Steve Wallace, the agency’s chief technology officer, said at the 2024 TechNet Cyber conference presented by the Armed Forces Communications & Electronics Association International that this is a way of getting at a common problem in the Defense Department: a focus on emerging technology without a clear understanding of the problem its intended to solve.

“How does the department understand what you all can bring forward?” he said to a crowd of industry leaders and other cyber professionals in Baltimore June 26. “And then at the same time, how do you understand what the heck we actually need? There’s always that friction there.”

It’s not just an attempt to speed up the acquisitions process as the Pentagon is in a race for digital dominance against China and other nation-state hackers. So much of the conversation around cybersecurity in national defense is around pacing, but with industry constantly coming to market with new tools, there’s a need by government to be a wary purchaser.

These problem statements are a potential way for the Defense Department buy the tools, not just the shiniest ones.

“I think there is that risk that we get excited by new things — which are exciting — and we want to play with them and explore and see what’s possible,” said Scarlett Swerdlow, a senior technical strategist in the DISA’s Emerging Technology Directorate. “But at the end of the day, we have to make sure we’re solving a real problem that a real person has.”

The government often tries to emulate industry. But startups in Silicon Valley aren’t tied to a congressional budget cycle. And they have the room, and often the in-house expertise, to fail fast and pivot often. And though the Defense Department is at the mercy of a constantly changing threat landscape, DISA officials said at the conference that it can be enough for DoD to allow industry to do what it does best and be an evaluator when it comes time to settle on a solution.

“It is our ability to interface with industry, but knowing that the dollars that mature the technology are industry dollars, and not tax dollars, and then understanding where to apply some tactical patience as industry develops tech and [then we] insert ourselves,” said Army Maj. David Courter, chief of combatant command plan integration with the J-5. “I think that’s much different than us writing an initial capabilities document and saying, ‘I need you to build this cool tool.’”

Cautionary tale

One cautionary tale came to mind: the Joint Regional Security Stacks, an ambitious plan to massively consolidate the DoD’s sprawling IT infrastructure that set to be wound down in 2021 following reports of cost overruns and unresolved complexities.

At inception, it was supposed to be a gamechanger for the department, but a 2019 inspector general audit revealed it ultimately wasn’t meeting end users’ needs.

“The whole notion behind JRSS was best of breed for every component in the doggone stack,” Wallace said. “We are going to have the very best of everything. And then we are going to attempt to integrate or interoperate between all these components. Didn’t go well.”

The other issue is ensuring that DoD can verify for itself whether a tool actually does what it claims to do when its adapted for military or defense purposes. That comes into play when the department thinks about how buying one system must be able to operate with existing ones and those to come.

“[That’s] another reason to add that in-house talent that can … test some of those claims that products make,” said Swerdlow.

Along with this change in thinking comes changes to the processes that govern how the DoD defends its network and that includes implementing Zero Trust Architecture. A year after issuing its initial guidance, the Pentagon is ahead of the curve in its Zero Trust journey, but individually every component is at a different mile marker, facing their own unique challenges.

DoD CIO John Sherman announced in early September that the Pentagon would be assessing the Zero Trust plans of every component, an action he identified as a “very important milestone.” The review will make sure plans are consistent with the agency’s broader zero trust vision and the 91 capabilities outlined to achieve targeted zero trust goals by 2027.

While the DoD begins its assessment, these components should be looking ahead to the next phase of their plans and begin implementing their specific strategies. There is a lot of work ahead, but by utilizing best practices — both technical and non-technical — developed and honed by the private sector, the DoD can take meaningful action to strengthen cyber strategies.

Starting wherever you can

DoD entities including the Defense Information Systems Agency have advanced quickly in their Zero Trust journeys, harnessing the power of AI and other innovative technologies to implement advanced threat detection algorithms, multi-layered encryption protocols and real-time monitoring to counteract cyber threats. Not every component has the in-house expertise or technology that DISA does to make those big leaps. But everyone has the capabilities to pick a place to start and make meaningful progress.

