Transcription complète de Episode 125: Modernizing the Mission: Secure AI, Cyber Resilience, and the Future of Energy IT

cloud, it's secure. And working with each of the stakeholders, showing them, this is a secure environment, we've got all the security controls. We now have data coming in from parts of the organization.that would never in the past have shared their data. And the power of this, of Quanta now, just, it keeps growing more and more and more, like on a daily basis. Like it excites me every single day, because they're like, and we've got another data source coming in. And then, you know, I go into a meeting with an executive and they're like, yeah, we'd like to tell this story. I'm like, we got all that.here and we show them the prompt and we show them what the tables we can build and they go, wait, you can do that. And you already had that and like that's that speed of need. They needed it and it's already happening. Ford, Carolyn So, this initiative... Is getting rid of the silos, the data silos from the different groups, bringing them all in and using AI quantum to analyze and integrate and move like come up with solutions. Dawn Zimmer Yeah, so it's artificial intelligence for sure. The name of the product that we've deemed it our internal product is Quanta. We're not quite at the point where we're using quantum computing yet, although I'd love to someday. But really, we've just, you know, we kind of gave it a little like internal marketing name And it's just, you know, it's built on a data platform with data bricks, and we're just building off of that incrementally, but breaking down those data silos for sure. Ford, Carolyn Was that the objective of Quanta to be able to aggregate data from all over DOE? Dawn Zimmer Absolutely. It was always part of our data strategy from day one was there's a chart on one of my deputies, the deputy CIO for this particular area. She has this diagram on her wall and it showed like all of the places, right? And like where we wanted to make all these connections come together. And every time I, it's been up there probably for a year now, like, and none of us ever want to erase it because it just kind of always reminds me that that was, you know, where we started was a conversation on a whiteboard. How can we lost connect all these things? And sometimes I just want to go in and go, oh, we got that one checked and we got that one checked. And like, you know, it's just starting to come together. And what we're giving them is we're giving them decision support tools, real time, so that the power of being able to use our taxpayer dollars to make good decisions that enable energy dominance and meet the Secretary's goals at the speed of need is just, you know, it's just a beautiful story of all of us working together. Yeah. Ford, Carolyn There's so many things that I love about this story. One of them is that you sat in an office, human beings in person, sat in an office together and wrote on a whiteboard. This isn't, you know, there's a lot of fear right now about AI taking our jobs and being able to do what

we do. And I still maintain that we have to, you know, the creativity, the ideas are still driven by us. Dawn Zimmer Right. Ford, Carolyn So, I'm also wondering, you know, you mentioned planning for the future, planning for down the road, not just to get to this milestone, but to get, you know, 100 miles down the road, because rebuilding is hard. You There's got to be a lot of legacy IT in DOE. I have no idea how much. There's just got to be a lot. So. Multiple part question. Was Quanta as part of the objective to help you identify what legacy IT to modernize first? Like where to, how to tackle that and how, and even how to start modernizing it? Is that part of the objective? Dawn Zimmer No. Yes and no. It wasn't necessarily, it was part of the objective. Yes. It was. So yes, there is a lot of legacy IT out there, but there's lots of systems doing very specialized things. What we are finding is Quanta is able to fill some of those gaps, We went into a meeting the other day and we were showing Quanta for a completely different use case. And at the same time, I was rebuilding a legacy system into something a little bit more modern with a little less technical debt for the same organization. We all looked at each other and said, we could take that and move it over here and meet the objective by putting it all in Quanta as opposed to building two systems. It wasn't necessarily like we went in with that objective but we got ourselves there. So sometimes we stumble into it. Other times, yes, it is very, very, sometimes it is very predetermined where I know where the legacy is and where I want to move it to. But every day I stumble upon a new system that I didn't even know existed out there. Ford, Carolyn How do you modernize without compromising mission continuity? It's like building a plane while you're flying it. Dawn Zimmer Or, or you build 2, right? You, you fly one plane and you build the other one, right? And at some point, you have a path that takes you from one to the other. I always call it like, you know, I always think about the Commander Stadium in DC, right? You know, you're going to, we're going to build, you're going to build the new stadium, you're going to play in the old one until it's finished, right? And then you're gonna have your migration plan to move folks over to the new one. And I think being really conscious about that and making sure, and my team will tell you, my number one motto is we don't ever intentionally break anything, right? And we look for all the ways we can unintentionally break something and mitigate for it