More than 47 orders have already been awarded to contractors, and over 50 are “in the pipeline right now,” according to Defense Department Chief Information Officer John Sherman. The figures are up sharply from August, when officials said they were working with more than 13.

“In today’s environment … it is critical more than ever that we provide DOD personnel with secure and resilient software when and where they need it,” Sherman told the House’s Cyber, Information Technology and Innovation panel March 22. Exactly how many orders have been completed thus far was unclear.

The Defense Department in December 2022 tapped Amazon, Google, Microsoft and Oracle to supply digital services for the JWCC, itself the successor to the failed Joint Enterprise Defense Infrastructure venture, or JEDI. The JWCC is valued up to $9 billion over several years. The four companies compete for each order dished out, with each only guaranteed $100,000.

The cloud capability contract is considered the backbone of the Defense Department’s connect-everything-everywhere campaign dubbed Combined Joint All-Domain Command and Control. The CJADC2 concept envisions troops and their databases seamlessly linked across land, air, sea, space and cyber, and spanning unclassified, classified and top secret designations.

“When I testified last year, the department was just beginning the enterprise cloud journey,” Sherman told lawmakers. “I’m happy to report significant and successful progress.”

Cloud is increasingly seen as a means to get the right data to the right people at the right time — a pillar of CJADC2. Sherman last year advised defense agencies, military services and other offices to prioritize JWCC, especially when inking deals involving the nation’s most sensitive information.

The guidance helps streamline cloud contracting and reduces “contract sprawl” across the Defense Department, Sherman said.

His directions for JWCC employment included carve outs for the National Reconnaissance Office, National Geospatial-Intelligence Agency, Defense Intelligence Agency and the National Security Agency. They rely on the intelligence community’s Commercial Cloud Enterprise, or C2E, which was awarded in 2020. It features the same vendors as JWCC, plus IBM.

The department tapped Amazon, Google, Microsoft and Oracle to supply digital services for the JWCC, itself the follow-up to the failed Joint Enterprise Defense Infrastructure venture, or JEDI, in December 2022 in an award worth as much as $9 billion over three to five years. The companies are in competition with one another for task orders, and each is only guaranteed $100,000.

Dozens of orders totaling hundreds of millions of dollars have already been logged using JWCC. The arrangement spans unclassified, classified and top-secret designations and is meant to connect far-flung front lines with established headquarters.

“When we announced JWCC, it was a three-year base with two option years, and we’re already in the one-year base of this,” Chief Information Officer John Sherman said Dec. 13 at the DODIIS Worldwide Conference in Portland, Oregon. “We said all along, in ‘24, in that timeframe, we’re going to start looking at what comes next.”

Sherman provided no timeline for what the Defense Department has previously advertised as full and open multi-cloud and multi-vendor competition. He did say, though, the Defense Information Systems Agency will play a key role in “JWCC 2.0.” DISA is the department’s de facto information technology authority.

“We are firmly committed to mutli-cloud, multi-vendor, and this is what we’re going to be doing moving forward,” Sherman said. “Watch this space. More to follow.”

The JWCC is considered the backbone of the Defense Department’s Combined Joint All-Domain Command and Control initiative, or CJADC2, in which forces and their databases across land, air, sea, space and cyber are interlinked.

Cloud is increasingly seen as a means to get the right data to the right people at the right time — the tenet of CJADC2. Sherman earlier this year instructed defense agencies, military services and other offices to prioritize JWCC, especially when cutting deals concerning the nation’s most sensitive information.

“The JWCC is not a cloud management or hosting environment,” he said in a memo made public in August, “but rather a key vehicle in the department’s technology arsenal for the acquisition of services for current and future DoD component managed and controlled cloud environments.”

Sherman’s directions for JWCC employment included carve outs for the National Reconnaissance Office, National Geospatial-Intelligence Agency, Defense Intelligence Agency and the National Security Agency. They rely on the intelligence community’s Commercial Cloud Enterprise, or C2E, which was awarded in 2020. It features the same vendors as JWCC, plus IBM.

