Brad Neal

Over the past 25 years, I have managed the NASA Kennedy Space Center (KSC) Application Portfolio, lead in the modernization of KSC Application and Platform Architecture, and monitored and/or lead both civil servant and contractor application related KSC projects. I have implemented and enforced system security plans for the NASA KSC IT Computational Division as an Information System Security Officer (ISSO) including Operational Technology and Network System Security Plans. I have a working knowledge of the Federal Information Security Management Act (FISMA) and the National Institute of Standards and Technology (NIST) standards and guidelines specified in the Federal Information Processing Standards (FIPS) and Special Publication 800 series. My primary responsibilities at the KSC are implementing and assessing security controls, maintaining and monitoring systems, and presenting information systems security plans for annual authorization to operate (ATO) under the Risk Management Framework (RMF) mandated by the Office of Management and Budget (OMB) for categorizing, selecting, implementing, assessing, authorizing, and monitoring all information and information systems collected or maintained by or on behalf of the KSC IT Computational Sciences Branch and the KSC IT Project Management Office. I have also been part of teams performing security assessments on NASA systems and source evaluation boards for NASA contractor selections. I work with NASA Network to maintain Zero Trust while assure Application resource availability to and from external cloud providers, including AWS GovCloud and GCP commercial cloud. Over the years, I have providing data to KSC IT Security for monthly metrics and reporting as part of continuous monitoring. From this, I understand the definition of good metrics and the value of reporting, as well as the importance of prompt compliance. I have extensive experience with the Plan of Action and Mitigation (POA&M) and Risk Based Decision (RBD) process as a result of Security Assessment Reports (SAR). I understand the gravity of risk-based decision making and I always weigh them out based on the fundamentals of the CIA triad for the systems I am responsible for.