Cybersecurity Assessment Standardization

Context & Business Challenge

The cybersecurity assessment process for new applications entering the VA Electronic Health Record Modernization (EHRM) Program lacked a standardized workflow, creating variability in requirements, ownership, and delivery timelines. This created a clear process-improvement opportunity: establish a structured, repeatable approach that would make assessments more predictable and efficient while preserving the required cybersecurity rigor.

As new Security Technical Implementation Guides (STIGs) were released, expectations could shift during an active assessment, resulting in repeated rework and a cycle in which assessment criteria continued to shift before teams could reach closure.

I was asked to improve the consistency and predictability of the assessment process by helping establish a more structured, repeatable approach. The challenge was to accommodate evolving cybersecurity requirements without allowing every change to restart or indefinitely extend an active assessment, while still maintaining the rigor required for applications moving toward implementation.

Solution & Process Development

We established structured cybersecurity assessment types—such as net-new applications, capacity increases, and other applicable scenarios—along with defined entrance criteria so teams understood what had to be in place before an assessment could begin. As part of the standardized process, we also established completion and approval of a Security Assessment Plan (SAP) as a required step. The SAP for each assessment documented the applicable STIGs identified for the assets being assessed.

By defining the assessment type, entrance criteria, required documentation, and assessment steps at the outset, the standardized process created a common baseline for each assessment and reduced the ambiguity that had previously contributed to repeated rework and shifting expectations.

My Role & Leadership Actions

I specifically spearheaded development and implementation of the standardized process for net-new application assessments, bringing together stakeholders from Cerner, VA, and Leidos Partnership for Defense Health (LPDH) to establish common expectations around entrance criteria, task ownership, required security documentation, and response timelines for approval steps. I drove alignment on the process design, clarified ownership and decision points, and helped establish a repeatable operating model for net-new application assessments.

I also served as the Project Manager accountable end-to-end for six cybersecurity assessments, utilizing the newly documented process, each supporting a separate application being implemented within the EHRM Program. I drove each assessment through the established process, coordinating stakeholders, tracking requirements and dependencies, resolving issues, and maintaining progress through completion. Applying the standardized process across these assessments helped validate and refine it in practice while improving consistency and predictability without reducing cybersecurity rigor.

Results & Impact

The standardized process created a consistent and repeatable approach for net-new application cybersecurity assessments, reducing ambiguity around requirements, ownership, and expected turnaround times. Assessments that previously could extend unpredictably due to shifting requirements were now structured around a defined timeframe of approximately 60 calendar days.

The process became the required Program Standard for all net-new applications entering the EHRM Program and remains in use today. As teams gained experience with the process and execution became more practiced, typical assessment duration improved further to approximately 45 calendar days. The lasting impact of my work was a cybersecurity assessment process that became more predictable, more efficient, and sustainable at Program scale—with the process institutionalized as the required standard for all net-new applications across the EHRM Program.