i would say fisma fisma's shortcomings or more in that area and they need to be updated and then completely replace. >> guest: one of the main stumbling blocks to legislation on cybersecurity is the industry believes that any regulatory regime may eventualleventuall y resemble fisma in that it is more focused on complying then operation of cybersecurity. >> guest: one of the things we have done is we are in the process of developing the executive order and we had extensive outreach with industry and academia. we held dozens of meetings, more than 30 actually with different trade associations and industry groups and companies in one of the things we stressed and that is the process we want to set uy collaborative and really rests on the practices that they themselves the leaders in their industries or already doing. it doesn't really do us any good to put out a compliance model that is -- that a company can't comply with or doesn't make any sense in their business because the goal is to improve cybersecurity. just checking the block doesn't actually do any good so i would say that the other

>> guest: so i would say that fisma has worked, but it needs to be updated. it was a good piece of legislation for when it was passed, and it moved the ball forward for that time period. but now we have a more sophisticated understanding of what you actually need to do in cybersecurity. so, for example, i would say one of the things that needs to be updated is a move away from a compliance model where you only periodically go back and check every so many years. um, that's not going to really work now in the modern cyberspace age, right? things move too fast. so we want to move to much more of a continuous diagnostics approach such that you are always getting information about the state of your network and where -- what assets do you have that are hooked up to the network, and what are your vulnerabilities? have you done the latest patching so that you have that information in realtime. i would tell you that fisma's shortcomings are more in that area, that it needs to be updated than sort of completely replaced. >> now, one of the main stumbling blocks, as you

i wrote the last cybersecurity law that goes to congress called fisma federal information security act and i was a chief author that so i was a prolific legislator in those areas. rochkind across party lines. >> host: . >> host: speaking of the government procurement process, does it work currently especially when it comes to technology? >> the problem of government procurement, will give an example combat put an addition on my house about a year ago and i didn't have to worry about advertising it. i didn't have to worry about small business set asides or minority set-asides and didn't have to worry about protests and i got it done efficiently and it works pretty quickly. didn't have to worry about the buy america acts. all these bells bells and whistles that try to basically look at other government policies as a procurement part of that instead of just looking at getting the cheapest goods for the cheapest price for the taxpayer. as a result of that it's a very efficient way to pick your goods because we said too many public policy goals within the procurement system. so the answer i

services acquisition reform act the last cybersecurity law to get through congress called fisma. so i was a pretty prolific legislator in those areas. which tended to cross party lines. >> host: well, speaking of the government procurement process, does it work currently especially when it comes to technology? >> guest: well, the problem with government procurement is, i'll give you an example. i put an addition on my house about a year ago. i didn't have to worry about advertising it. i didn't have to worry about small business set asides or minority set asides. those issues, i didn't have to worry about o protests, and and i got it done pretty efficiently, and i could work it pretty quickly. i didn't have to worry about the buy america act. government procurement has all these bells and whistles on it that try to, basically, look at other government policies and make procurement part of that instead of just looking at getting the cheapest goods for the cheapest price for the taxpayer. we try to pursue too many public policy goals within that procurement system. is so it's, no,