Episode 76: Julie Chua

hello and welcome to risk chats for the firm i'm your host paul marshall all right well today we are inviting a guest back that was on quite a few years ago but today we're going to focus just on her so this should be a great one and uh my guest today is julie chua from hhs office of the cio hello julie how you doing hey paul very good and thanks for having me on your podcast absolutely welcome back um all right well let me introduce the subject today uh we are going to be talking about actually a couple things specifically about julie uh she did win an award actually a couple years ago now but an affirm award so we'll talk about that but we're also going to talk about you know what you do some of the cyber work and how that integrates with erm so why don't we start off you might just give us give us the audience a little bit of a background about yourself and what you do absolutely so at hhs within the office of the cio we do sit within the cso's office so that's the chief information security officer i am the governance risk management and compliance director so that is my main hat that is my main duties um that involves sisma and all the federal regulations that all agencies have to comply with and then on the other side of things so healthcare and public health sector is one of the 16 critical infrastructure sectors so part of my portfolio is engaging with the private sector to make sure that they have the requisite cyber security best practices and we engage with them with a lot of development of those types of resources raising awareness training education and how that plays into um why i'm such an advocate for integrating your cyber security risk management with enterprise risk management is from a healthcare and public health sector lens for us it is ultimately about patient safety so our model when we talk to our stakeholders when we engage with our healthcare stakeholders is cyber safety is patient safety and i think that is a clear very concrete way to look at why cyber security is not solely an ip issue so that's one of the things that i've been trying to dispel um working with niss colleagues working with other federal agencies is when people think about cyber security they go oh that's the ip department they have that all taken care of but if you put that mindset into a hospital situation or setting and nobody knows what the impact is or are from a cyber impact to your clinical operations your patient care um if you don't know how to respond to such an event much like other hazards like hurricanes or earthquakes etc i think you'll quickly see how if you don't put cyber or include cyber in your enterprise risk management efforts in your board of directors or similar type of governance structure it can easily just affect how you care for patients and or how you are unable to care for patients so i think that's a very critical way to think about things um i think i mentioned to you paul that most of federal agencies they are part or even a sector risk management agency for a critical infrastructure sector so think of energy financial sector water and dam communications etc so that's kind of how i look at the importance of cyber and erms and integrating the two right so yeah i mean what were your observations when you started doing this work you know when um like the cyber or cio folks would start talking to the risk management folks or even the budget people the strategic plan people do you feel like they didn't know how to communicate their value proposition or how would you frame that right so when i was starting this work at hfs and then later on i'll mention the interagency work that we are currently still um doing is i realized that the reason why we weren't able to articulate we meaning cyber professionals inclusive of your executive leadership up to the we were talking technical language we were talking about vulnerabilities that our analysts have been seeing we were talking about patch management or these things that are needed to be upgraded because of some known uh attack vectors so when you talk to a cfo a chief financial officer or even you're just your risk officer or crm counsel who are not it and they are definitely not cyber focused it's easy to lose the one-to-one match so i'll say one-to-one because that's where the integration comes in where you look at all your risks in an enterprise and you look at them a lot of them or all of them collectively as a portfolio so when you talk about this invite you don't talk about what is the business and mission impact why is this so critical to us so that we can sustain and continue our operations without that context it is likely that a financial focused executive will take a look at those areas where he or she is being given this is why it matters to us from the financial resource allocation prioritization of where we need to put our investment funding and budget so all of that said is we were speaking in our cyber world language and that is not helpful even to today and the one thing that i've been trying to get federal agencies to realize within the cyber community is let's talk about how these cyber risk decisions support the necessary allocation of funding support the necessary budgets that need to be either increased decreased maintained and then how is it that we are able to continue our essential functions so in the federal agency world we have primary mission essential functions and essential functions that we have to maintain and continue and the last thing about this particular area is we also have this thing in the federal world where we look at our high value assets and those are critical assets that support our essential functions so hopefully the way that i've articulated how all of these things work if you're a cyber person listening to this podcast you are going to go oh yeah i have been um missing the opportunity to articulate why i need increased resources and if you're an erm counterpart hopefully you understand why it is a struggle for us to get into let's say the enterprise risk register because as an you're a practitioner you don't understand why we're telling you this needs to get edited right so you know something i'm hearing is that so if you are a cyber practitioner you know whatever level you are of course the higher levels you know it's really important i mean to truly understand what is the impact