For example, for those having trouble moving from the planning to the implementation stage, a great place to start would be getting an accurate inventory of users and devices. Not only will this make it easier to get the right permissions to the right users from the start, but it will also give Network and IT teams a chance to make sure access privileges for former employees have been revoked.

Risk tolerance is another quick entry into Zero Trust implementation that doesn’t involve a big technological lift. That means IT and security teams need to identify the minimum threshold for letting a user have access to certain parts of the network. User access is dynamic, changing by the day depending on the situation. Because of that, the minimum threshold must be monitored and re-evaluated to make sure everyone is getting the access they need to complete the mission and keeping anyone out who shouldn’t have access.

More than just security

It’s also important to remember that implementing Zero Trust isn’t just about making DoD networks more secure, it’s also about fitting into a larger modernization vision that can help the Pentagon realize better performance for the mission. Reinforcing that cultural mindset in both messaging and communications will help everyone, down to the least technical employee or military member, realize why this effort is so important and where they fit into the process.

This leads into another action DoD components can take in their initial stages of implementation. IT teams should begin the process of understanding the role each person employed by the agency, what information they should have access to and when they should have access to it. This will be a huge help as the process moves forward because mapping the flow of information in this way helps IT and security teams build in permissions and requirements early on rather than trying to build them in piecemeal after the fact.

DoD components, from the foxhole to the flagpole, all have a long way to go before hitting the goal of full Zero Trust implementation by 2027, but that shouldn’t invoke anxiety. Much like any other important technology initiative, every step forward counts. No matter where you are in your implementation story, the goal is to keep moving and keep pushing for the foundational cultural and technological changes that need to happen to stand up a true Zero Trust architecture over the next four years.

Mark Wiggins, is Director DoD, IC, and Federal Systems Integrators at Fortinet Federal, a unit of Fortinet Inc. focused on modernized and secure infrastructure for the U.S. Government.

The plan aims to dismantle organic data silos and encourage integrated network capabilities, thus improving functionality in the agency’s management systems, while embracing DoD structures and strategies.

It will also guide how the organization will manage and exploit data as a critical asset, highlighting the evident value of implementing modernized cyber architectures in the public sector, which ensure that decision-makers can collaborate using interoperable and secure data networks.

There are a few areas that could impact the outcome if they were called out more explicitly, including C-suite alignment, setting intermediate goals and workforce development — all of which are essential to planting a data-centric approach for any agency.

C-suite alignment and coordination

C-suite alignment throughout any information technology-based process is critical for mission success, especially when discussing an enterprisewide data strategy. A strategy or plan would greatly benefit from further clarification on how to navigate the responsibilities between the chief information officer, the chief information security officer and the chief data officer in order to build a successful, data-driven culture.

Role clarity is essential here. While the plan mentions the three titles, it implies but does not encourage collaboration between them. And while each agency has its own relationships, these three positions need to be in sync to meet mission objectives effectively.

Defining intermediary goals

The IPlan is ambitious and lists out goals and initiatives with 2023 deadlines; however, it would help to better define those that are essential for a strategic plan rollout, or offer guidance on what’s needed for effective implementation in the long term.

The plan does outline final goals and objectives, looking at where agencies should strive to be at the end of this data journey.

Intermediate goals keep an organization’s team aligned throughout the process — and most importantly on the right path toward success. Regardless of the agency, all aspects of an organization’s data strategy goals should be clearly tied to data-driven outcomes that directly support missions.

If results and progress aren’t measureable, they don’t exist; there’s a need for clear benchmarks and methods to track the implementation process for immediate feedback and understanding. While setting clear, measurable, data-driven goals is vital, without the proper workforce and organizational culture, meeting them can be tough.

Workforce development to support a data-centric approach

The IPlan’s goals have a fairly aggressive 2023 timeline, but as it stands, DISA needs to ensure it has the staff and expertise to accomplish its mission. As the DoD has moved to a more data-centric approach regarding plans and strategy, we’ve learned there aren’t enough cyber and data trained professionals to perform necessary functions.

