during Operation Allied Refuge and the evacuation of Kabul shows why that full scope leads directly to operating at the speed of relevance.”

DOD’s memo outlining the new software modernization strategy describes a DevSecOps, Agile approach to software delivery that learns and responds to DOD mission needs in real-time. 

Beachkofski said one of Kessel Run’s goals is to train airmen to be savvy software engineers to help close the tech talent gap at DOD and help the department shift to a DevSecOps mindset in a sustainable way.

Beachkofski’s vision aligns with comments from Hannah Hunt, Chief Product and Innovation Officer at Army Futures Command, last fall (Army Futures Command is a software factory serving the U.S. Army).

“Kessel Run’s focus on talent acquisition has centered not on recruiting from the private sector, but rather bringing private sector learnings to the Air Force and encouraging servicemen to adopt them,” Beachkofski said. “This has been designed with the intent of building a skill and knowledge base within the Air Force itself.”

DOD also emphasizes the need for improved software supply chain security in the memo describing the new strategy.

Kessel Run Chief Security Officer Brandon Johns said Kessel Run “applauds” recent moves within DOD toward adopting “Software Bills of Materials” (SBOMs) to document every line of code in the software supply chain, but believes DOD should still prepare for breaches despite best efforts to prevent them.

A DevSecOps approach can help with that.

“We build a system that provides us with telemetry and visibility so that we can detect the anomalies that indicate when a product, service, or user isn’t behaving as expected,” Johns told GovCIO Media & Research in a statement. “This allows us early and vital alerting so that we can respond and ensure mission completion.”

DOD’s software modernization strategy positions the department to follow in Kessel Run’s footsteps, but Beachofski said DOD’s definition of a software factory “is slightly out of step” with their definition of DevSecOps. Instead of launching new software factories to release software, Beachofski believes DOD should focus on deploying more DevSecOps units throughout the department to foster Agile culture.

“We need more DevSecOps units and not software factories,” he said. “Kessel Run was founded as a pathfinder to see what works and allow the wider community to benefit from our lessons learned. This is the chance to realize that our differential impact to fielded users at the 609th AOC is directly related to our implementation of DevSecOps and our structure mirroring our strategy. There is an opportunity to use the current focus on DevSecOps to do what we did for cyber operations and combine the required authorities into a single organization that is responsible for all of DevSecOps.”

Article link: https://governmentciomedia.com/dods-new-software-modernization-strategy-comes-kessel-run-prepares-major-milestone

MARCH 21, 2022

https://www.whitehouse.gov/briefing-room/statements-releases/

This is a critical moment to accelerate our work to improve domestic cybersecurity and bolster our national resilience.  I have previously warned about the potential that Russia could conduct malicious cyber activity against the United States, including as a response to the unprecedented economic costs we’ve imposed on Russia alongside our allies and partners. It’s part of Russia’s playbook. Today, my Administration is reiterating those warnings based on evolving intelligence that the Russian Government is exploring options for potential cyberattacks.

From day one, my Administration has worked to strengthen our national cyber defenses, mandating extensive cybersecurity measures for the Federal Government and those critical infrastructure sectors where we have authority to do so, and creating innovative public-private partnerships and initiatives to enhance cybersecurity across all our critical infrastructure. Congress has partnered with us on these efforts — we appreciate that Members of Congress worked across the aisle to require companies to report cyber incidents to the United States Government.

My Administration will continue to use every tool to deter, disrupt, and if necessary, respond to cyberattacks against critical infrastructure. But the Federal Government can’t defend against this threat alone. Most of America’s critical infrastructure is owned and operated by the private sector and critical infrastructure owners and operators must accelerate efforts to lock their digital doors. The Department of Homeland Security’s Cybersecurity and Infrastructure Security Agency (CISA) has been actively working with organizations across critical infrastructure to rapidly share information and mitigation guidance to help protect their systems and networks

If you have not already done so, I urge our private sector partners to harden your cyber defenses immediately by implementing the best practices we have developed together over the last year. You have the power, the capacity, and the responsibility to strengthen the cybersecurity and resilience of the critical services and technologies on which Americans rely. We need everyone to do their part to meet one of the defining threats of our time — your vigilance and urgency today can prevent or mitigate attacks tomorrow.

