Technology & Innovation

Q&A with Theresa Payton, CEO, Fortalice, former CIO, White House

March 13, 2018

Global

March 13, 2018

Global
Michael Hoffmann

Contributor

Michael was an editor for The Economist Intelligence Unit’s thought leadership division in the Americas. He was previously an equity research analyst covering cybersecurity, data networking, cloud computing and IT infrastructure. He has also worked on several grants from the National Institutes of Health to research topics including HIV/AIDS, non-communicable diseases and international human rights law. His work has been published in several peer-reviewed journals including AIDS Care, Global Public Health and the Journal of the International AIDS Society. He received his bachelor’s degree in International Relations from Brown University. He has worked in Latin America and is fluent in Spanish and Portuguese. 

This article is part of a series developed by The Economist Intelligence Unit’s Pioneering Leadership programme, sponsored by IBM, and drawing on interviews with leading CIOs from around the world.

In this Q&A, we ask Theresa Payton, CEO of Fortalice Solutions and former CIO of the White House, about the changing role of the CIO, today’s cyber threat landscape and best practices in security and IT operations.

Theresa Payton is a leading expert in cyber-security and IT strategy. Ms Payton is currently CEO of Fortalice Solutions, a cyber-security consulting firm, and was the first woman CIO at the White House, serving under president George W Bush from 2006 to 2008. Ms Payton also previously held leadership roles at Bank of America and Wachovia. 

__________

EIU: How do you think the role of the CIO has changed since your time at the White House? 

When I was CIO, which was from 2006 to 2008, we were right at the beginning of the social media revolution. People forget that the first iPhone was released in 2007. We can’t remember life without smartphones, but that was really a huge transformation in technology. 

The things that have stayed the same are you absolutely have to have operational stability and resiliency. In an age where cybercrime constantly changes, as does the technology in the hands of people, the CIO has to foster the ability to adapt processes, people and security strategies to accommodate these changes. If the CIO ignores this, they will actually face outages in the long run and will not recover quickly from natural or man-made disasters.

You always have to walk that balance between how do you make sure that operation is resilient and secure, but at the same time, enable the staff that’s on the front lines of doing critically important business.

EIU: You were the first woman CIO in the White House. Tell us what you think about diversity and bringing more people into the technology industry.

A lot of progress has been made, but we still have so far to go. First of all, I am so grateful that president Bush made diversity and inclusion such a high priority during his administration.

I was equally thankful that I was the first female CIO at the White House. There was a wonderful level of professional courtesy and respect, and when you’re working 18-hour days with people, you tend to break down most barriers pretty quickly. And I am very proud of improving the overall technology and security platforms at the White House, as well as being able to recruit really great talent, including women and minorities, into the CIO team at the Executive Office of the President. 

Within our own company, Fortalice, we do a mentor/protégé programme. When people come in and they haven’t done cyber before, they get assigned somebody in the company that’s their coach and mentor. 

If you’re the best at what you do, you can do a lot of the training internally. Take advantage of your own amazing people and have them train and be responsible for some of the retooling and retraining of your own people. Make it part of their workday. Build it into your resource plans that you’re going to train, coach and mentor the next generation. It’s succession planning, and it’s, again, team talent, resiliency and operational stability. Doing that creates that cross training, that esprit de corps

Of course, you’re going to have to spend some money on retooling and retraining, but you’re going to have an incredibly loyal employee that you’ve created in that process.

EIU: The White House is clearly a sensitive environment with a lot of mission critical information. How were you able to successfully manage security?

One of the strategies that I think was so successful at the White House, and the reason why we did not have a data breach while we were there, is I always think about things in zones of information, zones of protection and zones of need-to-know. We zoned off different parts of the operations within the White House. By creating those zones, you can create behavioral-based analytics about events. 

The job of being CIO and responsible for security really has to start with the end-user case first, because then that’s how you will understand how cyber-criminals will actually try to take advantage of vulnerabilities in those use cases, and that’s at that level where you have to be thinking about protection. Once you know the critical assets the business must protect, you have to set daily battle rhythms for the team. This allows you to help the overall organisation stay focused on their day jobs while integrating security into the culture. The CIO can’t see security as a discrete function or a project, it has to be part of the service delivery. 

EIU: What advice you would give to CIOs today?

The CIO job can be a little overwhelming because it is a massive undertaking in today’s day and age. You have the legacy systems that you have to maintain and operate, and the less sexy side of the CIO job: “Did you run payroll?” “Yeah, we made sure payroll ran.” There’s that least sexy side all the way to, are you actually transforming the business with really cool, cutting- and leading-edge technologies? 

My counsel to CIOs is you need to be a constant student of your job.  Whatever you thought made you successful to be here, throw some of that out the window, and reinvent yourself and reinvent your job on a regular basis. 

Why are some companies successful? It’s because they’re reinventing themselves constantly as they see what the market demands are and what their competitors are doing. Then they can decide to be a fast follower, a total follower, a “no, I’m going to do my own thing”, or a leader. The CIO needs to be thinking about that. 

EIU: Any best practices CIOs should remember when balancing these challenges and trying to reinvent themselves?  

You have to stay close to the business and stay close to the technologies. Being a constant student of your job is easier said than done, but it’s actually never been easier than it is right now. Here are a few examples:

Pick something that along your career you were good at, and find ways to constantly keep learning. I started out as a developer. I’m not going to be as good as the developers I have working for me today because that’s what they do all day long. But just to make sure I keep my edge, I do online programming classes. Recently, I did one in Python. 

Talk to smart people. I call them walk-abouts. I spend time talking to my team, and then our own CIOs and CISOs as clients. I ask them if you had to say what are your biggest three challenges this year, what are they and how are you going to tackle them? And you learn so much from other people. Conferences can be helpful as well. Take advantage of the information sharing that goes on at conferences. 

Read, read, read as much as you can. I get up extra early in the morning. I got in the habit of getting up at 3:30 in the morning when I was in the White House to make sure that I could plan out my day and start reading before daily briefing started. If I wanted to make sure I had my day planned out and that I was being a student of my job, I had to get up extra early. 

My biggest recommendation to CIOs everywhere is, every week, be thinking about what am I going to do that, as I’m transforming the business, allows me to transform myself in my role.

To learn more about The EIU’s Pioneering Leadership programme, find a full range of insights, including more Q&As, upcoming articles and an in-depth report, click here.

Enjoy in-depth insights and expert analysis - subscribe to our Perspectives newsletter, delivered every week