earlier. So the first thing I'm always thinking about is I don't want to hurt anybody's anything, right? We're going to be very mindful in the way we cut over. So if you look at what we did with Workday, right, we took our HR IT system, We built Workday, you know, we stayed on the system we were on, which was a legacy system. We built Workday out, and we very intentionally moved pieces over one at a time, right, and tested, made sure, okay, great, set a date for a cutover, moved over. But we didn't try it. We did it in small, manageable chunks. And where we had confidence levels built, we have a governance structure that makes a go, no-go decision. And we're not doing anything where, you know, 100,000 employees could end up without, you know, HR services because we got either too aggressive or didn't think through all of the pieces. And that's kind of how I approach all of our modernization efforts. Just, you know, very consciously as we're going through it and really kind of thinking through like, what's the worst scenario that can happen here? Okay, let's plan for that one. Ford, Carolyn That sounds like a much gentler migration path than I was imagining. Honestly, right now I'm going through a small, like, my house is getting painted just on the outside, not a lot. It's really painful. And I just keep thinking, you know what, I think it might be easier to just bulldoze it and start over. Dawn Zimmer I feel the same way. I mean, you know, the thing is, I came from, you know, FAA, right, where we tried to, we've been modernizing the air traffic system for, you know, 25 years, 30 years, right? And I worked on NextGen. So I saw like, you know, how important it was to kind of, you know, know where you were, where you wanted to get to and then have just applied a lot of those lessons in this role and try to think about it. It's also, we're in a different place today. We're able to build faster, right? The tools are there to allow us to build faster. IT 10 years ago, the process was,You know, I spent six months gathering requirements. I brought every stakeholder I possibly could into the room. I had 100 pages of requirements and who wanted the field blue and it had to do X and it had to do Y and it had to do Z and whatever. And then you never got any time to build anything because it just everybody. would go back and say, oh, now the requirements changed. And then he finally started to build something and he went into a year build cycle, right? And then you tested and then, you know, by the end of it, it was OBE because the business had changed, the administration had changed, the needs of the organization had changed. And today, you know, being a CIO today is so exciting because the tools are there. You've got initiatives like Tech Force, where I can get coding help now and hands-on keyboards. I've got vendor partners, industry partners, who are like, tell us what you need and how fast you need it. And they're creating stand-up solutioning teams as well that you can partner with. I've got folks that are thinking about the problem just differently and going, well, we saw success here, we could build off of that. It's just like, you're just moving so much more quickly that that flying the plane, you know, the two planes at the same time or the same thing, that's like gone down to like, weeks versus or months versus years, right?

Which makes it a lot easier than to make those transitions because you're not kind of having to wait until all the pieces are built out. You're being able to do things a little bit more with a little bit more agility, I think, than ever before. Ford, Carolyn Well, I think AI has brought a whole new component to that too. You know, you talk about how quickly we can code. I don't know how to code. I took a coding class, you know, I think I was in junior high. I don't know how to code, but I code with AI.Which brings up should I be coding with AI, should I be coding at all? So lets talk about that, let’s talk about AI at DOE, what are you doing with it, what are the guardrails around it, what are you doing with it? Dawn Zimmer Yeah, so we, again, you know, I go back to, we started with the mission first and we are definitely using AI to solve as many problems as we can. So we launched Julix back in, I want to say 2023. It was before I arrived. .And it was this kind of, you know, small chat GPT kind of, we called it energy GPT. And it was one component of a larger toolkit called Julix. Ford, Carolyn Was is Dulex a DOE proprietary thing? Because I don't know that one. Okay. Dawn Zimmer It is a DOE proprietary environment. And in there we put something called Energy GPT, which is like your chat GPT. And oh, wait, this was this was some glass being broken and I cannot take credit for it, but I'm going to talk about it as much as I can because it's the coolest thing. Ford, Carolyn Man, you guys are pioneers. Like, you are way ahead of the curve. Dawn Zimmer 17:34 in government right now. We are probably the only department or agency doing this. And in there we also put like a position description builder and a performance workstation builder. So using AI technology to feed it. The brilliance was coming up with a relationship with our AI model provider that allowed us for web grounding. So all the data stays in our environment. I get a daily feed from the internet. So I'm getting, I've created an environment. where they're getting live internet data, but our data never goes back out the other way. It is all protected. So I'm giving them, you know, the power of AI at its fullest capacity inside and in a safe environment. So I can throw all the DOE data in there that I want. Ford, Carolyn Never goes out. It's protected, right? Got you. Dawn Zimmer to do some of the, you know, ask the questions, you know, give us the answer. So we put in there a performance workstation builder, we put in the position description builder, we took all the executive orders and put all the executive orders in there so you can do anything you want in terms of searching on all the EOs and, you know, comparing, contrasting. We are now looking at like, how can we do set up some technologies that will actually allow you to like, if I picked an executive order, web scrape for everything Secretary Wright has said about that particular executive order or the