Dahut leads Google Public Sector, launched in June 2022 to target government modernization and the tech-centric needs of national security. She previously worked as the president of Booz Allen Hamilton’s global defense business.

Dahut sat down with C4ISRNET on the sidelines of the Oct. 17 forum to discuss her experience with the company, government adoption of artificial intelligence and cloud, and the ever-changing landscape of cyber. Google Public Sector the same day announced it was collaborating with Accenture Federal Services on a cybersecurity center of excellence.

Portions of the interview below were edited for length and clarity.

How is Google Public Sector shaping up a little more than one year after its launch? Who or what have been some of its biggest focus areas?

I’ve spent the last year, really, traveling around, visiting with customers and prospective customers. There are three things they say, resoundingly, that they need and want.

One is they need to move quickly. They need to move boldly, and they need to transition out of legacy IT.

Two is that they need security built in. I don’t know if you saw Mandiant CEO Kevin Mandia speak earlier this morning, but the number of cyber incidents are quadrupling, the number of zero-day incidents are just growing extraordinarily, and our public-sector customers are experiencing that and seeing that. They need security built in.

Then, the last thing is that they don’t want to do this by themselves; they need really strong technology partners to support them.

I use that as a foundation to say we’re really trying to address those needs for our public-sector customers. Bringing modern cloud to the table, bringing an IL5-compliant cloud that is truly differentiated, because we are accrediting U.S. Google Cloud entirely at IL5, and it has security and AI built in by design. By default, security is built in.

What we have been really evangelizing with our customers is we’re the right partner for you. We’re the fastest growing cloud in industry for a reason. We want to bring this cloud and these feature sets to you to really help you, whether it’s security challenges that you have or to digitally transform using AI.

In your experience, how well are government or defense agencies adopting cloud, something like the Joint Warfighting Cloud Capability? What more can be done?

First of all, it’s quite variable, dependent on the technology leaders that lead the different agencies, how quickly they have moved to the cloud. I think the number is somewhere less than 20% in all of government that have actually transitioned to the cloud and are using the cloud in a meaningful way.

JWCC is a great contract vehicle, right? It’s a contract vehicle that all of the Department of Defense can access and leverage. But the technology leaders inside the agencies need to, first of all, commit that they want to move to the cloud and they want to use cloud and AI and security as a way of modernizing or digitally transforming.

You were at AUSA. If you look at the way the Army is, really, evaluating cloud, moving to a multi-cloud type of organization, really adopting AI and developing use cases to accelerate the mission, it’s super exciting.

There are other agencies that are not nearly as far along, so it really runs a continuum, depending upon who you’re talking to.

How has your defense experience — at Booz Allen, for example — shaped Google Public Sector’s pursuits thus far?

I ran the defense business at Booz Allen for a really long time. And what I know to be true is there are a lot of really earnest defense leaders that want to modernize and move quickly.

I think they are burdened with legacy IT and technical debt that they can’t resolve in a single budget year. They have incumbent providers that are super aggressive. So how can they overcome that? And then, thirdly, there’s a risk paradigm around technology, and particularly AI, that needs to be overcome.

As Jinyoung Englund said on the stage this morning — she’s the chief strategy officer for the algorithmic warfare directorate for the chief digital and AI office — there’s risk in everything.

Let’s not get mired in evaluating all of the risks. Let’s pick some use cases that are not complicated, that don’t create high level of risk for your organization. Maybe it’s a back-office use case, maybe it’s a security use case. It’s something. Let’s get started that way.

My advice for all of our customers has been ‘get started and move quickly.’

Now, to the point you made about drawing a distinction between an integrator and a Google, I think integrators own a lot of the dollars that are spent on technology on an annual basis. Our commitment is to partner very closely with integrators and be partner-first, so that we can really help them bring best-of-breed technology to their customers.

How would you assess the state of AI today, particularly for your government or defense consumers?

Well, I’ll back up and say the state of AI, globally, is that commercial companies are adopting it very, very quickly. I think that should tell you something about, No. 1, the economic benefit that it provides, as well as the mission benefit that it provides.

