The GIST of Govt IT

Swish
  • 4.5 (2)
  • Government

The weekly show that breaks down ideas, innovations and decisions that cut through complexity and offer real insights from the intersection of technology and the mission. 

  1. 2d ago

    Protect the Internet! A Fed’s Guide to PQC Compliance

    Adversaries are collecting encrypted federal data today to decrypt tomorrow, and the deadline to stop them just got closer. With NIST's final IR 8547 out only days before recording, Brian and Sean go hosts-only to unpack what the post-quantum transition means for federal agencies. Sean walks through the deadlines set by NSM-10, Executive Order 14412, OMB M-26-15, and CNSA 2.0, from high-impact systems that must use quantum-resistant key exchange by 2030 to network gear that must be refreshed or retired by the same year. The good news is that much of the work is a configuration change, not a purchase, because many vendors are already run post-quantum cryptography by default. Then they get practical about what can break. Larger keys can spill across two packets, vendor implementations don't always interoperate, and failed handshakes surface as dropped sessions, which is why Sean argues the truth is always in the packets. He shares takeaways from the GIST360 breakfast briefing with CBP's Dr. Edward Mays and Cloudflare's Jeremy Corey, explains why crypto agility is the hidden payoff, and closes with a clear Monday-morning priority. Protect internet-facing applications and remote access first, because that traffic is the most likely to be harvested now and decrypted later. Resources Mentioned in This Episode Federal PQC Guidance and Deadlines •  NIST IR 8547, Transition to Post-Quantum Cryptography Standards (final, October 2026) •  OMB M-26-15, Execution of the Migration to Post-Quantum Cryptography   •  Executive Order 14412 and the accelerated deadlines for high-impact systems •  National Security Memorandum 10 (NSM-10) on quantum computing and vulnerable cryptographic systems   •  NSA Commercial National Security Algorithm Suite 2.0 (CNSA 2.0)   •  NIST Post-Quantum Cryptography project and FIPS 203, 204, and 205   •  CISA Post-Quantum Cryptography Initiative  The Migration Timeline Discussed •  Software and firmware signing, PQC exclusively by 2030 •  Traditional networking equipment, PQC preferred in 2026 and exclusive by 2030 •  High-impact systems, quantum-resistant key establishment by end of 2030 and digital signatures by 2031 •  Operating systems, PQC preferred in 2027 and exclusive by 2033 •  Web browsers, servers, and cloud services, PQC exclusive by 2033 •  Federal system deadline for full migration, 2035 Industry Perspectives •  Cloudflare, running post-quantum cryptography by default  •  CBP's push toward quantum readiness (MeriTalk) •  Cisco's PQC Capabilities  From the GIST360 PQC Breakfast Briefing •  Dr. Edward Mays, Deputy Assistant Commissioner, U.S. Customs and Border Protection •  Jeremy Corey, Public Sector Solutions Engineer, Cloudflare •  Recap Blog •  Use commercial services that already support PQC for public-facing apps and remote users •  Key exchange is mature, while digital signatures, authentication, and private DNS are still catching up •  Crypto agility is the long-term payoff of the migration The Monday-Morning Takeaways (Sean Applegate) •  Share NIST IR 8547 with the team and make sure everyone reads it •  Confirm the inventory covers internet-facing systems and internet-heavy users •  Turn on PQC for public-facing apps at the CDN, WAF, or application delivery layer •  Turn on PQC for zero trust remote access and VPNs The Hosts and Show •  Swish •  GIST 360 Program CONNECT WITH US Got an idea for a future episode? Want to be a guest? Let us know. Brian Lake - blake@swishdata.com Sean Applegate - sapplegate@swishdata.com Subscribe wherever you get your podcasts: Apple Podcasts, Spotify, or gist360.com.