press has reported on and like put that into a daily news thing that I could just like, you know, hit my prompt and have it give me all of that in a single interface, right? So we're just like really leveraging that AI and just starts that that adoption just starts at the workforce level. Like how simple, right? That I can just log into Julix. I use it every day. I go in there, like, I'm trying to write a memo. Sometimes, you know, yes, you've got co-pilot that you can go to, but sometimes I'm like, oh, I need a little bit more information. And I go over to Julix and I'm like, okay, well, what executive orders are out there that DOE has done, compare it to, give me these things and bring that in. We gave them a work environment called Canvas. where they could find all of their stuff, bring it over, and then start to build their memo or their white paper or their notice of funding opportunity or whatever in a kind of a workspace that's also AI enabled. So really bringing it starting there at the desktop and then just giving them that capability. And then that just incrementally grows, like I said earlier. you know, where we're just, we're pushing it everywhere we can. I'm looking at like, you know, what's our correspondence system look like? Can we add AI to that so that we can have more intelligent approaches to doing correspondence? We're talking to the FOIA folks, we're talking to the, you know, general counsel folks, right? And the environment is hungry for it. The problem is, you know, you have to keep up with all of that. There's a pace there, right? Yeah, you only have so many people and so much time. Yeah, so yeah, so then and that gets us to, like I said, using a lot of like reusable tools. What are the things that we already have? Ford, Carolyn That's right. It's breakneck. Yeah. Dawn Zimmer that we can continue to build off of and that we're not creating new every single, single place. We're seeing, you know. Ford, Carolyn How do you? Sorry, how do Quanta and Dulux or do they work together? Dawn Zimmer They're separate products, but they do, they do interact. Ford, Carolyn I would imagine Julix is feeding Quanta data because you said it's bringing in data.. Dawn Zimmer Some, sometimes, some of the data that's in Quanta, l, it's more Julix feeds into Quanta than Quanta feeds into Julix. Ford, Carolyn So, you know, we were talking about this breakneck speed that everybody's going at. Agencies are trying to adopt AI. They're trying to modernize, balance speed, governance, security, risk, especially in critical infrastructure. environments, what advice would you give about balancing all that? Dawn Zimmer Yeah, you know, I don't know. I always feel like, remember the lady with the spinning plates, you know? Yeah, that's kind of the way I feel half the time. And I think it's, you know, the balance is for me is it's so easy to get so excited and almost out pace yourself right and get the organization so excited, and we do we sit back sometimes and we're like, okay, wait a second, let's just stop and sync before we run down this path. First thing is, it will always be my number one priority is gonna be protect the environment. protect the data, make sure that it's not a separate step, like cyber has to be baked into it. It's foundational, it's non-negotiable, and yet not make it a constraint, right? So we start with that as a big part of the conversation. What capabilities do we have in the toolkit that we can leverage? And then what's our capacity to take on work? And then, and to your point, it is, it's a balancing game. So we meet every week, my leadership team and I meet every week. We are doing, you know, we do monthly program reviews. We are constantly looking at all the opportunities that come our way through an opportunity management program. We assess them, we try and figure out, well, you know, this one actually, we could use this, we've already built. It's a simple modification, you know, bang, we can move that one out the door. versus this one's going to be a little bit more of a heavy lift. You know, where can we fit it in? How can we fit it in? And what does it bring to the business? What do we gain from it? Obviously, if the mission partner is asking for it, you know, those always go to the top of the list. And then, you know, at the same time, you're trying to do things internally for your own organization to make sure that you've got all the tools, you know, kind of moving because, you know, you need you need your toolkit to always be sharp. So, yeah, it's definitely, you know, a bunch of plates all day long. Ford, Carolyn Right. Yep, that is my new logo for you, is Dawn Zimmer, CIO of DOE Spinning Plates. And with that, we're going to take a quick break right here and hear from our sponsors. All right. We're back from our break. I'm Carolyn Ford. This is Tech Transforms. I'm with DOE CIO Dawn Zimmer. And right before the break, Dawn, you were talking about, you touched on, and you've touched on this multiple times, how