Article link: https://www.whitehouse.gov/briefing-room/statements-releases/2022/03/21/statement-by-president-biden-on-our-nations-cybersecurity/

by The Dalai Lama with Rasmus Hougaard

February 20, 2019

Summary.   The Dalai Lama shares his observations on leadership and describes how our “strong focus on material development and accumulating wealth has led us to neglect our basic human need for kindness and care.” He offers leaders three recommendations. First, to be mindful: “When we’re under the sway of anger or attachment, we’re limited in our ability to take a full and realistic view of the situation.” Also, to be selfless: “Once you have a genuine sense of concern for others, there’s no room for cheating, bullying, or exploitation; instead you can be honest, truthful, and transparent in your conduct.” And finally, to be compassionate: “When the mind is compassionate, it is calm and we’re able to use our sense of reason practically, realistically, and with determination.”close

Over the past nearly 60 years, I have engaged with many leaders of governments, companies, and other organizations, and I have observed how our societies have developed and changed. I am happy to share some of my observations in case others may benefit from what I have learned.

Leaders, whatever field they work in, have a strong impact on people’s lives and on how the world develops. We should remember that we are visitors on this planet. We are here for 90 or 100 years at the most. During this time, we should work to leave the world a better place.

What might a better world look like? I believe the answer is straightforward: A better world is one where people are happier. Why? Because all human beings want to be happy, and no one wants to suffer. Our desire for happiness is something we all have in common.

But today, the world seems to be facing an emotional crisis. Rates of stress, anxiety, and depression are higher than ever. The gap between rich and poor and between CEOs and employees is at a historic high. And the focus on turning a profit often overrules a commitment to people, the environment, or society.

I consider our tendency to see each other in terms of “us” and “them” as stemming from ignorance of our interdependence. As participants in the same global economy, we depend on each other, while changes in the climate and the global environment affect us all. What’s more, as human beings, we are physically, mentally, and emotionally the same.

Look at bees. They have no constitution, police, or moral training, but they work together in order to survive. Though they may occasionally squabble, the colony survives on the basis of cooperation. Human beings, on the other hand, have constitutions, complex legal systems, and police forces; we have remarkable intelligence and a great capacity for love and affection. Yet, despite our many extraordinary qualities, we seem less able to cooperate.

In organizations, people work closely together every day. But despite working together, many feel lonely and stressed. Even though we are social animals, there is a lack of responsibility toward each other. We need to ask ourselves what’s going wrong.

I believe that our strong focus on material development and accumulating wealth has led us to neglect our basic human need for kindness and care. Reinstating a commitment to the oneness of humanity and altruism toward our brothers and sisters is fundamental for societies and organizations and their individuals to thrive in the long run. Every one of us has a responsibility to make this happen.

What can leaders do?

Be mindful

Cultivate peace of mind. As human beings, we have a remarkable intelligence that allows us to analyze and plan for the future. We have language that enables us to communicate what we have understood to others. Since destructive emotions like anger and attachment cloud our ability to use our intelligence clearly, we need to tackle them.

Fear and anxiety easily give way to anger and violence. The opposite of fear is trust, which, related to warmheartedness, boosts our self-confidence. Compassion also reduces fear, reflecting as it does a concern for others’ well-being. This, not money and power, is what really attracts friends. When we’re under the sway of anger or attachment, we’re limited in our ability to take a full and realistic view of the situation. When the mind is compassionate, it is calm and we’re able to use our sense of reason practically, realistically, and with determination.

Be selfless

We are naturally driven by self-interest; it’s necessary to survive. But we need wise self-interest that is generous and cooperative, taking others’ interests into account. Cooperation comes from friendship, friendship comes from trust, and trust comes from kindheartedness. Once you have a genuine sense of concern for others, there’s no room for cheating, bullying, or exploitation; instead, you can be honest, truthful, and transparent in your conduct.

Be compassionate

The ultimate source of a happy life is warmheartedness. Even animals display some sense of compassion. When it comes to human beings, compassion can be combined with intelligence. Through the application of reason, compassion can be extended to all 7 billion human beings. Destructive emotions are related to ignorance, while compassion is a constructive emotion related to intelligence. Consequently, it can be taught and learned.

The source of a happy life is within us. Troublemakers in many parts of the world are often quite well-educated, so it is not just education that we need. What we need is to pay attention to inner values.

The distinction between violence and nonviolence lies less in the nature of a particular action and more in the motivation behind the action. Actions motivated by anger and greed tend to be violent, whereas those motivated by compassion and concern for others are generally peaceful. We won’t bring about peace in the world merely by praying for it; we have to take steps to tackle the violence and corruption that disrupt peace. We can’t expect change if we don’t take action.