As recently as five years ago, these plans and data-specific roles did not exist. Now there’s a law on the books supporting the position of a CDO. While it’s encouraging to see DISA prioritizing data through the implementation of data strategies and plans, a path to creating a more data-savvy workforce is necessary. Now that organizations are trying to be data centric and make data the core for more informed decisions, the need for a workforce that’s trained in these technologies is vitally necessary.

Overall, DISA’s IPlan is a solid step forward for guiding internal data practices, providing insights and goals to guide them in reducing data silos while managing and exploiting data as a critical asset. With a clear understanding of data and a trained and developed workforce, DISA will be able to provide informed insights to senior leaders that they didn’t have before. Setting clear, measurable intermediate goals and benchmarks will allow an organization to stay on track with its data initiatives.

The long-term goal for any organization serious about making progress with data is to establish a data-driven organizational culture that begins with leadership. Alignment at the C-level is crucial to ensure success in advancing data usage in government.

Also, digital transformation must become more efficient; it’s about seeing how few resources can be used to achieve a favorable outcome. This is why data is key to successful transformation.

Understanding how data can be used to make informed decisions based on factual evidence and increased visibility will propel an organization’s mission and lead to reduced resource spend.

Rob Carey is president of Cloudera Government Solutions. He previously served as principal deputy chief information officer for the U.S. Defense Department.

The documents detail the more than 100 activities, capabilities and pillars needed to achieve zero trust, a new paradigm for cybersecurity. The strategy fits into a larger constellation of security planning that includes the recently released National Defense Strategy, officials said.

“If we compare this to our home security, we can say that we traditionally lock our windows and doors, and that only those with a key can gain access,” Randy Resnick, the director of the zero trust portfolio management office, told reporters Nov. 22. “With zero trust, we have identified the items of value within the house and we’ve placed guards and locks with each one of those items inside the house, as well.”

Unlike older cybersecurity models, zero trust assumes networks are always at risk or are already compromised. As a result, continuous validation of users, devices and access is required. Pentagon Chief Information Officer John Sherman has likened it to trusting “no one or no thing.”

The transition to segmentation and inherent distrust comes as the U.S. prepares for a potential fight against China or Russia — world powers with histories of cyber aggression. Russia has deployed cyberattacks against Ukraine in its latest invasion, Western authorities say, and China leverages the digital domain to siphon intellectual property for its own gains.

The Defense Department has since 2015 experienced more than 12,000 cyber incidents, with yearly totals steadily declining since 2017, according to a Government Accountability Office evaluation. The federal government in early October said hackers infiltrated a defense industrial base organization, maintained “persistent, long-term” access to its network and absconded with sensitive data. The victim — most likely a defense contractor — was not named.

“Cyber threats and attacks are evolving at an ever-increasing pace and requiring a coordinated, defensive response that is adaptive, flexible, and agile,” the zero-trust strategy states. “Traditional perimeter or ‘castle-and-moat’ security approaches based on conventional authentication and authorization models do not work effectively to thwart current (and future) cyber-attack vectors.”

Defense officials previously imposed a five-year deadline to implement zero trust. The strategy maintains the fiscal 2027 timeline, which cybersecurity leaders described as challenging but important.

“Implementation of our zero-trust goals, to include educating every corner of the department, is an ambitious undertaking,” acting Principal Deputy Chief Information Officer David McKeown said. “We recognized that from the beginning, and that has driven our pace and informed our strategy.”

The Defense Information Systems Agency in late July extended a zero-trust agreement known as Thunderdome with Booz Allen Hamilton, the 22nd largest defense contractor in the world by revenue, according to a Defense News analysis.

DISA at the time cited lessons learned from Russia’s attack on Ukraine and the need to further harden the Secure Internet Protocol Router Network, or SIPRNet, a means of relaying secrets.