    Protect the Internet! A Fed’s Guide to PQC Compliance

  2. Oct 26

    Why a Former DHS CISO Never Wasted a Good Crisis

    Kenneth Bible walked into the DHS CISO job on January 3, 2021, with the agency still reeling from the SolarWinds hack. Now a board member at Crytica Security, the former DHS CISO and Marine Corps CIO joins the show to trace a career that started on nuclear submarines at the Charleston Naval Shipyard and ran through the NMCI transition to NGEN. He explains why governance, not technology, was the real fix after SolarWinds, how a Unified Cybersecurity Maturity Model helped 13 component CISOs prioritize roughly a billion dollars in requests, and why he pushed NIST to wrap governance around the entire Cybersecurity Framework rather than bolt it on as another pillar. Then the conversation turns to the attack surface nobody owns. Ken makes the case that operational technology has become the adversary's preferred target, from port cranes and water meters to LNG tankers and a grid that spent four hours rebalancing after a single Northern Virginia data center dropped its AI load. He explains why a 600MB EDR agent will never fit on an 8MB PLC, why IT and OT teams still don't talk, and what it takes to bring OT risk to the board. Resources Mentioned in This Episode Featured Guest •  Kenneth Bible, Board Member, Crytica Security, and former CISO, U.S. Department of Homeland Security •  Crytica Security  •  Crytica announcement of Ken joining its board   SolarWinds and Federal Cyber Governance •  Executive Order 14028, Improving the Nation's Cybersecurity  •  NIST Cybersecurity Framework 2.0  •  CISA Known Exploited Vulnerabilities (KEV) Catalog •  CISA Software Bill of Materials (SBOM) •  CISA Binding Operational Directive 26-02 •  NIST SP 800-171 •  Committee on National Security Systems (CNSS) OT and Critical Infrastructure Security •  CISA advisory on Volt Typhoon targeting U.S. critical infrastructure   •  NIST SP 800-82, Guide to Operational Technology Security •  CISA Industrial Control Systems resources  •  WaterISAC •  National Council of ISACs •  National Rural Water Association •  DEF CON Franklin volunteers helping small water utilities Recommended Reading •  The High-Velocity Edge, by Steven Spear •  Wiring the Winning Organization, by Gene Kim and Steven Spear The Monday-Morning Takeaways (Ken Bible) •  Take care of the people, because they take care of the mission •  Build relationships with OT owners to expose blind spots, and help rather than dictate •  Have the conversation up the chain, with the risk, the plan, and the result Related Episodes •  Episode 7  |  When IT meets OT, with Matthew Shelbetter of Armis •  Episode 5  |  GRU router hacking, Iranian PLC attacks, and Project Glasswing The Hosts and Show •  Swish •  GIST 360 Program CONNECT WITH US Got an idea for a future episode? Want to be a guest? Let us know. Brian Lake - blake@swishdata.com Sean Applegate - sapplegate@swishdata.com Subscribe wherever you get your podcasts: Apple Podcasts, Spotify, or gist360.com.

    Why a Former DHS CISO Never Wasted a Good Crisis

  3. Oct 19

    Mission Executive: Insights from a Six-Time Federal CIO

    Six federal CIO roles, and every one of them secured by an intentional process, hard work, and homework. Brian and Sean sit down with Dr. Barry West, founder of West Wing Advisory Services and program chairman of the Government Business Executive Forum, who led IT at the National Weather Service, at FEMA through Hurricane Katrina, at the Department of Commerce, and at PBGC. Barry traces a path from Air Force weather observer to technical lead on FirstGov, the site that became USA.gov, and explains why today's CIO has to operate as a mission executive who turns business requirements into outcomes while managing risk. The conversation gets practical fast. Barry lays out the six attributes every CIO needs, the reality check executives face when they move to industry and have to flip the switch, and why a GS-15 chasing SES should attack the job like a capture plan, with ECQs, metrics, GAO reports, and strategic plans studied cold. Sean shares mentorship stories from CBP and the FBI, and all three make the case for associations, a plan B and plan C, health, and financial planning at every stage of a career. Plus, the band that gets the lead out. Resources Mentioned in This Episode Featured Guest •  Dr. Barry West, Founder and President, West Wing Advisory Services •  West Wing Advisory Services •  Government Business Executive Forum (GBEF) •  Homeland Security and Defense Forum Where Barry Served •  National Weather Service   •  Federal Emergency Management Agency (FEMA)   •  U.S. Department of Commerce •  Pension Benefit Guaranty Corporation (PBGC) •  U.S. Census Bureau •  National Technical Information Service (NTIS) •  USA.gov, launched as FirstGov with Barry as technical lead Associations and Communities •  ACT-IAC, formerly FGIPC, which Barry led as president •  AFFIRM, where Barry is a past president •  AFCEA International and Young AFCEANs •  AFCEA Bethesda Chapter •  ATARC •  Partnership for Public Service Career Development and the Path to SES •  OPM Executive Core Qualifications (ECQs) Barry's Six Attributes of the Modern CIO •  Strategist •  Technologist, including cyber, AI, and LLMs •  Builder of business alliances across the mission •  Talent manager •  Lifelong learner •  Communicator who can brief in two minutes, not 40 pages Also Mentioned •  Get the Lead Out! The Hosts and Show •  Swish •  GIST360 Program    CONNECT WITH US Got an idea for a future episode? Want to be a guest? Let us know. Brian Lake - blake@swishdata.com Sean Applegate - sapplegate@swishdata.com Subscribe wherever you get your podcasts: Apple Podcasts, Spotify, or gist360.com.