Peace also means being undisturbed, free from danger. It relates to our mental attitude and whether we have a calm mind. What is crucial to realize is that, ultimately, peace of mind is within us; it requires that we develop a warm heart and use our intelligence. People often don’t realize that warmheartedness, compassion, and love are actually factors for our survival.

Buddhist tradition describes three styles of compassionate leadership: the trailblazer, who leads from the front, takes risks, and sets an example; the ferryman, who accompanies those in his care and shapes the ups and downs of the crossing; and the shepherd, who sees every one of his flock into safety before himself. Three styles, three approaches, but what they have in common is an all-encompassing concern for the welfare of those they lead.

Article link: https://hbr-org.cdn.ampproject.org/c/s/hbr.org/amp/2019/02/the-dalai-lama-on-why-leaders-should-be-mindful-selfless-and-compassionate

• The Dalai Lama is the spiritual leader of the Tibetan People. He was awarded the Nobel Peace Prize in 1989 and the U.S. Congressional Gold Medal in 2007. Rasmus Hougaard is the founder and managing director of Potential Project, a global leadership and organizational development firm, and the coauthor of the new book, The Mind of the Leader: How to Lead Yourself, Your People, and Your Organization for Extraordinary Results. He has created an app that will help you develop mindfulness, selflessness, and compassion in your leadership

Please share with friends and colleagues that might have an interest in Market Research for VA Supply Chain Modernization – part 3

Greetings,

You are invited to a Zoom webinar.
When: Mar 21, 2022 01:00 PM Eastern Time (US and Canada)
Topic: Market Research for VA Supply Chain Modernization – Part 3

Register in advance for this webinar:
https://us02web.zoom.us/webinar/register/WN_RZgFjt5JS6aU5ehv2xNxjg

After registering, you will receive a confirmation email containing information about joining the webinar.

---

Webinar Speakers

Ross A. Davidson (Associate Executive Director, Office of Facilities Planning Office of Construction and Facilities Management @Department of Veterans affairs)
Mr. Davidson serves as the principal advisor to the Executive Director, CFM on planning, architectural, engineering, and estimating disciplines, and assists and manages the development and maintenance of VA A/E quality standards for VA’s built environment; State Nursing Home Grant and Homeless Grant Programs’ facility quality control; cost estimating; and value engineering, and historic preservation and National Environmental Policy Act (NEPA) compliance issues.
Mr. Davidson is a retired U.S. Army Colonel with an extensive and successful background of service.

Mr. Davidson has a Bachelor of Architecture from the University of Notre Dame, a Master of Urban Design, a Master of Urban Planning, and a Graduate Certificate in Real Estate Development from the University of Michigan, and Master of Strategic Studies from the U.S Army War College. He is a Design Build Institute of America (DBIA) professional and Fellow with the Health Facility Institute.

Matthew J. Manning (Assistant Director, HCA Acquisition Division Office of Mission Support @Veterans Benefits Administration)

Vincent S. Calabrese (National Program Manager, Customer Service Consolidated Mail Outpatient Pharmacy National Office @Department of Veterans Affairs)

Michael Parrish (Principal Executive Director for the Office of Acquisition, Logistics, and Construction (OALC). Head of Contracts. @Department of Veterans Affairs)
Mr. Parrish has over 35 years of senior leadership experience in military, government, corporate, and non-profit organizations. After graduating in 1985 with a Bachelor’s Degree in Mechanical Engineering from the U.S. Military Academy, Mr. Parrish served for 14 years on active duty and 21 years in the in the U.S. Army Reserves where he held various leadership positions of increasing responsibility as an Army Aviator, serving as an Air Operations Officer during Desert Storm and culminating as a member of the Army Acquisition Corps. Mr. Parrish has been Chairman & CEO of several publicly traded companies and was founder and CEO for several start-ups. Mr. Parrish holds a Master’s Degree in Aeronautical and Astronautical Engineering from Stanford University and an MBA with honors from the Wharton School at the University of Pennsylvania.

