Shana Cromartie

Information System Security Officer (Isso) @U.S. Department of Veterans Affairs

US

As an Information System Security Officer (ISSO) for the Department of Veterans Affairs, I provide comprehensive cybersecurity oversight across multiple mission-critical systems by aligning federal information systems with NIST 800-53, Risk Management Framework (RMF), and VA-specific security controls. I am responsible for the ongoing management of system authorization packages, including the creation and maintenance of security documentation such as System Security Plans (SSPs), Security Assessment Reports (SARs), and Plans of Action and Milestones (POA & Ms).My role includes conducting in-depth security reviews, evaluating system vulnerabilities, managing remediation timelines, and ensuring continuous monitoring practices are in place. I collaborate with system owners, developers, assessors, and third-party vendors to mitigate risks and ensure system confidentiality, integrity, and availability. I actively support ATO lifecycle management, FedRAMP adherence for cloud-based solutions, and internal compliance audits to validate VA’s information assurance posture.Key Highlights:• Lead end-to-end ATO lifecycle support, from initial security control assessment to continuous monitoring, resulting in consistent authorization renewals• Maintain and update RMF documentation and ensure timely submission of POA & M closures and mitigation strategies• Conduct biweekly risk analysis meetings with stakeholders and technical teams to align remediation tasks with VA’s ISSO policies• Utilize tools like eMASS, Nessus, and Splunk to support vulnerability scanning, log review, and security incident analysis• Collaborate across departments to align VA systems with NIST, FISMA, and VA Directive 6500 compliance frameworks• Deliver training and mentoring to junior ISSOs and serve as a liaison between system owners and the VA Information Security Office (ISO)