Insights · Looking Back

Operations & Workforce

The Looking Back articles seen through operations & workforce, across every sector, in order.

45 articles

February 2020

  1. Week of 3 February 2020

    Iowa’s caucus app failed at rollout before it failed in code

    The Iowa Democratic caucus app had a coding error, but the public failure came from hard installation, untrained users and a fallback phone line nobody had sized. Every agency launch carries the same three operational risks.

    • Government
    • Operations & Workforce
    • 5 min read
  2. Week of 24 February 2020

    Buildings intact, workforce gone: the scenario continuity plans skipped

    As markets fell and federal health officials warned of community spread, most continuity plans still assumed the loss of a building. A pandemic removes people, suppliers and remote capacity at once, and plans had to be rebuilt and tested around those three losses.

    • Cross-sector
    • Operations & Workforce
    • 5 min read

April 2020

  1. Week of 6 April 2020

    Paycheck Protection: capital was easy, intake was hard

    When the Paycheck Protection Program opened on April 3, 2020, the guarantee and the Fed facility solved funding. Lenders’ capacity was set instead by intake, verification and submission to SBA, and by how fast they could redeploy staff into a standardized process.

    • Financial Services
    • Operations & Workforce
    • 5 min read

July 2020

  1. Week of 27 July 2020

    Lifespan’s stolen laptop and the home office risk analyses missed

    OCR’s July 2020 settlement with Lifespan turned on an unencrypted laptop, a weak device inventory and missing agreements. It landed as health care’s administrative staff settled in at home, where HIPAA risk analyses written for hospital buildings had not followed them.

    • Healthcare
    • Operations & Workforce
    • 5 min read

September 2020

  1. Week of 21 September 2020

    What a nationwide EHR outage at UHS asked of nurses and unit leaders

    When Universal Health Services lost systems across its network in September 2020, the downtime binder mattered less than whether staff trained on electronic records could run a unit on paper for days, and then put it all back.

    • Healthcare
    • Operations & Workforce
    • 5 min read

October 2020

  1. Week of 12 October 2020

    Why one phone call beat Twitter’s login controls

    New York’s report on the Twitter hack described a phone call and a fake login page, not an exploit. With staff dispersed, the people who verify callers and reset credentials were a control most organizations had never designed, staffed or measured as one.

    • Cross-sector
    • Operations & Workforce
    • 5 min read

November 2020

  1. Week of 23 November 2020

    Three things a delayed federal transition moved at once

    The late start to the 2020 presidential transition compressed a process that moves people and their access, records and accounts, and programs already in flight. Each needs its own runbook, prepared by career staff long before any election.

    • Government
    • Operations & Workforce
    • 5 min read

February 2021

  1. Week of 15 February 2021

    Why working from home failed when Texas froze

    A year into the pandemic, many continuity plans answered every site outage with remote work. Winter Storm Uri removed power, water, roads and home connectivity together, showing that a single fallback fails when failures are correlated across people, sites, networks and suppliers.

    • Cross-sector
    • Operations & Workforce
    • 5 min read

May 2021

  1. Week of 3 May 2021

    Four weeks on paper: what Scripps exposed about downtime plans

    Scripps Health spent most of May 2021 without its electronic health record after a ransomware attack. Downtime plans written for hours failed over weeks on three separate fronts: clinical continuity, revenue continuity and workforce endurance.

    • Healthcare
    • Operations & Workforce
    • 5 min read

June 2021

  1. Week of 14 June 2021

    Juneteenth tested how many calendars a bank really runs

    Juneteenth became a federal holiday with one day’s notice in June 2021. For banks and credit unions, it showed that a business day is defined in three places, payment rails, customer commitments and the workforce, usually owned by different teams.

    • Financial Services
    • Operations & Workforce
    • 5 min read

August 2021

  1. Week of 23 August 2021

    What the White House cyber summit’s training pledges left for agencies to fix

    Companies at the August 2021 White House cyber summit pledged to train hundreds of thousands of people. For public agencies, the shortage had three parts: supply, access and retention. Pledges addressed the first, while agencies held the levers for the other two.

