46 articles · Operations & Workforce · page 2 of 3
Articles
Week of 3 July 2023
Before the bias audit, the inventory: what New York City’s hiring-tool law asked of employers
New York City’s hiring-tool law made bias audits the headline. For banks, insurers and asset managers hiring in the city, the harder first step was finding every tool that scores candidates, deciding which were covered, and naming an owner for each.
Week of 8 May 2023
After the emergency, telehealth’s rules landed on clinicians one deadline at a time
The COVID-19 emergency ended in May 2023, and telehealth’s pandemic flexibilities unwound on schedules set separately by Congress, the DEA, OCR and the states, each landing on a different workforce question: what clinicians may prescribe remotely, where they may practice, which tools they may use.
Week of 10 April 2023
Clearance, access and need-to-know: three controls the Discord leak pulled apart
A junior IT specialist with a valid top secret clearance shared secrets on Discord. He had the access but no need for the material. Why any organization holding sensitive data should treat access, monitoring and supervision as three separate jobs.
Week of 9 January 2023
A deleted file, a national ground stop, and the runbook nobody rehearsed
The FAA’s pilot-notice system failed in January 2023, and the easy story was an aging system. The trigger was routine database maintenance that damaged both the main copy and the backup. For agencies running old mission systems, procedure, people and recovery design come first.
Week of 12 December 2022
FTX’s favored account was a setting in the code, and banks have settings too
The FTX charges described control failures regulated firms believe they solved long ago. What made them possible was a small engineering group able to change how the platform treated one account. Banks and broker-dealers now run many of their own controls the same way.
Week of 26 September 2022
Recordkeeping fails where the approved channel is slower than a text
In 2022 regulators fined major Wall Street firms over business texts sent from personal phones. The rules were old and the tools existed. People simply chose the faster channel, and fixing that took better apps, real supervision and proof that capture works.
Week of 29 August 2022
Why LAUSD could keep classrooms open through a ransomware attack
Days after ransomware hit its systems, the second-largest school district in the country opened its doors on schedule. It could, because teaching a class needs very few computers. The hard parts were resetting access for an enormous population and telling families what to do.
Week of 30 May 2022
No patch yet: Follina and Confluence tested who may switch things off
Two security holes were being exploited before any fix existed, leaving health systems with workarounds only. What decided the outcome was organizational: who could authorize switching something off, who could actually do it everywhere, and who checked that it worked.
Week of 16 May 2022
Safe harbor for researchers, homework for system owners
The Justice Department’s promise not to charge good-faith security research made it more likely that outsiders would report flaws. For agencies, that created practical homework: a front door for reports, a route to whoever can fix the problem, and a way to close the loop.
Week of 28 March 2022
Spring4Shell rewarded hospitals that could size a response in hours
Four months after Log4Shell, a Java flaw with a similar nickname set off fresh alarm, and early reports mixed it up with another bug. Its narrow conditions tested whether tired hospital IT teams could size a response in hours.
Week of 21 February 2022
Shields Up had no end date, so vigilance needed a staffing plan
Russia’s invasion of Ukraine brought a request from CISA for every US organization to raise its guard, with no date to lower it. Staying alert for months turned out to be a management problem: who watches, who decides, and what work stops.
Week of 13 December 2021
Kronos went down; the duty to pay public workers on time stayed up
In December 2021, ransomware knocked a cloud timekeeping service used by cities, transit agencies and public hospitals offline for weeks. The vendor had to rebuild its platform. Each employer still had to pay its people correctly, keep the time record and honor the law.
Week of 22 November 2021
Omicron’s scarcest resource was staff, and few hospitals could count them in real time
When Omicron arrived in late November 2021, hospitals braced for a flood of patients. What actually ran out that winter was staff able to work, and every hard decision hinged on how fast leaders could piece together who was available from scattered systems.
Week of 1 November 2021
Patch what attackers use: BOD 22-01 and the agency work queue
In November 2021, CISA stopped asking federal agencies to chase every scary-sounding flaw and handed them a short list of the ones attackers were actually using, with a deadline. The real story is what that did to patch teams, system owners and asset inventories.
Week of 6 September 2021
Vaccination status was the easy record; exemptions were the hard one
President Biden’s September 2021 vaccination plan sent employers scrambling to collect proof. It demanded three things: status records, weekly testing and exemption decisions. The third carried the lasting legal risk, and most organizations built it last and least.
Week of 23 August 2021
What the White House cyber summit’s training pledges left for agencies to fix
In August 2021, big companies pledged at the White House to train hundreds of thousands of people in cybersecurity. For public agencies, the talent shortage had three parts: supply, access and retention. The pledges tackled the first. Agencies held the keys to the other two.
Week of 14 June 2021
Juneteenth tested how many calendars a bank really runs
Juneteenth became a federal holiday with one day’s notice in June 2021. For banks and credit unions, it revealed something surprising: a “business day” is defined in three places, the payment rails, customer commitments and the workforce, usually owned by three different teams.
Week of 3 May 2021
Four weeks on paper: what Scripps exposed about downtime plans
After a ransomware attack, Scripps Health spent most of May 2021 without its electronic health record. Downtime plans written for hours failed over weeks on three separate fronts: keeping care safe, keeping revenue flowing and keeping staff going.
Week of 15 February 2021
Why working from home failed when Texas froze
A year into the pandemic, many continuity plans answered every site outage with “work from home.” Winter Storm Uri took out power, water, roads and home internet together, showing that one fallback fails when people, sites, networks and suppliers all fail at once.
Week of 23 November 2020
Three things a delayed federal transition moved at once
The late start to the 2020 presidential transition squeezed a huge handover of people and their system access, records and accounts, and programs already running. Each needs its own playbook, written by career staff long before any election.