DISA, the Pentagon’s lead IT agency, in January awarded Booz Allen the $6.8 million contract to develop a Thunderdome prototype. The subsequent extension stretches the pilot to a full year, with completion now expected at the start of 2023.

The Defense Department in 2021 decided to sunset Joint Regional Security Stacks in favor of the zero-trust Thunderdome approach, C4ISRNET reported.

“The deeper we dug into JADC2, we realized that more things that the agency does are impacted and part of this,” said Brian Hermann, director of DISA’s services development directorate, in an interview with C4ISRNET. “We’re going to play probably a growing role in JADC2.”

DISA manages the Department of Defense Information Network (DoDIN) and provides global connectivity to the department’s enterprise network. As the services build their systems for Joint All-Domain Command and Control, an effort to provide unprecedented amounts of data to commanders from across the battlefield, Hermann said DISA expects to play a role in network transport, data hosting and ensuring the department has spectrum access to allow networks to function.

“[It’s] how do we make sure that that the sensor data gets to the decision makers and the decision-making capabilities as quickly and cleanly as possible,” Hermann said.

Hermann said he expects DISA’s role to grow specifically to aid the Joint Force’s network transport needs. DISA generally doesn’t focus on tactical transport, rather it’s centered on long-haul, global connectivity back to the DoD network, which allows commanders to receive the information they need. As JADC2 progresses, DISA’s transport role will evolve, he said.

“Now what we have to do is we have to look at the JADC2 requirements for transport and we have to say, ‘What do we do differently?’ Do I need to make them somehow more robust than what I had originally planned our connectivity between theaters or between specific sites?” Hermann said.

DISA will also contribute cybersecurity capabilities for JADC2. It’s developing one capability, known as Thunderdome, a zero-trust cybersecurity initiative that could help solve some of the military’s cybersecurity challenges related to JADC2. DISA recently released a request for whitepapers for Thunderdome and plans to start prototyping “pretty quickly,” Hermann said.

Military officials have said that while JADC2 seeks to make data ubiquitous to warfighters, allowing only authorized users to access the data is tricky. That gets even more difficult when data is crossing different levels of security classification, an area where military officials have said they haven’t seen a viable industry solution that would work on the contested battlefield.

Speaking at the TechNet Augusta conference in late August, DISA director Lt. Gen. Robert Skinner said “identity management is, I would offer, the number one issue that we have got to address within the department in pushing toward zero trust.”

The services are interested in DISA’s work on identity, credential and access management, according to Brig. Gen. Rob Parker, the chairman of the Pentagon’s JADC2 cross-functional team and deputy director of the Joint Chiefs of Staff J-6. Parker said at the Defense News conference earlier this week that a DISA ICAM solution could be available in the next year if properly funded.

DISA is also modernizing two legacy systems that feed into warfighter’s common operating picture, a tool that allows users to have common views of the battlefield. The agency is modernizing its Global Command and Control System-Joint, a battlefield awareness tool, and a force planning tool called Joint Planning and Execution Services, a modernization of a legacy program known as Joint Operational Planning and Execution Services.

According to Hermann, the situational awareness working group on the JADC2 Cross-Functional Team has an ongoing program decision memorandum study exploring the military’s future situational awareness needs. GCCS-J modernization is part of that discussion.

“Those are pending discussions that are ongoing right now,” Hermann said. “So a big part of it is what do we have now in GCCS-J and what do we think it ought to look like. And so we’re part of those discussions we’re looking at how that transition is going on there.”

As it considers its contribution to future U.S. war fighting, DISA is grappling with its portfolio of legacy command-and-control systems that were effective during the last few decades of conflict, but may not be suitable for the data-driven warfare of the future. Hermann said there is “some question” about the role of legacy command-and-control systems moving forward.

“The ability to plan forces in the competition phase, as well as in the hot phases of action, are something [where] we depend upon those legacy tools,” he said. “That said, the architecture of those tools is today not really very JADC2-focused because there are many enclaves around the department that provide separate pieces of the common operational picture that are then stitched together at the enterprise level.”