    • Government
    • Operations & Workforce
    • 5 min read

September 2021

  1. Week of 6 September 2021

    Vaccination status was the easy record; exemptions were the hard one

    Biden’s September 2021 vaccination plan sent employers scrambling to collect proof. Of the three capabilities it demanded, status records, weekly testing and exemption decisions, the third carried the lasting legal risk and was the one most organizations under-built.

    • Cross-sector
    • Operations & Workforce
    • 5 min read

November 2021

  1. Week of 1 November 2021

    Patch what attackers use: BOD 22-01 and the agency work queue

    CISA’s Binding Operational Directive 22-01 replaced severity scores with a short, evidence-based list and a federal deadline. Its biggest effect was on how agency patch teams spent their week, argued with system owners, and exposed weak asset inventories.

    • Government
    • Operations & Workforce
    • 5 min read
  2. Week of 22 November 2021

    Omicron’s scarcest resource was staff, and few hospitals could count them in real time

    When WHO named Omicron a variant of concern in late November 2021, hospitals braced for patients. The binding constraint that winter was staff able to work, and the speed of every decision depended on joining data scattered across HR, scheduling and occupational health.

    • Healthcare
    • Operations & Workforce
    • 5 min read

December 2021

  1. Week of 13 December 2021

    Kronos went down; the duty to pay public workers on time stayed up

    When ransomware took a widely used cloud timekeeping service offline in December 2021, cities, transit agencies and public hospitals still had to pay shift workers correctly. The vendor owned the platform. The employer kept the paycheck, the time record and the legal duty.

    • Government
    • Operations & Workforce
    • 5 min read

February 2022

  1. Week of 21 February 2022

    Shields Up had no end date, so vigilance needed a staffing plan

    When Russia invaded Ukraine, CISA asked every US organization to raise its guard, with no date to lower it. Sustaining a heightened posture for months was a management problem: who watches, who decides, and what work stops to pay for it.

    • Cross-sector
    • Operations & Workforce
    • 5 min read

March 2022

  1. Week of 28 March 2022

    Spring4Shell rewarded hospitals that could size a response in hours

    A Java flaw with a Log4Shell-style nickname arrived four months after Log4Shell, amid confusion over which bug was which. Its narrow exploit conditions made it a test of triage, and of whether tired hospital IT teams could avoid a second all-hands scramble.

    • Healthcare
    • Operations & Workforce
    • 5 min read

May 2022

  1. Week of 16 May 2022

    Safe harbor for researchers, homework for system owners

    The Justice Department’s pledge not to charge good-faith security research made outside reports more likely. For agencies, the work it created was operational: a front door for reports, a route to whoever can fix the flaw, and a way to close the loop.

    • Government
    • Operations & Workforce
    • 5 min read
  2. Week of 30 May 2022

    No patch yet: Follina and Confluence tested who may switch things off

    Two flaws exploited before fixes existed left health systems with workarounds only. The deciding factor was organizational: who could authorize turning something off, who could carry it out across the edges of the estate, and who confirmed it worked.

    • Healthcare
    • Operations & Workforce
    • 5 min read

August 2022

  1. Week of 29 August 2022

    Why LAUSD could keep classrooms open through a ransomware attack

    The second-largest U.S. school district opened on schedule days after ransomware hit its systems. That was possible because classroom teaching depends on few systems. The hard parts were resetting access for an enormous population and telling families what to do.

    • Government
    • Operations & Workforce
    • 5 min read

September 2022

  1. Week of 26 September 2022

    Recordkeeping fails where the approved channel is slower than a text

    The SEC and CFTC fined large Wall Street firms over employees’ business texts on personal phones. The rules were old and capture tools existed. The failures came from convenience, and fixing them meant channels, supervision and capture assurance moving together.

    • Financial Services
    • Operations & Workforce
    • 5 min read

December 2022

  1. Week of 12 December 2022

    FTX’s favored account was a setting in the code, and banks have settings too

    The FTX charges described control failures that regulated firms believe they solved long ago. What made them possible was a small engineering group able to change how the platform treated one account. Banks and broker-dealers now run their own controls the same way.

    • Financial Services
    • Operations & Workforce
    • 5 min read

January 2023

  1. Week of 9 January 2023

    A deleted file, a national ground stop, and the runbook nobody rehearsed

    The FAA’s NOTAM outage was blamed on an aging system, but the trigger was routine database maintenance that damaged both the primary and the backup. For agencies running old mission systems, procedure, people and recovery design deserve attention before replacement does.