    Mission Executive: Insights from a Six-Time Federal CIO

  4. Oct 13

    If You're Not First, You're Last: A Former Govt. CTO's Perspective

    Steve Wallace spent 15 years at DISA, seven and a half of them as CTO, building some of the largest IT programs the Department has ever attempted. Now 130 days into his role as Public Sector CTO at F5, Steve joins Brian and Sean to share what those programs taught him. He walks through scaling DoD Enterprise Email to 1.8 million users before Office 365 existed, why a design only succeeds if operations can run it, and how a borrowed Lotus philosophy shaped his approach to systems engineering. Simpler systems are easier to troubleshoot, easier to operate, and far easier to defend because adversaries have fewer folds to hide in. That lesson drove the move from the Joint Regional Security Stack, with 20-plus vendors and a print job that traveled hundreds of miles to reach a printer down the hall, to Thunderdome, a zero trust architecture whose name came from the idea that two solutions enter and one leaves. The conversation turns to cutting through AI hype the same way Steve once cut through blockchain and zero trust washing. He warns that the rush to deploy AI echoes the late-1990s scramble to install antivirus after the fact, and he flags API security as the screen door on the side of a house with a bolted front door. Steve and Sean dig into F5's acquisition of CalypsoAI, agentic red teaming that adapts its attacks in real time, why guardrails are never fire and forget, and how distillation puts fine-tuned agency knowledge at risk. Plus why the token party is over, the danger of cognitive surrender, and Steve's Monday-morning creed of delivering for people on the worst day of their lives, holding teams accountable, spending taxpayer dollars wisely, and never letting the adversary win on his watch. ______________ Resources Mentioned in This Episode Featured Guest •  Steve Wallace, Public Sector CTO, F5, and former CTO, Defense Information Systems Agency •  F5 Public Sector  DISA and DOD Programs •  Defense Information Systems Agency (DISA)   •  DoD Zero Trust Strategy and Reference Architecture   •  DISA THUNDERDOME AI Security and Guardrails •  F5 acquisition of CalypsoAI (AI guardrails and red teaming)   •  CalypsoAI CASI leaderboard, a monthly security ranking of AI models   •  OWASP Top 10 for LLM Applications   •  MITRE ATLAS, the adversarial threat landscape for AI systems   •  Cognitive surrender and over-reliance on AI outputs The Monday-Morning Takeaways (Steve Wallace) •  Deliver for the people having the worst day of their lives •  Equip the team, and hold the team accountable •  Spend taxpayer dollars as efficiently as possible •  Never let the adversary win on your watch Also Mentioned •  Ricky Bobby - If You Aint First, You're Last •  James Dalton - Pain Don't Hurt •  Simplify and then Add Lightness - Lotus Motorsports  The Hosts and Show •  Swish  •  GIST360 Program  CONNECT WITH US Got an idea for a future episode? Want to be a guest? Let us know. Brian Lake - blake@swishdata.com Sean Applegate - sapplegate@swishdata.com Subscribe wherever you get your podcasts: Apple Podcasts, Spotify, or gist360.com.