Joe Grace, Captain USN (Retired) (President and CEO (Moderator for this event) @Grace and Associates)
Captain Joe Grace, USN (Retired), is the President and CEO of Grace & Associates. Mr. Grace is a graduate of the United States Naval Academy, a former nuclear submarine officer, and earned his MBA from the University of New Orleans. During his active and reserve military career, he worked a variety of military assignments, including his final tour as the Chief Information Officer for Navy Medicine. Mr. Grace has worked for multiple companies and held many positions in industry. He is a serial entrepreneur, venture construction leader and long time business owner. He now works as a connector between industry and government, with an emphasis on Military Health and the Department of Veterans Affairs. His many roles include Moderator, Facilitator, a key trusted advisor to leadership and a mentor to industry and government. As an entrepreneur, Mr. Grace has started many technology-based companies and taken three public. Grace & Associates holds no government contracts

Dr. Angela Billups (Executive Director, Office of Acquisition and Logistics @Department of Veterans Affairs)
Dr. Angela Billups was appointed as the Executive Director, Office of Acquisition and Logistics at the Department of Veterans Affairs (VA) on November 26, 2018. As the Executive Director of one of the largest acquisition and logistics programs in the Federal government, Dr. Billups manages and oversees the development and implementation of policies and procedures for department-wide acquisition and logistics programs supporting all VA facilities and the VA Acquisition Academy in Frederick, Maryland. She is the primary advisor to the Chief Acquisition Officer and to the Secretary of Veterans Affairs for matters related to enterprise business strategies and acquisition management. Dr. Billups also serves as the VA Senior Procurement Executive and VA Suspension and Debarment Official. Dr. Billups is a seasoned acquisition professional with years of experience advising and assisting senior officials, government and industry, with the goal of helping them realize the acquisition life cycle.

Greg McLean (Special Projects Manager @Department of Veterans Affairs)
Gregory “Greg” McLean Special Project Manager Reported to APS (on detail) in May 2020. Gregory McLean is Vice-Chancellor of the VA Acquisition Academy (VAAA) Program Management (PM) School, where he oversees the training of VA program managers. The Program Management curriculum is intended to ensure that VA has the most qualified program managers and includes competency assessment, classroom and online learning, coaching and mentoring, on-the-job qualification development, assignment-specific courses, training toward Federal Acquisition Certification in Program/Project Management (FAC-P/PM), and continuing education. Mr. McLean previously served as Director of Program Management Policy in the Department of Veterans Affairs Office of Policy and Planning. Mr. McLean has more than 22 years of industry and Government experience, including developing and implementing national training and certification programs for major and critical acquisition initiatives.

Phillip Christy (Deputy Executive Director, Office of Acquisition, Logistics, and Construction (OALC) @Department of Veterans Affairs)
Mr. Christy serves as an advisor to OALCs Principal Executive Director on acquisition, logistics, and construction issues. His responsibilities include the day to day operational management of OALCs three major organizational elements: the Office of Acquisition and Logistics, the Office of Procurement, Acquisition and Logistics and the Office of Construction and Facilities Management. Mr. Christy is a retired U.S. Army Medical Service Corps Officer, and he served in multiple senior acquisition, construction and logistics positions during his 20-year career. Mr. Christy is a native of Renton, Washington. He holds an Executive Juris Doctorate in Health Law from the Concord University of Law, a Master of Science in Health Care Administration from Central Michigan University, and a Bachelor of Arts in Spanish and Business from Washington State University

President Joe Biden signed a law that requires critical infrastructure entities to report cyber attacks within 72 hours and report ransom payments in 24 hours.

Peyton Doyle

Published: 16 Mar 2022

On Tuesday, President Joe Biden signed into law a federal cyber attack reporting requirement aimed at protecting critical infrastructure in the United States.

The Strengthening American Cybersecurity Act of 2022 was created to shore up cyberdefenses and increase the power of agencies investigating cybersecurity incidents. The Cyber Incident Reporting for Critical Infrastructure Act of 2022 is a part of the new law that focuses on how critical infrastructure organizations must report cyber attacks to the federal government, specifically the Cybersecurity and Infrastructure Security Agency (CISA).

The Critical Infrastructure Act states that an entity in the critical infrastructure sector “shall report the covered cyber incident to the Agency not later than 72 hours after the covered entity reasonably believes that the covered cyber incident has occurred.” It also says that the director of CISA may not require a report any earlier than that 72-hour mark.

Peter Guffin, chair of law firm Pierce Atwood’s privacy and data security practice, discussed the aim of the law with SearchSecurity.

“As its name suggests, the Strengthening American Cybersecurity Act, passed by the U.S. Senate last week, aims to bolster the defenses of federal government agencies and critical infrastructure owners, such as energy and healthcare facilities, against major cyberthreats and cyber incidents, including ransomware attacks,” Guffin said. “The expectation is that the prompt reporting and subsequent sharing of such information will arm federal agencies and critical infrastructure owners with the information they need to be able to defend themselves against major cyberthreats and incidents.”

