- CMS Chief Information Security Officer Keith Busby said that the agency is transitioning from a compliance- to risk-based cybersecurity model
- One of the agency’s strategies is to utilize its Cybersecurity and Infrastructure Security Agency’s bug bounty program
- Busby explained that they will abide by a “protect first, visibility second” philosophy
The Centers for Medicare and Medicaid Services is reworking its cybersecurity approach, moving away from a checklist-driven compliance model toward one built on continuous monitoring, attack surface management and real-time threat response, Keith Busby, CMS chief information security officer, said in an interview with Federal News Network.
Busby said the shift is designed to tie regulatory compliance directly to active defense rather than treating the two as separate obligations. “We’re starting to make that transition from just having visibility, but using automated continuous reaction based off of that visibility,” he explained.
The federal government has spent more than 10 years building out visibility into agency networks through initiatives such as the Cybersecurity and Infrastructure Security Agency’s Continuous Diagnostics and Mitigation program. Busby said CMS is now building on that foundation with a “protect first, visibility second” philosophy, using the data gathered through monitoring to trigger automated protective action rather than simply cataloguing risk.
Because CMS operates in the healthcare sector, a frequent target for ransomware groups and other malicious actors, the agency’s overriding cybersecurity priority is preventing any disruption to patient care.
Federal health leaders from HHS, DHA, and more are converging on December 3 to share how they are spending billions on artificial intelligence, modernization and expanded care access. Reserve your seat at the 2026 Healthcare Summit on December 3 and get the inside track on FY27 contracting priorities straight from the decision-makers.
What Is CMS’ Attack Surface Management Approach?
To get ahead of emerging threats, CMS has shifted from relying primarily on system authorization documentation, according to Busby. The agency tracks what is being scanned and what shows up in connection with CMS systems, layering internal monitoring with input from independent researchers. CMS taps into the Cybersecurity and Infrastructure Security Agency’s bug bounty program to invite outside researchers worldwide to probe its public-facing systems and flag weaknesses.
Busby added that the agency’s guiding principle is to keep CMS data inside environments it can directly monitor and control, limiting how often information or system functions move outside networks and assets where CMS can enforce its own security controls. The broader goal, he said, is to pull those functions back in-house so that partners can still carry out their work, but do so within CMS-controlled environments.
How Is CMS Using AI in Its Risk-Based Cybersecurity Model?
Busby also described artificial intelligence as a force multiplier for the agency’s cybersecurity mission. CMS is recruiting recent graduates with AI-related skills as part of a broader push toward in-house hiring intended to cut costs and increase flexibility.
Rather than deploying AI broadly, Busby said his team is targeting specific, well-defined use cases — including alert triage, behavioral analytics, anomaly detection and vulnerability prioritization — so that performance can be closely tracked and the tools can be held accountable.
How Will CMS’ New Strategy Impact Its Cyber Workforce?
To keep up with evolving cybersecurity technologies and approaches, CMS already announced earlier this year that it intends to add about 100 positions to its Office of Information Technology. Busby noted that many recent graduates already arrive with hands-on experience in areas such as agentic AI, and said the agency wants to learn from that incoming talent rather than force new hires to simply adopt legacy practices.
The agency is also bringing more technical functions in-house, including hiring junior ethical hackers — a role CMS has traditionally filled through contractors. Busby said the goal is to give early-career federal employees a chance to learn and experiment on the job, with many expected to advance to larger roles elsewhere in government as their careers progress.