    If You're Not First, You're Last: A Former Govt. CTO's Perspective

  5. Sep 29

    A Wrap on FY26: Trading Disruption for Execution

    In this season finale, Brian and Sean look back on a year that traded disruption for execution. Sean breaks down the wave of end-of-year infrastructure buys as CIOs finally funded the routers, switches, and Wi-Fi that leadership rarely sees but every AI agent, sensor, and data feed depends on. The conversation covers more legacy modernization in one year than in the past decade, OT security surging to the top of CISO agendas after real attacks on water and energy systems, and a reskilling wave that reached all the way to two-star generals writing their own agents. Brian and Sean also walk through the four seats shaping FY27 and a preview of Season Two's first guests.  The Hosts and Show •  Swish  •  GIST360 Program  CONNECT WITH US Got an idea for a future episode? Want to be a guest? Let us know. Brian Lake - blake@swishdata.com Sean Applegate - sapplegate@swishdata.com Subscribe wherever you get your podcasts: Apple Podcasts, Spotify, or gist360.com.

    A Wrap on FY26: Trading Disruption for Execution

  6. Sep 14

    Security Compliance Checklists vs. Commander's Intent

    The government is great at security governance — but that isn't the same as being secure. In Episode 18 of The GIST of Govt IT, Brian and Sean sit down with Ian Kelly of Cloudflare, a self-described liberal arts major turned 15-year Google veteran turned public-sector technologist, to talk about closing the gap between the checkbox and the outcome. The conversation digs into why the exploit window has collapsed from weeks to roughly five minutes, the pivot from point-in-time compliance to continuous, risk-based security,  and AI governance before the horse leaves the barn. Sean and Ian also get into edge compute, the CBP conversational video bot built for the FIFA games, infrastructure as code for repeatable accreditation, and the emerging discipline of AEO — optimizing content so agents, not just humans, can use it. Plus, Cloudflare's FedRAMP High authorization and IL4 intentions, a wall of lava lamps as a cryptographic entropy source, and three Monday-morning takeaways, not to mention KatEye makes an appearance.  Resources Mentioned in This Episode Featured Guest •  Ian Kelly, Senior Director of Solutions Engineering, Cloudflare Public Sector •  Cloudflare Public Sector •  Cloudflare FedRAMP High authorization announcement Cloudflare Capabilities Discussed •  Cloudflare Edge Compute •  Cloudflare AI Gateway (visibility, governance, cost control) •  Cloudflare SASE / Zero Trust •  Cloudflare's LavaRand entropy wall (true randomness) Compliance, Standards & Frameworks •  FIPS 140-3 validated cryptography •  FIPS 203 and NIST post-quantum cryptography Also Mentioned •  KATSEYE   •  Military Grade Metal Podcast Related Content  •  GIST360 Webinar: Rethinking Command and Control Resiliency at the Edge   The Hosts & Show •  Swish  •  GIST 360 CONNECT WITH US Got an idea for a future episode? Want to be a guest? Let us know. Brian Lake - blake@swishdata.com Sean Applegate - sapplegate@swishdata.com Subscribe wherever you get your podcasts: Apple Podcasts, Spotify, or gist360.com.

    Security Compliance Checklists vs. Commander's Intent

  7. Aug 31

    The LRA is Here and the Clock is Ticking!