On top of the initial report, any entity that submits a ransom payment to a threat actor must also report that they did so to CISA within 24 hours of delivering the payment.

The law details not only the timeline for reporting cyber attacks and specifically ransomware attacks on critical infrastructure, but also outlines the new powers and responsibilities given to CISA.

The law identifies CISA as the head agency in charge of collecting and analyzing the data on cyber incidents, but it also dictates that the agency must “coordinate and share information with appropriate Federal departments and agencies to identify and track ransom payments, including those utilizing virtual currencies.”

Sharing information with other agencies was a sticking point when the bill got to Congress, as it did not explicitly require CISA to assist other agencies, something that the Department of Justice took issue with.

The bill was passed by the House, however, and was adjusted so that all federal agencies were able to see what reported incidents CISA was handling if they wished. It also stated that CISA was required to share relevant findings with not just federal departments, but local entities as well.

Subsection (a)(4-5) of section 2241 states that the agency must provide “timely, actionable, and anonymized reports of cyber incident campaigns and trends, including, to the maximum extent practicable, related contextual information, cyber threat indicators, and defensive measures,” to all “appropriate entities, including sector coordinating councils, Information Sharing and Analysis Organizations, State, local, Tribal, and territorial governments, technology providers, cybersecurity and cyber incident response firms, and security researchers.”

Another key part of the law comes from a subsection titled “Periodic Briefing,” which states that on the first day of each month, the director of CISA must collaborate with the national cyber director, attorney general and the director of national intelligence to give a briefing on the “national cyber threat landscape.” This briefing would feature the total number of reports received by CISA in the previous month, new trends in cyber incidents and ransomware attacks, and how the past month compares to the month before it. It also says that the briefing must have a summary of how the information in the received reports was used by CISA.

The law requires the briefings to be delivered to the majority and minority leaders of the Senate, the speaker of the House and the minority leader of the House, the Senate Committee on Homeland Security and Governmental Affairs and the House Committee on Homeland Security.

What is still left

As far as how this new critical infrastructure law relates to state data breach notification requirements, Guffin said that it borrows from and enhances some of the laws produced by state legislatures.

“By requiring the prompt reporting of and sharing of information regarding actual data security incidents, the Act adopts, but vastly strengthens and improves upon, a sound regulatory model found in most existing data breach notification laws in the U.S.,” he said.

While this law focuses on critical infrastructure attacks and informing federal agencies, it does differ in how American citizens receive data breach notifications under different state laws. The federal law does not require critical infrastructure entities to inform U.S. citizens of cyber attacks. The only requirement is to inform federal agencies, and that leaves millions of Americans potentially in the dark about cyber attacks.

As of 2018, each state within the U.S. has some form of data breach notification law. While they all differ as far as how data breaches are reported to federal agencies and state governments, they all have one thing in common: They require entities to notify victims if their personal information may have been exposed or stolen.

Heidi Shey, a principal analyst at Forrester Research, discussed obstacles that are holding the U.S. back from enacting a federal data breach notification law.

“I think some of this stems from how the U.S. as a whole thinks about privacy and consumer privacy, because compared to a place like Europe, which looks at it as a fundamental right, you have a right to privacy,” Shey told SearchSecurity. “Whereas I think in the U.S., it’s more of this perspective of a trade-off. Because of that, I think there’s greater tie into this environment of what is considered a business-friendly type of policy or regulation versus what is about protecting consumers and their privacy.”

Article link: https://www-techtarget-com.cdn.ampproject.org/c/s/www.techtarget.com/searchsecurity/news/252514713/Biden-signs-law-on-reporting-critical-infrastructure-cyber-attacks?

March 2022 
Topics: Strategic Planning, Communications Technology (General), Computer Security, Policy

Charles Clancy Ph.D., The MITRE Corporation

DOWNLOAD PDF (1.31 MB) The internet is on the verge of the next fundamental change. The third generation of the World Wide Web, known as Web3, is bringing an entirely new technology stack built on blockchain. This new epoch of social interconnectivity blurs the lines between telecommunications and finance, compounding an already complex regulatory ecosystem.While Web3 is creating tremendous new opportunities, it is also at the center of major social, economic, and national security issues. A national strategy for Web3 is essential to the U.S. building on its early lead in the technology and to mitigate potential detrimental outcomes.In this paper, MITRE’s Charles Clancy, Ph.D., describes the generational arc of web technologies and the new, unique features of Web3, as well as policy objectives and specific recommendations for a national strategy.