A significant number of our commercial companies, they’re not experimenting with AI, they are implementing and adopting it. When we have those conversations with federal and state and local customers, we’re like, ‘Let’s take some of the use cases that we’re seeing in our commercial sector, and let’s just apply them, and use them, in the government sector,’ because we think that there’s not a lot of risk in some of those proven use cases.

Now, where they are challenged is, in some cases, they’re not yet transitioned to the cloud. In order to really leverage the benefit of AI, you have to be in the cloud, because that’s where the compute power is.

Sometimes they have to back up and say, OK, in order to do what Company A, B, or C is doing, we need to first transition to the cloud, to get our data into the cloud, to be able to leverage our data enterprise to apply AI.

It might be a longer pathway for them, but it’s still very doable.

What is the cause of that adoption lag between private and public sectors? The Defense Department has been dinged, for awhile, for its slow adoption of new tech.

I think it’s what I talked about earlier.

It’s technical debt. They have to move to the cloud and get there rapidly. It’s a risk conversation that they have.

It’s great to do prototypes, but they have a scale issue, as well. So you need to move from prototypes and pilots to real, scaled implementations. And that scale within DoD is a very dramatically different scale. So leveraging the lessons learned from like a large Fortune 50 company — how did they do it — and applying that same approach.

What’s your read on the shift to zero-trust cybersecurity? Do you feel it’s as bulletproof or revolutionary as some officials make it out to be?

Google is a zero-trust company. We became a zero-trust company, we were really the pioneers in zero trust, because we were hacked in 2008, 2009. Well-known story. We can send you the YouTube links.

But we, Google, decided at that point in time that we needed to adopt an entirely different security architecture, because it was an existential threat to the company. We, over the past 13 years, have really been adopting and implementing zero trust across the board.

It starts with identity and access. That is a really hard thing, sometimes, for the government to get its head around.

If I can identify you as a user — what your appropriate accesses are, and that you are sitting at the computer you say you are sitting at — that is the trifecta of security. Now, do I believe that, at some point down the road, somebody would find a way to hack into that? Quite possibly. But right now, it is the most secure architecture there is.

That’s why we’re working, actually, with DoD to help them think through their zero-trust architecture and how they could move to it.

It’s not easy. I mean, Google has been migrating to this over a long period of time, and we are now in that architecture. It takes time, effort, resources to really dedicate to doing it right.

Is zero trust the right fit for everyone, for commercial companies and these massive government agencies?

The way I think about government and government transformation, if you will, you have to take it in its piece parts. If you look at it with the big picture, it seems overwhelming.

I always talk to our customers about what is the first step you can take today to modernize. I know that if you go out 20 years, this is where you want to be. But let’s back up to today: What is the first step you would take? Let’s take that step.

Maybe the first step is moving to the cloud. Then, once you’re in the cloud, securing your data in a secure way, so that the entire enterprise can leverage that data. So, just taking those incremental steps but with a bold vision.

‘Is zero trust right for everybody?’ is your question. I don’t know that it’s right for everybody, but I also don’t know that it’s not right for everybody.

If you look at the number of security incidents we’ve had as a company since moving there, it’s none. So, what is the value of being able to secure your enterprise in a way that you sleep at night?

The Army considers cloud migration and adoption fundamental to the overhaul of its larger networks and collaborative capabilities. Mastering cloud technology could also help take advantage of artificial intelligence and machine-learning tools as well as provide troops access to data they otherwise wouldn’t be able to get their hands on.

“I believe that right now we are 100% definitely on a good path to start what I call the ‘maturation process’ of how we are employing and deploying cloud capabilities,” CIO Leonel Garciga told C4ISRNET in an interview. “We’re hitting that next step now where we’re validating some of the work that we’ve done. We’re looking, both from an operational and cyber perspective, where we are in the story, and we’re starting to mature the process on how those capabilities get delivered.”