you bake cybersecurity into everything you do. And before we even go there, I wanted to say I asked you. you know, that balancing act and you conjured up the image of the woman with the spinning plates, how you balance governance, security, AI guardrails, all of that. And...I realized this whole conversation, and you started the conversation this way, is... What's the mission? What's the objective? That's what you keep going back to. Even when we're going at these breakneck speeds, we're not going to bring on new tools just to bring on new tools. How are they going to help us achieve the mission? And I think that's a really important point and how you're able to keep this balancing act going. Dawn Zimmer It really is. And it's, like I said, that's been our cornerstone. You know, is keeping that. The hardest, like I said earlier, I think the hardest part is, you know, This is an environment where, you know,

everybody wants the, let me, let me put it this way. Fifteen years ago, I came up with this notion that IT users or users want to use IT in the office the same way they use IT at home. And that hasn't changed 15 years later, right? So I've got users who come in and they're like, hey, at home, I can go on Claude or Gemini or whatever it is and I can do these things. So I came in the office and I wanted to do that. How come I can't do that? And you have to try to explain why that's not secure and that how. Ford, Carolyn That's right. Dawn Zimmer the models are getting fed and how you're putting data out there, you know, could put the department at risk is sometimes really hard to do because folks, they just, they're like, but I do it at home. And I'm like, yeah, but are you putting your, you know, you may as well put your social security number out there. Like, are you putting your social security number in the AI, in your AI environment at home? Ford, Carolyn Right. Dawn Zimmer Well, no, I would never do that. Then why would you put the DOE data about, you know, what our next funding opportunity might be out there? Right? So trying to find a way for them to understand that, that yes, you want to use it the way you use it at home. in the office, but we need to do that safely. And, you know, that just takes, it takes some doing and a little bit of finesse. I think we're making some real progress there when I, you know, kind of give them some examples of what could potentially happen and how, you know, I give them their doomsday scenarios and they go, Oh, well, we didn't know that. And I, you know, I'm like, well, you know, the more you put in there, you're actually feeding the very organizations or competitors that you're trying to do business with. You're giving them because they're not going to say, they're not going to do a search that says, hey, what's DOE asking? But when they do a search about something, you've just put data in there that's going to give them more information. And they're like, oh, right, okay, we got that. Ford, Carolyn 1 That's right. That's right. And at home, you're not securing the nuclear power plant. So it seems like it's kind of a no-brainer. Dawn Zimmer Correct. Correct. Right, right, right, right. And you're, you know, at home, you're not mining for critical minerals, right? You're not looking for ways to lower energy prices. Exactly, exactly. You know, the grid, I don't know. So, yeah, so, so yeah, I mean, and then, and Ford, Carolyn That's right. Securing our water systems. Dawn Zimmer And it's not, I mean, I work with the smartest people in the world and they get it. You know, it's just a lot, you know, of folks, you know, it's a different environment. You know, got some folks who have not necessarily been in government before. So this is like new information, right? And I'm super sensitive to that and always looking for like, I know, I know, you know, like I know, but I'm gonna, Let me explain it to you again and coming to a happy, happy compromise. But one of the things like we are doing is, you know, this is still, you know, it's obviously just even your basic cyber is a hop up, right? And you still have like basic things you have to do. So we actually launched an initiative this year called Echo, which is our energy consolidated cyber office, and that is giving us a dashboard where I'm able to pull the cyber data from across the entire organization to include the labs, plans, and sites into kind of a single pane of glass and start really understanding what our cyber posture is and where our risks are. Because, you know, it's really easy to forget, you know, You have to be brilliant at the basics, right? You kind of get all wrapped up in all the AI and the modernization and all the cool stuff that's going on out there. But at the same time, there's some foundational, just regular work that still happens, right? I'm still, you know, I've still got infrastructure that's got to be protected. I've still got an email, you know. email tenants that need to be protected. So how do I use the power of AI to help me just manage the regular day-to-day security posture, understand where our risks are, and make sure that we're not losing sight of that stuff because we're so spun up on all the other cool stuff that's going on out there. And I think that's really where the balance sometimes comes in, is, you know, kind of, you know, just making sure that you're remembering, you know, that there is this basic, you know, operational stuff that enables all the other things and you need to make sure you're protecting that as well. Ford, Carolyn Yeah, just that basic cyber hygiene that we've been talking about for 20 years. We got to keep that. So. Dawn Zimmer