Related Sections

Focus Areas

• Information Systems

Browse Topics

Air Traffic Management  (79)

Artificial Intelligence  (62)

Community Impact  (18)

Cybersecurity  (138)

Computer Security  (81)

Economic and Cost Analysis  (15)

Emergency Preparedness and Response  (27)

Intelligence After Next  (11)

Modeling and Simulation  (96)

National Security  (9)

Public Health  (62)

Risk Management (26)

Article link: https://www.mitre.org/publications/technical-papers/call-to-action-developing-national-strategy-web3

Related Publications

Beyond Thin Clients: Limiting Cybersecurity Vulnerabilities

By Design: Integrating Privacy into Information Systems

Mission Not Impossible: Defending IT Systems Through Mission Assurance

The Human Factor: Using Behavioral Science to Counter Insider Threats

Helping the FAA Adapt to Evolving Cyber Threats

NEWS PROVIDED BYChenega Applied Solutions

Mar 15, 2022, 08:51 ET

STAFFORD, Va., March 15, 2022/PRNewswire/ — Chenega Applied Solutions (CAS), a subsidiary of Chenega Corporation’s Military, Intelligence, and Operations Support (MIOS) Strategic Business Unit and the Cyber Bytes Foundation (CBF), a 501(c)3 organization working to establish a sustainable cyber community through education, innovation, and outreach programs, are proud to announce their partnership to develop a showcase software factory at the Quantico Cyber Hub called “Nebula.” The goal of Nebula is to become a “birthplace” of software factories throughout the Department of Defense (DoD) and the US Government (USG) by providing a fully operational software factory with best-in-class tools, development platforms, and cloud access for Government programs to come up with successful “Proofs of Concepts (POCs)” and “Minimal Viable Products (MVPs)” free of charge to help fuel-inject the Government’s innovation progress.

Since 2017, Chenega Applied Solutions has become a leader in Department of Defense’s (DoD’s) budding DevSecOps movement by providing fully managed turn-key software factories and innovation environments to notable DoD programs such as Kessel Run, LevelUP, and Project Synergy, through its innovative Modernization as a Service (MaaS) offering. Using their best-in-class MaaScapability, Chenega Applied Solutions will be building the Nebula Software Factory on the second floor of the Cyber Bytes Foundation’s Quantico Cyber Hub, which hosted its Grand Opening in September 2021. The Quantico Cyber Hub (QCH) is the largest Cyber Security Center of Excellence in a Virginia HUBZone. It was designed as an agnostic “Cyber Domain Ecosystem,” making it the perfect place for CAS to showcase the state-of-the-art software factories produced by MaaS for the DOD around the country. Current projects being worked on at the QCH include the Cooperative Research and Development Agreement (CRADA) with the U.S. Marine Corps as well as projects with the Department of Homeland Security, and Department of State.

“Cyber Bytes Foundation is committed to bringing technology and solutions to the Warfighter at the local, State, Federal and DoD levels at the speed of Innovation,” says Jonathan Payton of the Cyber Bytes Foundation. “The Nebula Software Factory, in partnership with Chenega Applied Solutions, is the latest representation of that commitment.” 

The Nebula Software Factory will support QCH’s mission of being a place where subject matter experts come together with processes and capabilities to customize solutions to accelerate the implementation of Advanced Cyber Technologies through experimentation, innovation, research, and application. CAS will provide all aspects of a modern software factory, including but not limited to computers, hardware, software, furniture, and collaboration equipment.  Additionally, CAS has partnered with Cornerstone to provide free access to their cutting edge TruStacks DevSecOps Orchestration Platform, a deployable “software factory in a box” providing full end-to-end DevSecOps orchestration. Further partners include Insight Public Sector, Red Hat, and GitLab as contributors to the development platform.

“True to its name, we want Nebula to be the birthplace of software factories for the DoD and USG. Despite all the press and attention, the DevSecOps movement within the DoD and USG is currently a disrupter movement and needs more support. Our goal with Nebula is to provide a place where foundling, bootstrap software development groups across the DoD and USG can come, free of charge, to use the best-in-class tools and technologies, create meaningful MVPs, and get the proof of concepts they need to go back to their leadership and say ‘This works! Look what we can accomplish if we leverage the right tools and methods! Support this!'” says Mike Masten, Vice President of Operations for CAS and founder of MaaS.

If you work within a government or DOD agency and would like to be considered as a beta user group for the Nebula Software Factory please fill out the form linked here.

