How Veterans Affairs CISO Approaches Risk, Recruiting Talent and Proving Cyber's Business Value

Paul Cunningham sees some similarities between his first stint in government service—flying helicopters  as a lieutenant commander for the U.S. Navy—and his current role as chief information security officer at the Veterans Affairs Department.

“Risk management—from the aviation and cybersecurity perspectives—are pretty important,” Cunningham told Nextgov, speaking from his office at VA’s headquarters in Washington, D.C. “You want to drive down risk to as close to zero as you can.”

At an enterprise as large as VA, eliminating risk entirely is impossible because it’s simply too big. VA currently employs some 404,000 people across 170 hospitals, 1,200 clinics and 130 cemeteries across more than 25,000 acres of property. VA manages the largest medical network in the country—providing care to approximately 10 million veterans annually—and each year processes about $120 billion in financial transactions. VA’s Office of Information Technology alone is comprised of several thousand federal IT professionals, managing programs and overseeing networks across the country.

“If we were a private-sector company, we’d be in the Fortune 10 or Fortune 5, on par with companies like that,” Cunningham said. “We’ve got to start thinking like a business in those kinds of numbers alone. We want to show cyber has a business value.”

That’s where risk management comes into play. In government, you want to spend the money you’re budgeted, and a common sense approach to risk management helps a CISO determine where best to obligate funding.

“If we have one more dollar to spend, do we spend it on training employees on phishing scams or invest it in our firewall?” Cunningham said. In IT security decision-making, Cunningham said you first acknowledge risk and either accept it at face value, attempt to mitigate that risk or add value to the accepted risk. Decisions on whether to implement new technologies like artificial intelligence or internet-of-things medical devices, are weighed against other factors, such as total cost of ownership, security risks and potential returns on investment.

Cunningham became VA’s CISO in January 2019, having served in the same capacity at the Energy Department for 7 years and more than a year as a branch director for the U.S. Immigrations and Customs Enforcement. The stakes at VA are high, he said, because millions of veterans depend on the agency for health care, support, small business loans, education services, disability benefits and other services. Cunningham, a veteran himself—along with approximately 60% of VA OIT’s staff—said veterans sacrificed a lot to earth those rights and services, and their experience receiving those services should be as seamless as possible.

Yet delivering quality, timely services to veterans requires a bit of a balancing act. VA, like all agencies, has to comply with numerous federal laws, regulations—and as of late—an increasing number of binding operational directives from the Homeland Security Department. Cunningham called DHS “first among many” in terms of cybersecurity partner agencies across civilian government. It’s at this three-way intersection of compliance, cybersecurity and customer experience where Cunningham really earns his paychecks.

“When I look at it, it’s the balance of how quick we can serve veterans and reduce their burden, but what are the things we have to do to meet our federal requirements and what makes sound sense,” Cunningham said. “We still do compliance chasing, but we’re putting measures and metrics on priorities. Our job is to service the veterans. If we’re not looking at that first, then we’re probably missing the mark.”

For all the talk of silos in government, VA’s executives work closely with each other and meet often. In matters of IT and cybersecurity, the CIO and deputy CIO steer the rudders, while C-suite executives meet at least weekly to address governance matters on issues like architecture, finance, requirements and acquisition. The governance board meetings also serve as a time to get buy-in on potential solutions, and for executives to address big-mission items.

The biggest right now is VA’s transition to a new electronic health records system designed to be interoperable with the Pentagon’s electronic health records system. The multibillion-dollar Cerner Millennium platform, originally scheduled for a March launch, was delayed last month to July after clinicians asked to be trained on a full version of the system.

Cunningham said VA wants to learn from the challenges the Defense Department experienced rolling out their health records system “to help us slingshot” to their own successful rollout. While executives from both agencies are partnering together to ensure interoperability between both systems, Cunningham said the partnership will extend into the digital realm, sharing threat indicators and having the “full force of DOD protecting our network as well.”

On the horizon, Cunningham foresees the government’s tech workforce challenge as a major obstacle. Technology, he said, “is moving faster than the budget cycle can support,” and it is becoming increasingly difficult to recruit tech talent to the government ranks. Data from the Office of Personnel Management suggests VA is among the most challenged agencies when it comes to recruiting young tech talent. There may be no singular solution to this challenge, but Cunningham said increased partnership with the private sector—creating a sort of revolving door where techies move in and out of government with relative ease—may improve the government’s outlook.

“We’ve got to look at where we can partner with the private sector, for them to train people who can feed our machine and our people can feed back out in a more porous manner, so people don’t feel like they’re taking a big hit,” Cunningham said, noting the salary discrepancy between private and public sectors. “If you’re young and want hands-on experience, getting in the federal space is one way to do it.”

Cunningham also stressed the importance of role-based cyber training. Every employee, Cunningham said, has to be trained to be cyber and privacy warriors, but a standard one-size-fits-all cyber training isn’t enough. Employees require training relevant to their specific duties, and VA organizes a variety of summits and campaigns to “keep it at the forefront.”

“We’re trying to teach them habits that empower them without distracting from their jobs,” Cunningham said.

For aspiring CISOs, Cunningham recommends rounding out those resumes. A variety of career experiences is typically better suited for a CISO role than someone who has been in a singular role, Cunningham said. Further, while technical chops are great, they are not necessarily required for a policy-heavy role.

“For someone who wants to be a CISO, go read a job description and see what you can’t answer well, and then move your career to fill in those voids,” Cunningham said.