on the critical mission of your agency or bureau or office to cyber attacks and related things right like really understand like how could you explain this to a senior leader or budget or cfo person you know to say if we don't get this funding or the system will be vulnerable and attacked and then this whole health care program you know something horrible happens right so basically have that big picture correct absolutely right and i mean it makes sense i mean you know we're all technical people we focus on what we do every day we don't think about maybe the whole organization that's above most people's daily activities so it does make sense why folks tend to focus on their very specific things right so uh so that's great yeah i think that's one of the big messages from this is is precisely that to frame you know your uh your budgetary or your operational needs as part of the bigger picture what is the mission what is the critical mission of your agency and how can you you know explain those risks to help you get that funding so so that's kind of what your day-to-day activities are but um another thing we want to talk about here is that you were actually an affirm award winner um it was actually 2022 uh but we were trying to get a hold of you about i think we just couldn't get our scales up to speed here but you might just tell us a little bit about you know why you received that award some of the activities you were performing there with the firm sure so that's that's an interesting way to ask me why i received the award so to give you a little bit of how i thought about that day that when i received the notification that hey you were one of the two erin leaders of the year this year and it was coming back then and it still is today that i received this award because to me the work that we do in this state and that's the cyber and erin integration bridging the gap between these two communities and whether it's within your own agency if you are a federal agency stakeholder or in partnership with our private sector stakeholders this is not easy it's very complex it's on the cyber side at least i can say that it's a novel idea of thinking about way beyond you know enterprise perimeter architecture type of security and really looking at why and where i sit as a cyber area within my agency's entire portfolio of risks that they are looking at so all of that said i am really lucky to be surrounded by leaders and peers who know and advocate that this work is important and i think that's why discussions and now actually more and more there are concrete outcomes and implementations of cyber erin integration there's widespread discussion now it's not when it was in 2018 where you talk to a cyber person and you ask hey are you familiar with enterprise risk management are you involved in that and they would say absolutely yes and then they tell you what they think what enterprise risk management means which is like i just said their perimeter their boundary of systems that are within their purview and they are protecting those in you know within the system requirements and within um 8130 which is another requirement that we do in 813 which is a part of it so i would say i think that's why i received the award is because i was adamant with getting the right people talking about this getting the right people at the table and not putting it into one little silo where a small number of federal agencies are talking and nobody else is hearing about it and if i may i'm going to fast forward and kind of take a trip down memory lane where this cyber erin community that i kind of spoke about indirectly it started in 2018 so if you can picture 12 or so federal employees we gathered it was still pre-pandemic so we were in um one of the buildings in dc yeah don't ask the usual things that would happen when a gathering would take place and at that time there were five including me it and or cyber professionals everybody else were e-run professionals or in the e-run state so a little more fast forward the co-chair at that time from miss nala ivy she asked if i would like to co-chair with her because her previous co-chair had stepped down so i was very excited and it was my chance to hopefully make a difference and have concrete outcomes and i promised her the first year my goal was to expand the it and infosec participation and really bridge that gap so more of that forward after a year i didn't make that goal there were more cyber and it professionals so in 2020 there were still at 60 erm but at least now there's a bit there was about 30 percent it and infosec today it is um i would say 48 percent so close to half of this cyber community of interest and it is now more a diverse group also where we have acquisitions performance management compliance strategic planning so i think as this coy has matured it really has given an opportunity for federal agencies to come together and figure out what is this cyber and erm integration even if they are outside of cyber and drs so that was a long answer to your question about why i think i received the award but i have to say all that to give some context no totally i mean that does explain it and you know you said it's still ongoing you know this is what you did then but you all continue to grow and this is still a strong focus for a firm in the erm world and federal government so that's that's great um so i just had a couple more questions for you so following on from that specifically the coy you know just to let our audience understand what are some of the main major activities that the group actually performs so one of the big things that the coy produced was in 2021 we started work and developed the special chapter for the federal erm playbook and it was focused on cyber and erm integration the actual final of the federal erm playbook was released in mid-december 2022 but that i would say that was one of the biggest accomplishments of the coy and because of that big accomplishment around mid to late 2022 they were now ready for the next concrete things like what do we want to produce next so we did a lot of membership sessions and invited them to let us know what their top of mind challenges or topics that they would want you you would see the usual types of things um risk appetite tolerance supply chain came up as a big issue and challenge for federal agencies um ai actually also made the long list