Both CAS and CBF are committed to providing a top-of-the-line cyber ecosystem at the Quantico Cyber Hub and look forward to sharing the process of building the Nebula Software Factory. Follow along on the Chenega Applied Solutions Linkedin and Cyber Bytes Foundation’s social channels as well. A grand opening is expected in May 2022.

About Cyber Bytes Foundation:

The Cyber Bytes Foundation (CBF) is a 501(c)3 organization working to establish and sustain a unique “Cyber Ecosystem” to produce education, innovation, and outreach programs to enhance developers for the cyber workforce.

About Chenega Applied Solutions:

Chenega Applied Solutions (CAS) is an Alaska Native-Owned Company operating under Chenega Corporation’s Military, Intelligence, and Operations Support (MIOS) Strategic Business Unit. For the better part of a decade, CAS has served federal agencies and the DOD as trusted advisors in IT, Records Management, Language Services, and more. CAS is proud to now support the DOD in its efforts to modernize through Modernization as a Service (MaaS).

Article link: https://www.prnewswire.com/news-releases/chenega-applied-solutions-to-build-nebula-software-factory-at-quantico-cyber-hub-301502872.html?tc=eml_cleartimeu

Contact Information:
Chenega Applied Solutions
Caleb Thompson
202.602.2039
331918@email4pr.com 

Cyber Bytes Foundation
Jonathan Payton
331918@email4pr.com

NCSC works with its partners to assess and mitigate the activities of foreign intelligence entities and other adversaries who attempt to compromise the supply chains of our government and industry. These adversaries exploit supply chain vulnerabilities to steal America’s intellectual property, corrupt our software, surveil our critical infrastructure, and carry out other malicious activities. They infiltrate trusted suppliers and vendors to target equipment, systems, and information used every day by the government, businesses, and individuals. The cost to our nation comes not only in lost innovation, jobs, and economic advantage, but also in reduced U.S. military strength.

RELEVANT REPORTS, BRIEFINGS & READING MATERIAL

Executive Orders

• EO 13636 Improving Critical Infrastructure Cybersecurity
• EO 13806 Assessing and Strengthening the Manufacturing and Defense Industrial Base and Supply Chain Resiliency of the United States (PDF)
• EO 13873 Securing the Information and Communications Technology and Services Supply Chain
• EO 13913 Establishing the Committee for the Assessment of Foreign Participation in the United States Telecommunications Services Sector
• EO 13984 Taking Additional Steps to Address the National Emergency with Respect to Significant Malicious Cyber-Enabled Activities
• EO 14005 Ensuring the Future Is Made in All of America by All of America’s Workers
• EO 14017 America’s Supply Chains
• EO 14024 Blocking Property with Respect to Specified Foreign Activities of the Government of the Russian Federation
• EO 14028 Improving the Nation’s Cybersecurity
  •  NIST: Security Measures for “EO-Critical Software” Use
  •  NIST: Recommended Minimum Standards for Vendor or Developer Verification (Testing) of Software Under Executive Order (EO) 14028
• EO 14034 Protecting Americans’ Sensitive Data from Foreign Adversaries

Supply Chain Risk Management – Authorities, Policies, and

      Standards

• Executive Order 13806 report (PDF)
• Executive Order 14017 – America’s Supply Chains (PDF)
• SECURE Technology Act: Establishment of the Federal Acquisition Security Council

          –  Federal Acquisition Security Council overview (PDF)

          –  Federal Acquisition Supply Chain Security Act graphic (PDF)

          –  H.R.7327 SECURE Technology Act (PDF)

   –  (New) FASC Final Rule(PDF)

• NIST Special Publication 800-161 (PDF)
• ICD 731, Supply chain Risk Management for the Intelligence Community (PDF)

 Tools

•  User Manual: The Outsourcing Network Services Assessment Tool (ONSAT) (PDF)
• (New) ONSAT Tool

National Supply Chain Integrity Month – A Call to Action

• Press Release: National Supply Chain Integrity Month – A Call to Action
• Software Supply Chain Attacks – 2021
• Supply Chain Risk Management: Best Practices in One Page – 2021
• Framework for Assessing Risks – 2021

Supply Chain Risk Management: Reducing Threats to Key U.S. Supply Chains

• NTIA Releases Minimum Elements for a Software Bill of Materials
• NCSC Supply Chain Risk Management Tri-Fold: Reducing Threats to Key U.S. Supply Chains (PDF)

Sector-Specific Supply Chain Best Practices

• Information and Communications Technology Sector
• Manufacturing and Production Sector
• Health Care Sector
• Energy Sector
• Ongoing Cyber Threats to U.S. Water and Wastewater Systems Joint Cybersecurity Advisory (PDF)

Podcasts

• Podcast on How One Federal Program Worked to Enhance its Supply Chain Security
• Podcast on Cyber & Supply Chain Threats to the Health Care Sector

Supply Chain Risk Management (SCRM) – Don’t Be the Weakest 

      Link!

