TriWest Healthcare Alliance counts on John Pontrelli to work effectively with his technology colleagues to provide health care to 2.8 million members of the U.S. military and their families in 21 states. As VP and CSO, Pontrelli’s responsibilities cover both physical security and information security, and he has found it imperative to form a tight working relationship with his CIO, Rick Green. Pontrelli, a corporate security expert at Microsoft and W.L. Gore before joining TriWest three years ago, spoke to CIO sister publication CSO’s managing editor, Michael Goldberg, about the partnership he has formed with his CIO.

Michael Goldberg: In the past, you’ve described TriWest as being an information systems–dependent company.

What does that mean?

John Pontrelli: TriWest is in 21 states, basically the left side of the United States, including Hawaii and Alaska. We have over 120 locations, and they are all connected via WAN to our corporate data center in Phoenix. Most of our sites are on military installations, so we have to coordinate with the military when we come in to set up our routing/switching equipment, as well as bringing in the phone lines. We house two or three major applications that our people hit from all the 21 states to retrieve data and to input data. We have a lot of data traversing our 21–state region at any given time; we also push our VoIP over our wide area network. Our entire company is VoIP, and our security systems also ride over our network, so our network stays busy.

That’s a good segue into the relationship you have with your CIO, Rick Green. Could you describe the nature of that relationship and, in a business like yours, what makes the relationship important?

Rick and I both started at TriWest approximately three years ago. He came in to redefine the IT —not only the infrastructure but the applications— and we had just been awarded a new bid from the Department of Defense. He had a huge challenge in front of him.

I was hired a few months after he came on board. One of the conversations we had was around security and IT. My proposal was that information security should reside in my department, primarily to free him up to focus on connectivity, availability and support in the businesses but also because implementing all of the security requirements that the DoD had levied upon us was somewhat unmanageable. We agreed right there, from the very beginning, that that’s how we were going to set it up and run it.