    • Government
    • Operations & Workforce
    • 5 min read

April 2023

  1. Week of 10 April 2023

    Clearance, access and need-to-know: three controls the Discord leak pulled apart

    The documents posted on Discord were taken by a junior IT specialist whose clearance and systems access were valid, but who had no need for the material. Agencies that hold any sensitive data need separate controls for administrative access, its monitoring and its supervision.

    • Government
    • Operations & Workforce
    • 5 min read

May 2023

  1. Week of 8 May 2023

    After the emergency, telehealth’s rules landed on clinicians one deadline at a time

    The COVID-19 emergency’s end unwound telehealth flexibilities on separate schedules set by Congress, the DEA, OCR and the states. Each schedule governed a different workforce question: what clinicians may prescribe remotely, where they may practice from, and which tools they may use.

    • Healthcare
    • Operations & Workforce
    • 5 min read

July 2023

  1. Week of 3 July 2023

    Before the bias audit, the inventory: what New York City’s hiring-tool law asked of employers

    New York City’s Local Law 144 made bias audits the headline. For banks, insurers and asset managers hiring in the city, the harder prerequisite was finding every tool that scores candidates, deciding which were in scope, and naming an owner for each.

    • Financial Services
    • Operations & Workforce
    • 5 min read

August 2023

  1. Week of 14 August 2023

    A weekend of public red-teaming showed agencies that AI testing never finishes

    The White House-backed red-teaming of chatbots at DEF CON in August 2023 was a demonstration, not a certification. For agencies buying AI, testing is a standing workload at three stages, before award, before deployment and in operation, and the binding constraint is staff.

    • Government
    • Operations & Workforce
    • 5 min read

September 2023

  1. Week of 25 September 2023

    Shutdown plans counted people; agency systems depended on contracts and expiry dates

    The shutdown averted on September 30, 2023 still forced agencies to write lapse plans. Those plans were built around excepted staff, while agency technology also depended on how each contract was funded, what would expire mid-lapse and how systems would restart.

    • Government
    • Operations & Workforce
    • 5 min read

November 2023

  1. Week of 27 November 2023

    Ardent took one network offline, and emergency departments in six states had to answer for it

    Ardent’s Thanksgiving 2023 ransomware response was decided centrally and felt locally, in hospitals that carried partners’ names and answered to different state systems. Multi-state operators need the central decision, local authority and partner obligations settled before a holiday weekend.

    • Healthcare
    • Operations & Workforce
    • 5 min read

January 2024

  1. Week of 29 January 2024

    Why CISA’s Ivanti disconnect order was decided by people, before it was issued

    CISA gave federal agencies about two days to unplug and rebuild their Ivanti gateways. The steps were documented. What decided who met the deadline was who could authorize cutting remote access, who could rebuild the devices, and where agencies sat in their contractors’ queues.

    • Government
    • Operations & Workforce
    • 5 min read

February 2024

  1. Week of 26 February 2024

    CSF 2.0’s biggest addition was the one a security team could not deliver

    NIST’s new Govern function looked like a security framework update. Its six categories assign work to executives, HR, procurement and boards. Organizations that treated it as a mapping exercise for the CISO missed what had changed.

    • Cross-sector
    • Operations & Workforce
    • 5 min read

May 2024

  1. Week of 6 May 2024

    Bigger network, thinner safety net: Ascension’s outage hit every sister hospital at once

    A large system’s hospitals normally cover for each other with beds, staff and shared services. When ransomware took Ascension’s shared platforms down across its markets, that internal mutual aid failed together, and the help had to come from outside.

    • Healthcare
    • Operations & Workforce
    • 5 min read

July 2024

  1. Week of 15 July 2024

    Channel File 291 measured every recovery plan in hands per device

    The faulty CrowdStrike update turned remotely managed Windows estates into a field-service job. Recovery speed came down to three constraints most plans never modeled: access to recovery secrets, people at keyboards, and the order of repair.

    • Cross-sector
    • Operations & Workforce
    • 5 min read

August 2024

  1. Week of 26 August 2024

    Sea-Tac’s handwritten bag tags were a staffing plan in disguise

    When ransomware took down Port of Seattle systems, the airport kept moving on paper. “Revert to manual” is a promise about people: which work has a paper version, who does it, how long they can sustain it, and who re-keys it afterward.