    It's here. On August 20, CISA dropped the Logging Reference Architecture (LRA) a practitioner's guide that operationalizes OMB M-26-14 and the countdown just got real. In this episode of The GIST of Govt IT, Brian and Sean break down the aggressive timeline it sets: agencies have 90 days to inventory their environment and submit a plan in Cyberscope (the week before Thanksgiving), then about 30 more to hit Baseline 1 maturity (the week before Christmas). Surprisingly, or not, Sean's read is refreshingly positive, this guide was written by practitioners for practitioners, with concrete advice, outcome-focused questions to ask your teams, and clear thresholds: 70% of assets inventoried, 50% logging coverage, 50% actionable alerts, six-month retention. The conversation digs into why IoT and OT are the hard part (segmented networks, third-party-managed devices, systems you can't actively scan), why the LRA deliberately doesn't mandate AI, and a practical path forward: assign a single LRA owner, reconcile your CMDB against your property book, deploy passive OT listening kits rather than scanning fragile systems, and use end-of-fiscal-year funds now to close gaps you can't fill over the holidays. The clock is ticking and agencies are going to have to build the airplane while they fly.  Resources Mentioned in This Episode The Core Documents •  CISA Logging Reference Architecture (LRA), released August 20 •  OMB M-26-14 (the logging mandate the LRA operationalizes) •  CyberScope (where agencies submit their plans) The Baseline 1 Thresholds •  Inventory visibility: 70% of assets captured in a centralized inventory •  Collection coverage: 50% of inventoried assets logging •  Collection operations: 50% of logs producing actionable alerts •  Data retention: minimum six months (per M-26-14; the LRA guide notes a slightly different figure) •  Timeline: plan ~Nov 18, Baseline 1 ~mid-December Frameworks & Technical References •  MITRE ATT&CK (adversary behavior models) •  CISA Zero Trust Maturity Model •  NIST SP 800-92 (log management guidance) The Threat Backdrop •  DOJ/FBI seizure of Chinese state-sponsored hacking infrastructure (August 26) •  CISA advisory on edge-device compromise and lateral movement •  Anthropic and OpenAI on the narrowing window to defend against AI cyber threats From Swish / GIST 360 •  Swish LRA planning assessmen  •  “When the Perimeter Disappears” breakfast briefing recap Related Episodes •  Episode 13: Fed Christmas in July? The OMB M-26-14 Holiday Rush Begins! •  Episode 15: Billion Dollar Pilots and Boil Water Notices: Securing OT Environments •  Episode 7: Iran Came for the Dams and We Got Lucky: Frontline Insights into the OT Fight The Hosts & Show •  Swish •  GIST 360 CONNECT WITH US Got an idea for a future episode? Want to be a guest? Let us know. Brian Lake - blake@swishdata.com Sean Applegate - sapplegate@swishdata.com Subscribe wherever you get your podcasts: Apple Podcasts, Spotify, or gist360.com.

    The LRA is Here and the Clock is Ticking!

  8. Aug 24

    Federal AI Wants to Fly but Data Weighs it Down

    Somewhere between 60% and 80% of federal AI projects have stalled out and the common denominator almost always traces back to the data. In Episode 16 of The GIST of Govt IT, Brian and Sean sit down with Matt Lawson, Director of Solution Engineering for NetApp Federal, to unpack what it actually takes to build a data foundation that lets AI succeed. Matt's thesis is that projects keep stalling because teams can't get the right data, in the right place, at the right cost. The conversation digs into data gravity (you can't move petabytes overnight, and you can't beat the speed of light), the take-the-data-to-the-model vs. bring-the-model-to-the-data debate (answer: you need both), and the copy-of-a-copy sprawl that quietly wrecks both budgets and data authority. Matt walks through ideas that change the math, and the guys close out on post-quantum cryptography and why “harvest now, decrypt later” makes it a today problem, not a tomorrow problem. Plus Matt on why he always chooses the blue pill. Featured Guest •  Matt Lawson, Director of Solution Engineering, NetApp Federal •  NetApp Public Sector The “Why AI Projects Fail” Data •  The concept of data gravity AI, RAG & Partners •  Retrieval-Augmented Generation (RAG) explained •  Apache Kafka (real-time event streaming) Post-Quantum Cryptography •  NIST Post-Quantum Cryptography Standards (FIPS 203/204/205) •  OMB M-23-02 (migrating to post-quantum cryptography) The Monday-Morning Playbook (Matt Lawson) •  1. Catalog your data — know what data sets you actually have •  2. Plan for a federated environment — data will live in many places, some not even yours •  3. Design for security from day one — immutability, ransomware recovery, and PQC can't be bolted on later Related Episodes •  Episode 9: Quad Charts Be Damned: Data Meets the Mission Upcoming Event •  GIST 360 Breakfast Briefing with NetApp — Washington, DC, November 10 The Hosts & Show •  Swish  •  GIST 360 Program CONNECT WITH US Got an idea for a future episode? Want to be a guest? Let us know. Brian Lake - blake@swishdata.com Sean Applegate - sapplegate@swishdata.com Subscribe wherever you get your podcasts: Apple Podcasts, Spotify, or gist360.com.

    Federal AI Wants to Fly but Data Weighs it Down
See All (23)

Ratings & Reviews

4.5
out of 5
2 Ratings

About

The weekly show that breaks down ideas, innovations and decisions that cut through complexity and offer real insights from the intersection of technology and the mission. 

Information

  • Creator
    Swish
  • Years Active
    2026
  • Episodes
    23
  • Rating
    Clean
  • Copyright
    © 2026 The GIST of Govt IT
  • Show Website
    The GIST of Govt IT

You Might Also Like