Garciga was named CIO in June after working as the top technology officer for Army intelligence. Prior to taking over the Army’s IT reins, service officials touted a $290 million investment in cloud — an expenditure they said underlines the seriousness of the matter.

“Cloud’s not a new thing, and it more becomes: Where do we have the best opportunity, from a technical perspective, to leverage cloud across the board?” Garciga said. “I think we’re doing a great job there. That’s been a maturing process over the last couple of years that has been interesting to watch, both outside of being in this position and in this position.”

The Army is not alone in embracing the cloud. The Air Force and Navy are tapping the digital ether to ensure information is available when and where it’s most needed.

Underpinning it all is the Defense Department’s Joint Warfighting Cloud Capability, or JWCC. The landmark arrangement with Amazon, Google, Microsoft and Oracle, worth up to $9 billion, is meant to expand the department’s cloud inventory while bridging unclassified, secret and top secret designations.

The contract is considered the follow-up to the Joint Enterprise Defense Infrastructure venture, which was scuttled in 2021 after allegations of political interference.

Garciga said the Army is “all in” regarding JWCC. The service, he added, is working through “the initial stages of getting some task orders right, running through the process.”

More than a dozen orders totaling hundreds of millions of dollars were awarded using JWCC as of August, according to the Defense Information Systems Agency, the Defense Department’s de facto IT authority.

“They’ve been really good partners, understanding where we are in the story,” Garciga said of that agency. “We’ve made a decision to move out on first steps within JWCC, see what that looks like, and keeping some of our legacy stuff on [Cloud Account Management Optimization] until we get the process right, we understand what it looks like, we get some more organic capability to manage the business process of cloud acquisition.”

Pentagon CIO John Sherman has instructed defense agencies, military services and other offices to prioritize JWCC, including when dealing with the nation’s most sensitive data.

He said a number of existing cloud services will transition to JWCC upon expiration.

Garciga said the Army has a calculated plan to transition from where the service is now “because we’ve got some some runway and some space to get there. We’re deliberately looking at onboarding and making sure that we’ve got a good plan to scale at Army size.”

Garciga succeeded Raj Iyer as the Army CIO. He spent years at the Defense Department’s research arm focused on improvised explosive devices. He was also an enlisted Navy submariner and is a graduate of the Navy’s Nuclear Power School.

Under the five-year partnership, announced Aug. 29, Synthetaic will have access to nearly 1 million hours of cloud-computing power. The Wisconsin-based company said it will buttress its Rapid Automatic Image Categorization software, or RAIC, which lets users mine vast collections of photos and other visuals for specific items. Additional terms of the agreement were not disclosed.

“Using AI to extract insights from image data is like building a fire: you need heat (AI algorithm), fuel (data), and oxygen (compute),” Corey Jaskolski, the Synthetaic founder and CEO, said in a statement. “This partnership allows us to combine Azure’s GPU compute and fast data storage running next to our algorithms, which enables our customers to process massive quantities of visual data into actionable insights and models in minutes.”

RAIC was built on the Azure cloud. Jaskolski in a May interview told C4ISRNET that Synthetaic had several government customers and was in talks with the Air Force “on an effort to use RAIC on things like MQ-9 drone data.”

“It’s image recognition, but it’s done differently,” he said at the time. “When we tracked the balloon, we had just come up with this new feature that we call ‘geospatial object detect mode.’ So instead of just finding an area of a map that looked like other things, we could find discrete objects in satellite data.”

Overhead imagery is a resource of increasing importance, with governments, analysts and hobbyists tapping in to monitor their respective surroundings. Photos were used to expose Russia’s materiel buildup ahead of the February 2022 invasion of Ukraine, and, more recently, have shown the scale of devastation in Eastern Europe.

Synthetaic previously partnered with Planet Labs, a provider of Earth-observation imagery.

“We’ll be working with Planet to run this across Planet data, going forward and backward,” Jaskolski said. “It’s actually a really cool use case of RAIC because Planet has a six-year archive going back across the Earth. And, with RAIC, now we can search that archive and find anything.”

