Government · Operations & Workforce
Articles in this selection, newest first. Change the filters, or clear them to see every article.
18 articles · Government · Operations & Workforce
Articles
Week of 26 October 2026
OPM’s staffing-plan rule tucked a systems certification into a personnel regulation
OPM’s October 29 rule made workforce planning a quarterly data feed, moved the employee survey to agencies and had agency heads certify that their systems let HR leaders see the workforce. CIOs will carry much of it, on HR systems awaiting replacement.
Week of 21 September 2026
Agency certificates now expire faster than agency budgets turn over
On October 1, 2026, the first day of the federal fiscal year, the first full-term 200-day website certificates ran out. Agencies built to buy, staff and schedule them once a year had to rethink all three.
Week of 9 February 2026
What a second CISA lapse in five months asked state and local security teams to own
Homeland Security’s funding lapsed on February 14, and the nation’s cyber defense agency paused much of its help to states and localities for the second time in five months. Local leaders now had to decide which work to take on, buy or keep borrowing.
Week of 14 July 2025
An escort who cannot read the command is not a security control
ProPublica’s report on Microsoft’s “digital escorts” showed that a cloud authorization says little about who actually runs a system. Agencies need personnel terms they can test: who can touch the system, how that work is checked, and what evidence reaches them.
Week of 23 September 2024
Helene tested what continuity plans take for granted: staff, signal and signatures
Most continuity plans prepare for losing a building or a computer system. Hurricane Helene took away people, phone and internet service, and the officials who sign off on decisions, across a whole region at once. Each needs its own preparation, years ahead.
Week of 26 August 2024
Sea-Tac’s handwritten boarding passes were a staffing plan in disguise
Ransomware knocked out Port of Seattle systems, and the airport kept moving on paper and goodwill. “Revert to manual” turns out to be a promise about people: which work has a paper version, who does it, for how long, and who re-keys it afterward.
Week of 29 January 2024
Why CISA’s Ivanti disconnect order was decided by people, before it was issued
CISA gave federal agencies about two days to unplug and rebuild their Ivanti gateways. The steps were written down; people decided who made it: who could approve cutting staff off, who could rebuild the devices, and each agency’s place in a contractor’s queue.
Week of 25 September 2023
Shutdown plans counted people; agency systems depended on contracts and expiry dates
The shutdown averted on September 30, 2023 still made agencies write plans for a funding lapse. Those plans counted people. But agency technology also depended on how each contract was paid for, what would expire mid-lapse, and how systems would restart afterward.
Week of 14 August 2023
A weekend of public red-teaming showed agencies that AI testing never finishes
In August 2023, members of the public spent a weekend at DEF CON trying to make leading chatbots misbehave. It was a demonstration, not a certification. For agencies buying AI, testing is ongoing work before award, before deployment and in operation, limited by staff.
Week of 10 April 2023
Clearance, access and need-to-know: three controls the Discord leak pulled apart
A junior IT specialist with a valid top secret clearance shared secrets on Discord. He had the access but no need for the material. Why any organization holding sensitive data should treat access, monitoring and supervision as three separate jobs.
Week of 9 January 2023
A deleted file, a national ground stop, and the runbook nobody rehearsed
The FAA’s pilot-notice system failed in January 2023, and the easy story was an aging system. The trigger was routine database maintenance that damaged both the main copy and the backup. For agencies running old mission systems, procedure, people and recovery design come first.
Week of 29 August 2022
Why LAUSD could keep classrooms open through a ransomware attack
Days after ransomware hit its systems, the second-largest school district in the country opened its doors on schedule. It could, because teaching a class needs very few computers. The hard parts were resetting access for an enormous population and telling families what to do.
Week of 16 May 2022
Safe harbor for researchers, homework for system owners
The Justice Department’s promise not to charge good-faith security research made it more likely that outsiders would report flaws. For agencies, that created practical homework: a front door for reports, a route to whoever can fix the problem, and a way to close the loop.
Week of 13 December 2021
Kronos went down; the duty to pay public workers on time stayed up
In December 2021, ransomware knocked a cloud timekeeping service used by cities, transit agencies and public hospitals offline for weeks. The vendor had to rebuild its platform. Each employer still had to pay its people correctly, keep the time record and honor the law.
Week of 1 November 2021
Patch what attackers use: BOD 22-01 and the agency work queue
In November 2021, CISA stopped asking federal agencies to chase every scary-sounding flaw and handed them a short list of the ones attackers were actually using, with a deadline. The real story is what that did to patch teams, system owners and asset inventories.
Week of 23 August 2021
What the White House cyber summit’s training pledges left for agencies to fix
In August 2021, big companies pledged at the White House to train hundreds of thousands of people in cybersecurity. For public agencies, the talent shortage had three parts: supply, access and retention. The pledges tackled the first. Agencies held the keys to the other two.
Week of 23 November 2020
Three things a delayed federal transition moved at once
The late start to the 2020 presidential transition squeezed a huge handover of people and their system access, records and accounts, and programs already running. Each needs its own playbook, written by career staff long before any election.
Week of 3 February 2020
Iowa’s caucus app failed at rollout before it failed in code
The Iowa caucus app had a coding error, but the public failure came from a hard installation, untrained users and a backup phone line nobody had sized. Every agency launch carries the same three operational risks.