Former federal IT security contractor here. There's nothing unusual about this event, except perhaps the fact that it's receiving national attention. When I wo

Former federal IT security contractor here. There's nothing unusual about this event, except perhaps the fact that it's receiving national attention. When I worked for the federal agency responsible for providing health care services to tribal entities, we would routinely accept and issue waivers for high-level risks discovered in RPMS (called VistA at the VA), the 30-year-old EHR application we used to store PHI and PII. Honestly, I don't know why we even bothered performing C&As and penetration tests -- everybody knew we weren't going to mitigate the vulnerabilities, even before we started testing for them. It was an incredibly frustrating environment to work in. Federal law required us to test for vulnerabilities, but the director and CIO didn't give a shit about infosec and the CISO just kept issuing waivers for everything.