The goal in the modernization, he added, is to host the capabilities at the enterprise level to increase access, deliver updates and ensure cybersecurity. Until recently, Hermann said, GCCS-J had a separate modernization project known as GCCS-Joint Enterprise, but the Joint Staff redirected the agency to modernize the existing capability incrementally. Moving away from the legacy systems to enable JADC2 is a challenge.

“When you look at demonstrations associated with JADC2, sometimes what you find out is under the covers they’re getting the data from a legacy service that’s already there,” Hermann said.

Mark Pomerleau contributed to this report.

WASHINGTON — The Department of Defense announced Tuesday it canceled its contract with Microsoft for an enterprise cloud to bring decisive data to the battlefield, a nearly four-year-old project that never started because of a challenge by Amazon Web Services.

Citing the delays, a DoD spokesperson said the requirements of the Joint Enterprise Defense Infrastructure contract worth up to $10 billion “no longer meets the department’s cloud needs,” and the Pentagon announced an alternative to work with both companies, the only two the DoD has found that are capable of filling its requirements.

With the new Joint Warfighter Cloud Capability, AWS — along with Microsoft — is likely to win a piece of the lucrative business it has sought since the acquisition stage for JEDI cloud started 2017. AWS eventually challenged the single-company award in court, partly over accusations that then-President Donald Trump interfered with the decision because of his public feud with Jeff Bezos, who just stepped down as Amazon CEO.

The department plans to send Joint Warfighter Cloud Capability solicitations to the two tech giants in mid-October and said the pair will “likely” be direct awardees, acting DoD CIO John Sherman said. The department aims to make awards to the vendors by April 2022 in order to fulfill the department’s “urgent, unmet need” for an enterprise cloud capability, he said. The department also plans to do market research into other U.S. cloud giants.

“If we determined that additional vendors can also meet our requirements, then we will extend solicitations to them as well,” Sherman said on a call with reporters.

The department is aiming to make the direct awards by April next year, Sherman said. The cloud contract will be in the “billions of dollars,” he said, but the amount won’t be finalized until the market research is complete in October. The department anticipates a “full and open” competition for cloud providers in 2025. The contracts will have a three-year base period and two one-year options.

“We believe this contract period is both appropriately brief for a direct award and long enough for us to start to leverage the new enterprise capabilities as we fully develop our longer-term plan,” he said.

In the press call, Sherman stressed that the new cloud capability was a necessity to enable department initiatives, including the Pentagon’s future war-fighting strategy of Joint All-Domain Command and Control and its Artificial Intelligence and Data Accelerator, announced last month by Deputy Defense Secretary Kathleen Hicks. An enterprise cloud is a requirement for JADC2, the Pentagon’s vision for connecting sensors and shooters, according to the three-star tasked with coordinating the concept.

“If you think about the challenge we have in AI, in amalgamating data and sharing data, what it means to take processing and move that processing requirement to the tactical edge, without a cloud none of this” is possible, Lt. Gen. Dennis Crall, CIO/J-6 of the Joint Staff, said at the C4ISRNET conference in April.

The JEDI cloud’s troubles extend back several years when pre-bid protests and a related court case delayed the contract award. After ultimately awarding the cloud contract to Microsoft over Amazon Web Services, largely viewed by experts as an upset, AWS sued the DoD in the U.S. Court of Federal Claims in late 2019. AWS alleged the department erred in its technical evaluations and that Trump interfered with the selection.

Last year, the court halted the department and Microsoft from building the enterprise cloud, delaying the project seemingly indefinitely. Earlier this year, the court ruled that it wouldn’t toss out AWS allegations of political interference, adding months of continued litigation and casting doubt over the future of the JEDI cloud.

In a blog post, Microsoft’s President of U.S. Regulated Industries Toni Townes-Whitley wrote that the company is pivoting to the “way forward.”