The Air Force teased its Cloud One successor in November, seeking industry feedback with a request for information. At the time, interested companies were asked how they might approach managing and modernizing Cloud One while factoring in “recent government leadership direction,” including the National Defense Strategy and a fiscal 2023-2028 information technology road map.

While details about the future arrangement are still being ironed out, C1N, as it’s known, will emphasize zero-trust cybersecurity, identity, credential and access management, or ICAM, and software development, Maj. Gen. Anthony Genatempo said July 31 at the Air Force’s Life Cycle Industry Days event in Dayton, Ohio. Genatempo serves as the program executive officer for command, control, communications, intelligence and networks.

Zero trust is a cybersecurity paradigm that assumes networks and databases have already been breached, thus requiring constant validation of users and devices. ICAM is a means of checking qualifications and then tailoring what information is available to a user.

“We’re bringing in a lot of the CIO’s strategy,” Genatempo said.

The focus on cloud services comes as the Air Force seeks additional data durability and portability. Its forces are among the most scattered, with infrastructure dotting the globe. Cloud One launched years ago, providing access to apps, information and broader connectivity.

Jay Bonci, the Air Force’s chief technology officer, in December told C4ISRNET he considered Cloud One, with its focus on Platform as a Service, or PaaS, a springboard to greater digital modernization.

“Cloud One has been principally focused on a PaaS baseline, so platform as a service, with a heavy focus on refactoring apps to take advantage of PaaS. And in so doing, it has cleaned up a lot of technical debt,” he said at the time. “Undoubtedly, Cloud One has been a huge success, but it’s going to have to continue to look at how it gets more and more and more customers.”

Defense News reporter Stephen Losey contributed to this article.

The Pentagon in December picked Amazon, Google, Microsoft and Oracle for its $9 billion Joint Warfighting Cloud Capability contract, or JWCC, the follow-up to the $10 billion Joint Enterprise Defense Infrastructure deal, or JEDI, which foundered in 2021 after allegations of political interference.

The four companies are competing for JWCC jobs spanning unclassified, secret and top-secret designations, and are guaranteed only $100,000. Each tech giant won work in March in an initial round of awards, which were worth millions of dollars, officials said at the time.

Since then, those involved with the cloud capability have been “pinged constantly” from a “really robust mix” of prospective customers, according to Sharon Woods, the director of the Defense Information Systems Agency Hosting and Compute Center.

“In terms of the task orders, we’re seeing both unclassified and secret requirements, and we have some folks that are early in the process that are interested in the top secret, as well,” she said May 3 at the AFCEA TechNet Cyber conference in Baltimore. “So we are seeing both interest and operational at all three classification levels.”

The JWCC is meant to serve as a backbone for the Pentagon’s connect-everything campaign, known as Joint All-Domain Command and Control, or JADC2. It is also built to complement cloud initiatives already established by the military services. The Air Force, for example, has Cloud One and its successor, Cloud One Next.

Pentagon Chief Information Officer John Sherman on Wednesday likened the multibillion-dollar arrangement to a carrier strike group — powerful, versatile and imposing.

“Here’s the big thing: It’s from the continental U.S. out to the tactical edge,” Sherman said at the conference. “What JWCC brings to the fight is an enterprise cloud capability we’ve not had, and we need for many mission outcomes.”

At the heart of JADC2 is a demand for seamless connectivity, which officials say will enable the speedy relay of information across land, air, sea, space and cyber. The military is increasingly embracing cloud as a means to up its digital resiliency and portability.

The indefinite delivery, indefinite quantity JWCC deal comprises a three-year base and one-year options, meaning work could be conducted through 2028.

The department has already migrated at least 100 apps, relying on its Cloud One program, and has “almost 200″ more in the pipeline ready to go, she said at the AFCEA TechNet Cyber conference in Baltimore. Apps in the military run the gamut, from recruiting to base updates, health information to higher-security matters.

The focus on cloud comes as the department, which includes both the Air and Space forces, seeks additional digital durability and portability. The forces are among the most dispersed, with bases dotting the U.S., Europe and Asia.

