Christopher Bramwell Email & Phone Number

Salt Lake City, Utah, United States

Appointed by Governor Spencer Cox as the inaugural Chief Privacy Officer for the State of Utah, I am entrusted with the pivotal role of architecting and implementing a comprehensive information privacy program across all levels of government. This position demands close collaboration with public sector entities, private stakeholders, and governmental agencies to ensure robust data protection and privacy practices.In my tenure, I have successfully spearheaded the creation of a statewide strategic privacy plan and played an instrumental role in the enactment of the Government Data Privacy Act (HB491, 2024 General Session). Furthermore, I secured critical funding for the establishment of the Utah Office of Data Privacy, dedicated to assisting governmental entities in fulfilling their privacy obligations.The years 2024-2025 will be transformative for privacy in Utah. Utah will be the first state to hire a Privacy Ombudsperson to provided mediation and dispute resolutions services regarding privacy complaints between governmental entities and individuals. Additionally, the Office of Data Privacy will be hiring for key positions to aid in the creation and implementation of standard Privacy Impact Assessment processes, as well as planning a high-risk privacy monitoring program for certain personal data processing activities.My experience has demonstrated that public employees and officials universally value privacy. Building and maturing privacy programs is challenging, yet achievable through strategic planning and steadfast leadership.

Salt Lake City

Plan and execute department wide security initiatives to improve security posture and compliance.Ensure information security best practices, standards, and requirements are implemented correctly within the agency applications and systems. (HIPPA, PCI-DSS, IRS PUB 1075, SSA, NIST 800 Series)Created and participates in department wide IT Architecture Review Board (ARB) process for application and software requests and approvals. Proposed and oversaw implementation of for security changes that will better the security posture of the agency. Directed and participate in the completion of agency risk assessments and system security plans.Directed and assisted in the development of project requirements to include requirements for security controls Proposed and wrote agency information privacy and security policies.

Greater Salt Lake City Area

Act as DTS liaison with Utah Tax Commission, Department of Human Services, and the Department of Environment Quality to ensure information security best practices, standards, and requirements are implemented correctly within the agencies. (HIPPA, PCI-DSS, IRS PUB 1075, NIST 800)Performs ad hoc vulnerability scans using Nessus and Nexpose to identify system and application vulnerabilities.Provide recommendations and reviews proposals for security changes that will better the security posture of the agencies. Participate in the completion of agency risk assessments and system security plans.Assist in the development of project requirements to include requirements for security controls Assist in the development of designs to ensure that required security controls are accommodated Assist in system/application/network construction to ensure that controls are effectively implemented and that any design changes effectively accomplish required security control objectives • Test the effectiveness of information security controls • Analyze test results • Report on the effectiveness of tested controls • Provide recommendations for additional or modified controls where deficiencies exist

Pocatello, Idaho Area

Performed system/ network mapping and vulnerability assessment as part of System Security Plan (SSP). Participated in the planning, setup, and system administration of a new computer lab. This included gaining management approval for project, completing acquisition of all required hardware and software, the actual setup of the lab, and completing the associated SSP/C&A requirements for the lab.Planned and managed the development of a virtual Industrial Control System in which hacking and defense abilities can be practiced and tested.Participated in weekly roundtable discussions of FISMA, FIPS, NIST, and Risk Management Framework which has led to a strong understanding and working knowledge of many components of the standards.Participated in strategic security planning for ISU and the creation of a new Security Operation Center, snort/snorby IDS system, and continuous monitoring system.Additional job functions and experience gained include packet analysis with Wireshark, port/network mapping with Nmap, basic forensics imaging and analysis with FTK.

Arlington, Va

Completed beginning, intermediate, and advanced DHS Control System Security Program which increased penetration, hacking, and defense skills in industrial control systems (ICS) and SCADA environments while also increasing working knowledge of specialized ICS protocols (DNP3, MODBUS, etc.).Worked with project teams to create and prepare deployment of the NICE Framework and its associated standards. The framework is a new classification system for the entire federal IT/ 2210 workforce which defines jobs, specialty areas, and KSAs.Participated in planning for 2012 NICE Workshop, including the planning and coordination of professional cybersecurity demonstrations.

Mba, Information Assurance, Computer Security

Activities and Societies: Running

Ba, Political Science

Education record