AgendaPublic Sector Day 2022

Chris DeRusha currently serves as the Federal Chief Information Security Officer in the Office of Management and Budget (OMB) and Deputy National Cyber Director for Federal Cybersecurity in the Office of the National Cyber Director (ONCD). He was most recently the Chief Information Security Officer for the Biden-Harris campaign. Prior to joining the campaign in June 2020, he served as the Chief Security Officer for the State of Michigan. DeRusha has extensive experience managing cybersecurity and critical infrastructure programs and operations both in the public and private sectors. DeRusha led Ford Motor Company's Enterprise Vulnerability Management program and has over eight years of Federal Government experience working both at the Office of Management and Budget and the U.S. Department of Homeland Security. He holds a Master's Degree in Security Studies from Columbia University and a Bachelor's Degree in Business Administration from James Madison University.

Government organizations increasingly rely on third parties to help support operations, their employees and in many cases the public they serve. While it is possible to outsource many activities to third parties, organizations retain the risks associated with their third-party relationships. This session will focus on why organizations need to deeply understand the risks third-party providers present and why its critically important to have impactful controls in place in order to manage risk within acceptable boundaries.

With the constant change in technology and the rising cyber threats, government organizations struggle to understand and translate cyber risks into the context of risk. Organizations can be overwhelmed by the magnitude, velocity and complexity of existing and emerging cyber risks. This session will focus on the challenges and yet opportunities government organizations have to determine assets critical to operations, ability to obtain and leverage actionable information, establish and communicate security policies and standards, detect and respond to attacks, identify and remediate security deficiencies, and establish clear IT risk management best practices.

A successful resiliency program aligns your impact analysis, continuity planning, IT disaster recovery planning, crisis management and incident response activities with your organization's broader business strategy and objectives. Resiliency requires building processes and technologies that naturally adapt to adverse conditions, make mid-course corrections, and avoid many of the negative impacts of a disruption. This session will focus on how an organizations resiliency can positively impact its overall operational risk.