“You’ll hear me say that data is the currency of the realm. And what I mean by that is, I have to make sure the data is available. It’s accessible, it’s where it needs to be, that the data can be actionable,” Goodwine said May 2. “I will need the cloud to do that.”

Cloud One was launched years ago, providing access to apps, information and broader connectivity using products from big-name players including Amazon and Microsoft. Science Applications International Corp. now holds the contract, worth hundreds of millions of dollars. The Air Force previously said the move to the cloud can save money, rid of outdated hardware, and reduce vulnerabilities.

Cloud One’s successor, Cloud One Next, or C1N, was teased by the department in a November request for information.

The documents asked companies how they “might approach managing and modernizing Cloud One” while considering “recent government leadership direction.” The National Defense Strategy and the Air Force chief information officer’s strategy for fiscal 2023-2028 were attached to the notice.

Jay Bonci, the Air Force department’s chief technology officer, in December told C4ISRNET industry response to the request was diverse and substantive.

“We’re looking at a couple of different kind of economic models for how we continue to get cost efficiency and get scale for how we’re able to get more applications into the cloud,” he said at the time. “Really, the focus is going to be on adoption.”

A significant difference exists between the services available to personnel on land and on sea, with the latter constrained by intermittent connectivity, constant movement and crowded vessel footprints.

What’s needed, according to Rear Adm. Stephen Donald, deputy commander of the 10th Fleet, is an extension of enterprise systems to “our maritime assets afloat, for all our weapons platforms out there.”

“When we go to the afloat side, I love the cloud, right, but I don’t have access to the cloud all the time,” he said April 4 at the Navy League’s Sea-Air-Space conference in National Harbor, Maryland. The 10th Fleet is directly involved with Navy cyber operations.

“I need industry to figure out how to give me a ‘virtual cloud,’ if you will, while afloat, so that while I’m disconnected, I still have all the capabilities I can possibly have locally,” he said. “And then, when I reconnect, it is seamless.”

Navy vessels dot waters the world over, separated by vast distances and fickle weather conditions, and are expected to play a critical role should the U.S. come to blows with China in the Indo-Pacific or Russia in Europe.

A fight with either world power would put the ships in the line of fire — hacking and jamming, or something more deadly — making connectivity and continuity all the more difficult to maintain.

The ability to rebound, as a result, is key, according to Rear Adm. Tracy Hines, the cybersecurity division director at the office of the chief of naval operations.

“We just need to have more robustness and more resiliency in that area, and I know there’s a lot of people that are working on that,” she said Tuesday at the conference. “I think the big challenge is when you’re in that denied, degraded, intermittent environment, how do you overcome that, so when you do come back online you can still have what you need and keep moving.”

The Navy in December 2022 awarded Amazon a five-year, $724 million contract for access to the company’s commercial cloud, related professional services and training options.

Amazon is also one of four companies picked for the Pentagon’s Joint Warfighting Cloud Capability, a competitive deal worth up to $9 billion. The JWCC arrangement was engineered to complement service-led cloud efforts, not commandeer them, defense officials say.

In his new job, he’ll oversee the development and implementation of the technology strategy for the Google Cloud Platform, according to an announcement shared with C4ISRNET. His first day is March 27.

Weis left the Navy CIO post this month after more than three years atop the service’s information technology, cybersecurity and cloud computing portfolios. During his tenure, Weis pushed the concept of “cyber readiness”: a shift away from standard audits, waiting periods and bureaucracy and toward a continuous measurement of security, proficiency and digital resources.

“It is my assertion, as a little old DON CIO, that the way that we do and the way we approach the problem of cybersecurity is wrong. We’re doing it wrong,” he said in February at the West conference in San Diego. “Readiness is a broader aperture than a 624-line checklist.”

Weis is one of three defense CIOs to announce their respective exits in 2023. Raj Iyer left the Army earlier this year, and Lauren Knausenberger will leave the Department of the Air Force in June.

Iyer has since been hired by ServiceNow, an American IT company. Knausenberger has not publicly said what she’ll do next.