• NCSC Bakers’ Dozen – 13 Elements of an Effective SCRM Program (PDF)
• NCSC SCRM Best Practices(PDF)
• Intelligence Community Logistics and SCRM (PDF)
• NCSC Supply Chain Risk Management video
• 2018 Foreign Economic Espionage in Cyberspace report (PDF)
• NCSC Federal Partner Newsletter : National Supply Chain Integrity Month (PDF)
• MITRE report: Deliver Uncompromised (PDF)

Thought Leaders: Supply Chain Security 

• The Emerging Cyber Threat to Industrial Control Systems (London: United Kingdom, Lloyd’s, February 2021) [Article characterized as a “Call to Action”]
• CSIS Working Group on Trust and Security in 5G Networks, Criteria for Security and Trust in Telecommunications Networks and Services (Washington, D.C.: Center for Strategic & International Studies, May 2020)
• Assessing SCRM Capabilities and Perspectives of the IT Vendor Community: Toward a Cyber-Supply Chain Code of Practice (College Park: University of Maryland, Robert H. Smith School of Business, 2011)
• Cyber Supply Chain Risk Management: Toward a Global Vision of Transparency and Trust (Redmond, WA: Microsoft, 2011). [also Political and Legal]
• Defense Science Board Task Force on Cyber Supply Chain (Washington, D.C.: U.S. Department of Defense, April 2017)
• Deliver Uncompromised: A Strategy for Supply Chain Security and Resilience in Response to the Changing Character of War (McLean, Virginia: MITRE Corporation, August 2018)
• How Chinese Cybersecurity Standards Impact Doing Business in China (Washington, D.C.: Center for Strategic & International Studies, August 2018)
• Supplier Assurance Framework: Good Practice Guide (London: United Kingdom Cabinet Office, May 2018)
• Breaking Trust: Shades of Crisis across an Insecure Software Supply Chain (Washington, D.C.: Atlantic Council, July 2020)

5G Wireless Technology

• Potential Threat Vectors to 5G Infrastructure – CISA, NSA, ODNI Report
• State Department 5G Technology Website
• State Department Fact Sheet: 5G Security – What is Trust?
• State Department Fact Sheet: 5G Security – Incredible Promise, Significant Risk
• State Department 5G Technology Video
• DHS 5G Wireless Networks Graphic: Market Penetration and Risk Factors

Supply Chain Resources 

• (New) General Services Administration (GSA) and Federal Acquisition Institute (FAI) training course FAC-093: “Introduction to Supply Chain Risk Management”
  • Requires Defense Acquisition University (DAU) account or Department of Defense (DoD) Common Access Card (CAC)
• Department of Defense resources
• Department of Homeland Security resources
• UK National Cyber Security Centre resources

Additional Resources

• National Cyber Strategy of the United States – September 2018(PDF)
• National Security Strategy 2017 (PDF)
• National Counterintelligence Strategy 2016 (PDF)
• Supply Chain Risk Management Practices for Federal Information Systems and Organizations (PDF)
• (New) Committee on National Security Systems Directive Supply Chain Risk Management, CNSSD 505 (PDF)
• Defense Science Board (DSB) Task Force Report on Cyber Supply Chain
• DNI ICD 731 Supply Chain Risk Management 20131207 (PDF)
• DNI ICS 731-01 Supply Chain Criticality Assessment 20151002 (PDF)
• DNI ICS 731-02 Supply Chain Threat Assessments 20160517 (PDF)
• DNI ICS 731-03 Supply Chain Information Sharing (PDF)

Article link: https://www.dni.gov/index.php/ncsc-what-we-do/ncsc-supply-chain-threats

RELATED LINKS

NCSC Awareness Materials

Your Personal Information: Protecting it from Exploitation

RELATED CONTENT

National Counterintelligence Strategy for the United States

National Insider Threat Task Force Fact Sheet

NCSC Strategic Plan

Michael Orlando, Senior Official Performing The Duties Of The Director, NCSC