but about two or three sessions we finally decided as a membership group that there were really three areas if they wanted to tackle and um form smaller groups within the coy so those three areas are risk appetite and risk tolerance and the focus of that group is to provide best practices sample statements or even templates that agency partners can use so that they can start developing their own within their agency if they don't have one there is a tools and technology working group and their scope is still in flux but they are kind of going between do we want to put together a good list of solid requirements for how GRC tools can help with cyber and ERM integration the other part of their scope is potentially focused on what are existing solutions and tools out there that agencies are either using and maybe want to share how their experiences are with the successful deployment or implementation of that tool the last one is on cyber risk registers this is my personal favorite because HHS has done a little bit of draft initial work on this and we would like to share that knowledge share that initial draft of what a cyber risk register is from our perspective and then get more robust inner agency reviews feedback and then hopefully come out with a template that the COI and their agencies can use that's great and I'm sorry I don't remember if you mentioned it here but the whole that NIST 8286 is that something that's kind of a document that's kind of a source in a way yes yes I'm glad you mentioned that so when 8286 was being developed the COI was absolutely involved with NIST in terms of reviewing drafts getting previews of certain things so that we can weigh in as a community and try to see if NIST is clear enough in certain aspects because this is definitely a new area that they were wanting to put you know their position on and I would say the COI was instrumental in that entire series so there's 8286 the main publication and then there's part A through D and highly recommend it if either you're an ERM professional or a cyber professional it is definitely a very clear concise usable set of documents to start either your journey on this topic or get more best practices how to implement sample templates etc a lot of that is in the 8286 series so when it was released in my opinion it was a pivotal moment in the cyber ERM integration world two reasons one is NIST was putting their like I said their position on this is what we think integration would look like these are some best practices why is it best practice for agencies and other entities number two it is a way now for federal agencies like HHS to have a set of universal language universal agreed upon concepts of what really we mean when we say integrate your cyber and ERM what we mean when we say use risk registers I don't think there has been prior to this a deep discussion within any risk um next risk publication on cyber risk registers so a lot of the 8286 concepts were new and they were putting it out there as hey let's think about this and this is the way we should be going so that was a that was really an interesting and exciting time when it was really yeah I mean I love when uh when these things come out and finally finally get something you've been waiting for for a while and it's awesome that you all are uh you know you're even making it more concrete putting examples out there for what people can do so I mean this is real you know deliverables coming out of your community of interest so yeah thanks on behalf of a firm thanks for doing those things absolutely so that is fun it's fun work it's hard but it's fun work yeah the best stuff is always hard to do right so um well one last question for you uh you know so you guys have done all this so far you know sounds like two or three very productive years um what are some ERM emerging topics that kind of touch on cyber CISO world that you're interested in exploring more in the future so you know I'm going to mention artificial intelligence so there was no way that this podcast was going to end without mentioning AI right so at HHS definitely and all federal agencies um we are working through the requirements for executive orders on AI and on the cyber side we are making sure that we are working with our chief AI officer and those cyber considerations we want to make sure they are captured and essentially this is another good example of enterprise risk management because AI a lot of people may think that it's only a technology challenge but it's way beyond that it's making sure that it is either part of your risk portfolio or profile if it's not in there or proposing that it should be and having those discussions with within your ERM council your CISO council or any other governance structure that you have because as the executive order calls for we need safe secure and trustworthy AI and that's beyond cyber and it is inclusive of cyber so that's one thing that we are excited about at HHS and I would be willing to not mention um the recent release of the cyber security framework at the SS 2.0 by NIST it's very exciting that they came out with that um not too long of a couple of weeks suddenly and a lot of implementation opportunities there to continue integrating cyber into the ERM agency and I want to highlight that there is a new government function where I think most of our risk management outcomes you will find it there they still have the the usual identify protect uh refund and recover um functions but highlighting that there's a new government function where risk management lives yeah no that's definitely very pertinent topics um I mean my thing with AI I do feel that it's the next revolution just like the internet revolution the industrial revolution the iron age the stone age I mean this is huge our whole life is going to change very dramatically now with this I just yeah it's very obvious now more so than it was before I think so I don't think we'll ever stop talking about it not for the next you know 100 years but yeah so but I wish I had more time this has been great really fascinating hope you'll come back again in the future sometime um so thanks again yeah for joining us today thank you very much and I hope this was informative for your listeners absolutely all right and with that we will go ahead and sign off and then this is your host Paul Marshall and that was Risk Chats with Firm you you you