    • Government
    • Operations & Workforce
    • 5 min read

September 2024

  1. Week of 23 September 2024

    Helene tested what continuity plans take for granted: staff, signal and signatures

    Continuity plans for local agencies are written for the loss of a building or a system. Helene removed people, connectivity and decision authority across a whole region at once, and each of the three needs its own preparation with its own lead time.

    • Government
    • Operations & Workforce
    • 5 min read

November 2024

  1. Week of 11 November 2024

    FinCEN’s deepfake alert was a job-design problem for three groups of staff

    FinCEN’s November 2024 alert read like a list of red flags for compliance teams. Its harder implication was for the people whose jobs let them act on recognition: onboarding reviewers, service agents and payment operators each needed new decision rights, incentives and escalation paths.

    • Financial Services
    • Operations & Workforce
    • 5 min read

May 2025

  1. Week of 12 May 2025

    Cheap contracts, valuable access: the market behind Coinbase’s bribed agents

    Coinbase’s May 2025 disclosure showed criminals buying data from outsourced support staff who could already see it. Insider risk in support operations behaves like a market, and financial institutions set its terms through how they buy and govern outsourced labor.

    • Financial Services
    • Operations & Workforce
    • 5 min read

July 2025

  1. Week of 14 July 2025

    An escort who cannot read the command is not a security control

    ProPublica’s report on Microsoft’s digital escorts showed that a cloud authorization says little about who actually operates a system. Agencies need personnel terms they can test: who can touch the system, how that work is checked, and what evidence reaches them.

    • Government
    • Operations & Workforce
    • 5 min read

September 2025

  1. Week of 29 September 2025

    How the lapse of a 2015 law put counsel in the threat-sharing loop

    When the Cybersecurity Information Sharing Act expired as the October 2025 shutdown began, sharing did not stop. Each outbound indicator acquired a legal question, and teams that had never written down who approves sharing found analysts waiting on lawyers.

    • Cross-sector
    • Operations & Workforce
    • 5 min read

January 2026

  1. Week of 26 January 2026

    A two-year telehealth runway is long enough to build on and too short to bet on

    After one more lapse at the end of January, Congress extended Medicare telehealth flexibilities through 2027 and hospital at home through September 2030. Health systems could finally plan, but only by sorting services according to how long their legal footing lasts.

    • Healthcare
    • Operations & Workforce
    • 5 min read

February 2026

  1. Week of 9 February 2026

    What a second CISA lapse in five months asked state and local security teams to own

    The DHS funding lapse that began on February 14 was the second interruption to CISA’s proactive services in five months. For state and local agencies, the question moved from listing federal dependencies to deciding which work to absorb, buy or keep borrowing.

    • Government
    • Operations & Workforce
    • 5 min read

March 2026

  1. Week of 30 March 2026

    What payers’ first prior authorization numbers needed from providers to be useful

    The prior authorization metrics payers posted by March 31, 2026 were rates without volumes, averaged across whole books of business. They became useful to a health system only when paired with its own counts, by payer and service.

    • Healthcare
    • Operations & Workforce
    • 5 min read

May 2026

  1. Week of 25 May 2026

    Faster settlement, longer nights: what two years of T+1 tell Europe’s operations desks

    The US move to one-day settlement held because firms automated trade-date matching and redesigned who works when. Europe and the UK move in October 2027, and the shift pattern and funding model will be harder to build than the software.

    • Financial Services
    • Operations & Workforce
    • 5 min read

June 2026

  1. Week of 29 June 2026

    July 1 in teaching hospitals: thousands of joiners, movers and leavers in one week

    The annual residency changeover is the largest identity event a US teaching hospital runs. Joiners, movers, leavers and the supervision record each fail differently, and each needs its own control and measure.

    • Healthcare
    • Operations & Workforce
    • 5 min read

September 2026

  1. Week of 21 September 2026

    Agency certificates now expire faster than agency budgets turn over

    The first full-term 200-day TLS certificates expired on October 1, 2026, the first day of the federal fiscal year. Agencies that bought, staffed and scheduled certificates on an annual rhythm had to rebuild all three around renewals that no longer fit one.

    • Government
    • Operations & Workforce
    • 5 min read