“The DoD has a critical unmet need to bring the power of cloud and AI to our men and women in uniform, modernizing technology infrastructure and platform services technology,” Townes-Whitley wrote. “We stand ready to support the DoD as they work through their next steps and its new cloud computing solicitation plans.”

In a statement, an AWS spokesperson applauded the department’s decision.

“We understand and agree with the DoD’s decision,” the spokesperson said. “Unfortunately, the contract award was not based on the merits of the proposals and instead was the result of outside influence that has no place in government procurement. Our commitment to supporting our nation’s military and ensuring that our warfighters and defense partners have access to the best technology at the best price is stronger than ever.”

Top IT staff in the Pentagon have consistently stressed the department’s need for an enterprise cloud to connect war fighters at the tactical edge with huge amounts of data. The department has stated that the JEDI cloud would be crucial to the Pentagon’s artificial intelligence, software development and data storage efforts. The JEDI cloud was supposed to house 80 percent of DoD systems.

In front of a subcommittee of the House Armed Services Committee last week, Sherman reiterated the Pentagon’s need for an enterprise cloud.

“We still have an urgent, unmet need for an enterprise cloud capability at all three security levels … that extends all the way from the headquarters all the way to the tactical edge and that has not gone away at this time,” Sherman said.

“The war fighter is absolutely waiting for this.”

“It is one of the crown jewels that we have as part of our IT reform.”

The first quote is how former U.S. Defense Department Chief Information Officer Dana Deasy described the department’s need for the Joint Enterprise Defense Infrastructure cloud contract in August 2019. More than a year and a half later, the enterprise cloud that was supposed to house data across all classification levels hasn’t been built despite a contract award in late 2019.

The second quote comes from one of Deasy’s deputies about the Defense Enclave Services contract, an IT services deal to create a common network for DoD offices that aren’t under the military services, known as the fourth estate agencies.

What do the two contracts have in common? Officials are emphatic that they serve a critical needs for the department, resulting in flashy price tags awarded to a single company for each project. The JEDI cloud has a ceiling of $10 billion over 10 years, while the DES contract could be worth more than $11 billion over a decade.

The JEDI contract attracted the major cloud providers, with Microsoft ultimately winning, but it has been tied up in court over accusations of political interference and evaluation errors. Likewise, the DES contract will attract major IT integrators. Could the department stumble into another boondoggle with the DES contract? Experts told C4ISRNET that any high-dollar procurements are likely to face protests, but they don’t expect the say level of controversy.

“Any contract can be protested,” said David Mihelcic, former chief technology officer of the Defense Information System Agency. “It seems like the trend these days [is] most large contracts are protestable.”

The JEDI cloud is meant to serve as an enterprise-wide cloud computing environment that will carry 80 percent of the department’s systems in an effort to reduce stovepipes to ease access to data. The DES contract, meanwhile, contains cloud computing services, network management, IT infrastructure and help desk services.

“It’s a forcing mechanism to get all of the fourth estate agencies on a set of standard services,” said Chris Cornillie, a federal technology market analyst at Bloomberg Government. “It’s basically a way to get everyone on the same page, much in the same way that JEDI cloud was originally devised as a way to get all of the military services onto the same platform, enabling them to share data and leverage artificial intelligence.”

The Defense Enclave Services contract has been a much quieter process so far. The department released its final RFP in December without problem, a far cry from the JEDI cloud RFP that was twice protested as unfair after its release and later ended up in court.

The JEDI cloud further suffered in part because of the intrigue around involvement in the contract by President Donald Trump, accused by Amazon Web Services of meddling in the contract to steer the lucrative award away from AWS because of the former president’s distaste for Amazon CEO Jeff Bezos.

“I’m certain you’re not going to see that level of intrigue with this is DES competition,” said Mihelcic, now a consultant at technology market insights firm DMMI.

Another key difference is that JEDI would have massive business implications for major cloud providers if a single vendor was able to demonstrate that it could take on databases hosted by a competitor, Cornillie said, but with DES, it’s a “traditional competition among government contractors.”

