Month: January 2023

Source: United States Navy

While the visits may conjure up visions of safety inspections with safety representatives on hand, that is not the case.

Assurance teams do not conduct safety inspections but rather risk assessments with principal command leaders over a one-week period. The word ‘safety’ will only be heard once, said the gold team lead in NAVSAFECOM’s assurance directorate, Capt. Brian Turney.

“We start discussions with commands by saying the only time you will hear the word ‘safety’ is when we say we are here from the Naval Safety Command,” Turney said. “Risk and self-improvement are the primary subjects of discussion.”

Assurance teams have conducted 11 assessments since June. Assessed commands appreciate the feedback provided and realize the assessments are helping them improve, said the director of NAVSAFECOM’s assurance directorate, David Bussel.

“The assessments measure whether behaviors of self-awareness, self-assessment, self-correction and continual learning are instilled within the command,” Bussel explained. “When these behaviors are present, then the command is likely ‘safe to operate’ and ‘operating safely’ because they are properly identifying and communicating risk, and accounting for risk at the appropriate level.”

So what does ‘safe to operate’ and ‘operating safely’ mean? It is a question that commands have asked NAVSAFECOM assurance teams.

“Throughout this first year of assessments, we will also assume an educational role to explain new concepts from the recently revamped Safety Management System (SMS),” said the NAVSAFECOM assurance directorate’s blue team lead, Capt. John Bub. “We understand that this is a learning process and how to better self-assess and self-correct.”

For example, the assurance teams will explain that ‘safe to operate’ and ‘operating safely’ are the lynchpins within the SMS, which encourages a safety focus and mindset that embraces self-assessment and self-correction to manage risk and maintain accountability. The SMS relies on four key takeaways: safe place, safe people, safe property and materiel, and safe processes and procedures (4Ps).

Yet the ‘safe to operate’ and ‘operating safely’ concepts are not one and the same, which is important to understand, Bub said.

“These are completely different aspects, and who owns these aspects can be different,” Bub said. “But they do not operate in isolation and in fact, are completely reliant on the other.”

‘Safe to operate’ is the as-designed safety for places, property and materiel, people, and processes and procedures.  It is the defining design, policy, engineering, resourcing and expectation management that sets the safety risk envelope for the hazardous activity or activities for a given operating environment.

On the other hand, ‘operating safely’ is executing the mission within the designed safety envelope. When unplanned or unforeseen safety risks manifest outside of the approved safety case and the military benefit (operationally defined objective) of taking the risk outweighs the cost of the risk exposure, then commands should apply the principles of operational risk management to control risk.

NAVSAFECOM conducts three tiers of assessments for Echelons II through V commands:

• Tier I: The assurance directorate provides assurance of Echelon II-III risk resilience as well as safety and risk management systems and policies in order to assure the Naval Enterprise is safe to operate and operating safely by identifying, communicating and accounting for risk at the appropriate level.
• Tier II: Certification and inspection teams from aviation, shore, afloat and expeditionary directorates focus on inspection and certification processes in support of the Navy’s Optimized Fleet Response Plan (OFRP) milestones. Units include carrier strike groups (CSG) and afloat training groups (ATG).
• Tier III: Multidisciplinary teams from aviation, shore, afloat and expeditionary directorates focus on day-to-day unit-level (Echelons IV and V) standards and compliance during local area assessments.

While Tier II and III assessments are no-notice, the NAVSAFECOM assurance directorate, who conducts Tier I assessments, will notify commands eight weeks in advance asking for data and documents no later than four weeks prior to the assessment. The 8-week advance notice also ensures that commands have principals on hand such as directors.

During the assessment week, the Tier I assurance teams will conduct interviews, review records, and observe battle rhythm and decision-making events.

Following the assurance assessment week, NAVSAFECOM will provide the unit commander an assessment out brief and follow-on written report with a ‘grade’ corresponding with levels of risk control effectiveness and details regarding risks. The assessed command will in turn provide a response report outlining corrective actions to their reporting senior within 30 days.

NAVSAFECOM is not the primary recipient of the response report but rather copied because the risk picture belongs to the commander, said the deputy director of NAVSAFECOM’s assurance directorate, Nate Elder.

“It is not the position of the assessment team to judge individual risk decisions because that is the role of the commander,” Elder said. “Our teams verify to the commander whether staff processes are in place to provide a complete risk picture when the commander needs to make an integrated risk decision. We are the third party coming in to look and see how well the system is working and help highlight where improvements can be made.”

Source: United States Navy

The ISV, published in February 2020, remains the foundation for the DON’s efforts to modernize, innovate and defend its information technology (IT). The campaign plan identifies six focus areas for FY 23 that are critical to maintaining momentum in achieving ISV objectives.

Optimize the DON IE for Cloud

The DON plans to optimize the Information Environment (IE) for cloud by modernizing application and data hosting environments and diversifying transport, including with Proliferated Low Earth Orbit satellites. When optimizing, the DON will target the challenging use cases of Multi-Level Security and bandwidth restricted environments, as well as garrison and expeditionary OCONUS shore locations.

Adopt Enterprise Services

IT Enterprise Services, which enable the DON to “create once, use often,” will enable consumers to achieve mission objectives faster, better, cheaper and more securely. The DON will enable a thriving marketplace for these reusable services by reinforcing standards and best practices for IT service management, and promoting mature enterprise solutions that satisfy common needs.

Implement Zero Trust

The DON will continue its shift from traditional network boundary protection to Zero Trust, which requires all access to data and computing resources to be fully authorized, authenticated, encrypted and monitored.

Use Data to Fuel Force Readiness

Making data consumable and useable for decision-making increases readiness and improves performance. During FY 23, the DON will pursue several data initiatives, including one to establish and execute the process for authoritatively defining mission-critical authoritative data sources, which will set the stage for operationalizing and sharing data at scale.

Cyber Ready

The DON will continue moving from its current compliance-based cybersecurity approach to one where the right to operate is earned and managed every day. Teams organized around the Cyber Ready lines of effort will develop solutions, select tools, and produce methodologies, policy, guidance and concepts of operation for instituting this new approach. The DON will also conduct pilots to validate the Cyber Ready process and demonstrate innovative methods for accelerating the deployment of secure capabilities.

Cattle Drive

Cattle Drive accelerates the modernization and transformation of the DON’s IT capabilities by ensuring decisions are made to sunset or rationalize unneeded, obsolete, unproductive, insecure and un-auditable IT applications. During FY 23, the DON will continue eliminating or realigning resources, decertifying systems, and removing targeted systems and applications from the network though this data driven process that provides better visibility into its IT portfolios, allowing for smarter investments that drive modernization.

“This is a team sport,” Weis said. “Cooperation continues to be the key to execution. Successful execution of the FY 23 campaign plan requires active involvement from champions across the DON.”