Yeah. Ford, Carolyn So what are some measurable outcomes that you've seen with the modernization efforts and the ones we talked about today and just in general, have you seen reduced risk exposure, improved incident response times? What have you seen? Dawn Zimmer We're definitely seeing big improvements in our response time on things. In fact, one of the initiatives we're working on, we were just talking about this yesterday, is pulling all of our help desk tickets and using AI to start proactively like, hey, all these users, you know, are, you know, you could do the analysis to say, oh, we got 53 password reset calls last year, right? But how do I use AI to actually figure out, like, what does that really mean? What are those 53 password resets really mean? When do they happen? How is it, you know, what's the user profile? How can I put other tools in place? Is it, is it, it always happens on Mondays, you know, whatever, right? So do like more in-depth analysis on some of some of our tickets. And I think that the other big thing we're seeing is the cost savings. I mean, last year, you know, we saved a lot of money. We started to really reduce contracts and then were, you

know, refocus our efforts instead of doing, you know, 100 small things, you know, that just were going nowhere. We're, you know, we're doing you know, maybe 50 now, you know, 50 big things, right? But we're making bigger investments in things. So we're seeing, you know, better cycle times. We're seeing reduced tools, right? I'm seeing reduced licensing costs because I'm not having as many as such a variety of things or, you know, looking for redundancy and getting rid of the duplicity of tools, right? And saying, okay, look, let's just have one tool to do these things and save some money. So, and then being able to redirect those funds into something else. Ford, Carolyn So this impact, are you seeing it from the modernization efforts in general, or are you thinking about AI specifically that's saved? Dawn Zimmer I think it's both. I think it's both. Yeah, we're definitely seeing, you know, the impact of AI saving time, allowing for, you know, more time to do more things, you know. Ford, Carolyn All right, well, before we go to our Tech Talk questions, is there anything else that we didn't touch on that you'd like to add here? Dawn Zimmer I think we covered like all of my, you know, my things. I don't, you know, it's like I said, it's an exciting time to be in federal government and it's an exciting time to be a CIO. There's every day, every day I go in like,I go in with a smile on my face and super excited to see what the day brings because it's always a new challenge and I just, you know, I love working with my user base and my customers and, you know, being a, you know, providing them with solutions and watching the look on their face and I go, that's so cool, we can do that. get mail and you go, yes, we can do that for you. How soon can I get it? I can have that set up for you in three days. And they're like, really, in three days I can get that? I don't have to wait a week? Nope, we'll have it in three days. So that's the win every day. Ford, Carolyn Your excitement and your passion is infectious. Like I feel like I've just had a hit of probably cocaine's not the PC thing to say here, but like just energy. Dawn Zimmer I, I'm telling you, it's energy is energizing. I mean, I, you know, I mean... Ford, Carolyn Yes, you have just pumped me up for the day. Dawn Zimmer It really is, Carolyn. I got to tell you, this is probably, I mean, I've been doing this a long time and this is the coolest job I have ever had the honor of having. And I feel so blessed every single day that, you know, Greg Barbaccia and Carl Coe were like, yes, we want you as our CIO. Dawn Zimmer I will forever be thankful that, you know, they stood behind me on this because it's just, it is a wild ride. Ford, Carolyn I love it. We definitely got the right person for the job right here. So let's go to our Tech Talk questions. So these are just fun from the gut questions. Dawn Zimmer Yeah? Ford, Carolyn So if you could give every federal CIO 1 superpower to tackle legacy IT or just a superpower, what would it be? Dawn Zimmer It would be the laser sword that allows them to break the complexity of how government systems were built and how the legacy IT just is like a bowl of spaghetti that can never get unwound. Ford, Carolyn So it's the sword of Dawn. It's not He Man's sword. It is the sword of Dawn. Dawn Zimmer Sword of Dawn. Ford, Carolyn 36:56 Honestly, after talking to you, I would give them your superpower. I would say this, it's the Dawn superpower. Ford, Carolyn All right, AI in critical infrastructure. Is it your right hand person or is it autopilot? Dawn Zimmer Definitely your right-hand person. Never trust the con to anybody. Even on the plane, there's always an override. Ford, Carolyn That's right. That is the right answer. Okay, last question. Cybersecurity strategy, fortress walls or intelligent immune system? Dawn Zimmer . Definitely an intelligent immune system. Got to make it easier. Got to have some appetite for a little bit of risk. And, you know, you're just monitoring the symptoms all the time, making sure there's no disease getting in there. Ford, Carolyn . Yep, love that analogy. All right, well, thank you so much for joining us today. Dawn Zimmer Well, thank you. Ford, Carolyn Fantastic start of my day, and I know that you joined me on your PTO, so I really appreciate it. For leaders looking to modernize their legacy systems and adopt AI securely, where can our listeners connect with you to learn more about your work? Follow us on, doe.gov.