He also pointed out that DES will have several subcontracting opportunities, whereas with JEDI, the winner would keep the bulk of the cash.

“It’s perhaps not a total loss for an integrator that doesn’t win the prime spot” on the DES contract, Cornillie said.

Alleged technical errors have been a thorn in the side of the department on cloud acquisition lately. A Court of Federal Claims judge halted work on the JEDI cloud based on AWS’ accusations that the DoD technical evaluators incorrectly reviewed the company’s proposal. In another $7 billion cloud contract, known as the Defense Enterprise Office Solutions cloud, the DoD twice accidentally released proprietary information to a competing company, delaying the award several months.

To ensure another critical solution doesn’t face similar fates, the department will have be meticulous through each stage of the contracting process.

“The losers (of the DES contract) will think long and hard about whether or not the evaluation was conducted fairly and equitably and may end up protesting that, but we’re not going to see anywhere near this level of intrigue” that came with JEDI, Mihelcic reiterated.

The creation of a zero-trust portfolio management office would provide “critical centralization and orchestration” for the department’s move toward the advanced cybersecurity architecture, in which users are are assumed to be unauthorized throughout the network unless proven otherwise, DoD chief information security officer David McKeown. McKeown was testifying before the Senate Armed Services Committee’s cybersecurity subcommittee.

The department has launched several pilot projects testing zero-trust concepts in the last two years and earlier this year the Defense Information Systems Agency and the NSA worked on zero-trust reference architectures.

If the Pentagon’s CIO shop establishes the portfolio management office, it would be responsible for “consolidating” talent from across the department, including network administration and cybersecurity experts, to manage “the complex task of moving the DODIN to this new cybersecurity construct,” McKeown wrote in his testimony.

The office would also be responsible for a campaign about the benefits of zero trust and would share best practices within the department, mission partners, the defense industrial base and allies, he said in written testimony. The office would also be develop a “strategic roadmap” for the department’s move toward zero trust. Russ Goemaere, a spokesperson for the DoD, said the office would “aim” to set up the portfolio office in the next six months.

McKeown also highlighted the Air Force’s Cloud One, its enterprise cloud, as a cloud-native zero trust environment and added that several DoD systems have migrated to that cloud environment. According to the McKeown, Cloud One implements all of the components of zero trust the DoD considers “pillars”: users; applications and workloads; devices; data; networks and infrastructure; visibility and analytics; and automation and orchestration.

Moving to a zero-trust model in the department’s cloud computing environments is critical given that cloud computing is central to the Pentagon’s digital modernization strategy and the Defense Information Systems Agency future plans as the department’s primary IT provider. DISA, in partnership with the DoD CIO, NSA and Cyber Command, is creating a zero trust lab to test zero-trust capabilities.

As part of the department’s push toward zero-trust, DISA is also working on a cloud-based internet isolation tool that allows users to remote browse the internet securely.

McKeown said the department is also taking another step toward zero-trust cybersecurity through a new enterprise-wide identity, credential and access management tool from DISA. He said that the department is already onboarding many of the department financial systems onto that tool.

“We believe that that will be the exemplar that we adopt across the board across the department,” McKeown said.

The statement from Air Force Lt. Gen. Robert Skinner signals that the new leader of the Pentagon’s combat IT support agency plans to maintain the department’s push to outsource IT services to vendors to increase efficiency and savings.

“I’m a big proponent of commercial IT as a service,” Skinner said at the AFCEA Rocky Mountain Cyberspace Symposium. “We have to be careful as we kind of move forward with this. … I think we really need to get after this in a more holistic look and a faster pace.”

The Air Force, Army and Navy each have ongoing enterprise IT as a service projects underway, with some IT officials looking to expand. Last year, a deputy program manager at the Army enterprise IT office said there’s “probably nothing that we’re not looking at as ‘as a service.’”

Skinner, who took over DISA at the beginning of the month, echoed the sentiment, saying that the military should be “really getting after where we can leverage commercial technologies.”

“Why would the government develop something when there is something that’s already out there from a commercial standpoint? Or why would we take something that’s commercial and … bastardize it to the point of it is a one-off or it’s very unique, just for the government?,” Skinner said. “Very few times do I think that we should be we should be doing that.”

He also critiqued the military IT community’s lack of mobility, citing it as a major area where the industry can help. The work from home of the last year, he said, demonstrated that the department needed to ensure senior leaders and service members are “able to effectively communicate, effectively command and control no matter where they are at.”

“There’s a lot of the haves and the have nots right now in relation to the ability to do 100% of your mission, no matter where you’re at,” Skinner said. “If I think from industry’s standpoint, you can continue to help on that.”

The three star is taking over as the department approaches the one-year anniversary of its Commercial Virtual Remote Environment, a cloud-based platform that gave DoD components the ability to collaborate on unclassified work throughout the pandemic. DISA, then under now-retired Vice Adm. Nancy Norton, played a crucial role in rolling out that platform.

Skinner also wants the joint force IT professionals to “take care of the irritants,” which he described as manual IT processes that can be replaced with robotic process automation, a tool that would allow soldiers to focus on higher-level challenges instead of tedious and time consuming IT tasks.

“How do we leverage the robotic process automation — bringing that into the fold with the combatant commands — to, I’ll say, take care of the irritants, so that the focus can really be on the command and control, the forces, getting after strategic competition in their area of responsibility,” Skinner said.

Now, DISA Director Vice Adm. Nancy Norton, who led the agency through it all, is retiring after three years at the helm of DISA and a 34-year Navy career. In the last year, her agency had to prepare DoD networks for a spike in remote work, helping to roll out the Commercial Virtual Remote environment for videoconferencing, file sharing and other collaboration.

“It is pretty amazing when you think about what would have happened in 2020 if any of that had come to fruition, you know, if they had started to eliminate and dismantle some of the things that DISA does,” Norton said in her last roundtable with reporters Thursday.

Norton attributes the agency’s success at staving off elimination to doing a better job of broadcasting what exactly DISA does. With so many different missions, she said, it’s difficult to get the full picture of DISA’s responsibilities, so messaging was important.

“The most important things that we did that helped to, to prevent that from really getting traction and coming to fruition [was] … telling our story, helping people to understand … what we actually do,” Norton said. “DISA is what you’ve had a personal experience with, but very few people can stand back and have the full picture of the scope and scale of the missions that DISA is responsible for and how significant that is, and how almost impossible … how difficult it would be to move many of those missions somewhere else.”

In recent years, DISA has delivered secure mobile devices to service members, became a central hub for DoD’s commercial cloud offerings, and established an enterprise email program that gave service members one email that followed them around from base to base. The agency also provides cybersecurity, spectrum, command and control services, and several other IT-related services under its $9.4 billion budget, in addition to its contracting arm.

Norton added that DISA increased its transparency to help people better understand its role. She said the agency made an effort to better explain how it works and spends resources.

“The reason why we were stood up was because we needed a joint organization to focus on joint interoperability across the services and not those unique stovepipe capabilities that are optimized for a service and a domain, but not for the joint force, which is how we fight,” Norton said.

DISA’s responsibilities have expanded further since House lawmakers tried to eliminate the agency, with the agency to become the single IT service provider for the department’s fourth estate agencies that handle business tasks. Norton said that DISA has proved itself to be a trusted partner in recent years in part because she prioritized empowering O-6s embedded with combatant commands and other DISA mission partners to be the agency’s “forward face.” The effort helps partners better understand DISA’s capabilities and lets the agency learn more about their needs.

“It’s a constant loop of ‘What are your requirements? What are the capabilities that we can deliver? How do we get that better? How does this feed into your effectiveness?’ And so that’s what’s really been important,” Norton said.

Air Force Lt. Gen. Robert J. Skinner took over Friday as the new director.