“I’m happy to share that I’m starting a new position as Acting Chief Information Officer at United States Department of Defense,” Beavers wrote in July on LinkedIn. The department’s website now lists her as acting CIO.

A spokesperson for the Pentagon did not immediately return a request for comment.

As the primary IT adviser to the defense secretary, Beavers is taking over from former CIO John Sherman, who stepped down in June to take a position outside government as dean of the Bush School of Government and Public Service at Texas A&M University.

Previously serving as the principal deputy CIO at the Pentagon, Beavers is well acquainted with the Defense Department’s many ongoing initiatives meant to secure the defense-industrial base, develop 5G technologies and explore artificial intelligence.

Since she came to the department, Beavers has worked on landmark endeavors like Project Herald, the Pentagon’s plan to transform digital intelligence sharing, and Fulcrum, the recently announced IT transformation strategy. The latter is where she is most focused now on building momentum, she said in her LinkedIn post.

“[That] gives you tangible steps to turn that strategic vision into an operational reality,” Beavers said at the 2024 TechNet Cyber conference in Baltimore, which took place June 25-27. “It’ll be followed by an implementation plan, which will give some more information.”

The former Air Force intelligence officer and retired brigadier general comes to the position at a time when the DOD is beginning to put many of its theories around zero trust, cloud computing, machine learning and cybersecurity into practice.

The department for several years now released guidance thanks to the help of working groups and testing approaches via pilots. Now, officials say, it’s in a position to actually phase in solutions. The department has a goal to come up with a data tagging and labeling strategy by the end of the calendar year.

Beavers also said at TechNet Cyber that she anticipates growth in the Joint Warfighting Cloud Capability procurement vehicle as other contracts begin to expire.

At the same time, challenges persist for Beavers and her office, including cyber workforce shortages, unpredictable funding and technical debt that separates the services from the modern approaches they’re after.

All the while, China looms as a major U.S. adversary on the digital battlefield, and attacks on public infrastructure underscore the urgency of predicting and intercepting cyberthreats.

The DOD is seeking $14.5 billion in fiscal 2025 for its cyberspace programs. According to the DOD’s website, Kevin Mulvihill is the new acting principal deputy CIO.

Airmen and guardians will soon be able to take advantage of the Hypori Halo Workspace Anywhere program that grants access to government apps, email, NIPRNet, sensitive data, and CAC-enabled websites via personal devices, including a phone or tablet, whether they’re in the office or not.

A spokesperson for Hypori did not give an exact date for enrollment, but told C4ISRNET it’s still on track to begin this summer.

“The Air Force and Space Force are actually already using our platform,” said Jared Shepard, CEO and president of Hypori, at the TechNet Cyber conference presented by the Armed Forces Communications & Electronics Association International late last month in Baltimore. “Now, they’re going to scale.”

Capitalizing on the need for integrated communications and the pandemic-fueled remote work environment, the Army, including its Reserve and Guard components, already began transitioning service members toward Halo, which as of June 11 became the only way Army.mil users can access Army 365 services from a personal device. Shepard said at the conference that 50,000 Army enrollees are using the service since that BYOD effort began as a pilot in 2022. Hypori was also awarded a contract by the National Geospatial-Intelligence Agency on June 6 to give a third of its workforce remote access to secure networks.

“[BYOD] is a top priority for us, and it is a game changer because when our soldiers and airmen are not at the armory, they have to be connected in a secure way,” said Kenneth McNeill, chief information officer of the National Guard Bureau, in a statement February.

Reservists and part-time members of the services especially have limited access to base networks, so giving them the flexibility to complete work from wherever they are will be a boon to the organization, leaders have said.

“In our dynamic environment, the Department of the Air Force is committed to providing user-friendly enterprise solutions which empower the force to work securely in a wide range of operational contexts,” said Air Force Chief Information Officer Venice Goodwine in a statement in March.

The technology also eliminates the need to carry two devices while ensuring their government and personal data are kept separate to minimize liability. The idea of “no data at rest” means there is no risk of compromise if the enrolled devices are stolen or lost, and it ensures that personal information stored on that device is not accessible by the government.

The technology, which also vets users, is also compliant with White House orders that ban TikTok on government devices due to concerns that the social media platform’s Chinese-based parent company, ByteDance, would get access to sensitive data.

“Industry has a responsibility that if it’s doing work for the Department of Defense, that it protects that data,” Shepard said.

At the TechNet Cyber conference presented by the Armed Forces Communications & Electronics Association International in Baltimore last month, Randy Resnick, director of the Zero Trust Portfolio Management Office, said tagging and labeling, the practice of assigning metadata and identifiers to pieces of data, has been a long-term challenge for the department.

“They’ve been apparently working on this for 12 or more years —15 years — and I think it’s time enough to do something,” he said.

By way of an update on these efforts, Resnick said he approved three pilot programs in conjunction with the U.S. Department of Defense Chief Data and Artificial Intelligence Office and the Department of Homeland Security to develop a plan that would allow for all the necessary conversions and interpretations to process any data tagging and labeling standard in an understandable,repeatable way.

The goal is to have a successful demo of a schema by the end of the calendar year. Resnick also set a deadline of October for an internal working group to brief his office on a solution, even a partial one.

“We’re not looking for perfection,” he said at TechNet. “We have to start implementing something, and then it’ll grow over time as people agree to more tags and more labels. It’s got to be flexible enough to allow for growth.”

In a January study by Defense Innovation Board, researchers found “data access remains the central enterprise-level obstacle to the sharing and use of data for the warfighter.” Part of that is because military departments are “haphazardly” placing data leaders throughout the organization while top-level tech leaders are struggling to enforce their position as a unifier. Other persistent issues like a lack of uniform guidance, sustained funding, workforce gaps and technical silos also make progress on broader zero-trust difficult.

For now, there remain roadblocks that separate the DoD from the data economy it wants, but Resnick is realistic about these challenges and said a solution in development is better than nothing at all.

“That’s the type of solution that I personally am looking for, because that’s what the department needs,” he said.

Randy Resnick, director of the Zero Trust Portfolio Management Office at the Pentagon, said there’s a need to independently validate whether vendor products and services are, in fact, up to snuff. And creating a standardized, multistep process for ensuring zero-trust compliance will give the DoD confidence in what it buys.

The evaluation begins with an assessment that will give an overall reading of cybersecurity design and pinpoint areas where developers can address gaps early in the process.

“You can’t really game it because it’s 250 questions, and odds are you’d have to lie on a lot of them to skew the results,” Resnick said at the TechNet Cyber conference presented by the Armed Forces Communications & Electronics Association International in Baltimore on June 25. “And if you’re in design with something and you honestly go through the process … it’s going to tell you your gap between wherever you are and the 91 [minimum] activities. That’s a useful thing to know because then you could design or engineer or fix whatever you have to do to get to target.”

The Pentagon’s Chief Information office is pushing 2027 as the year for the department to be fully aligned with zero trust. It has already offered a roadmap for doing this, called the ZT Strategy from 2022 that Resnick said is unlikely to be updated. Instead, the department is focused on finding ways to reliably test its designs for security against vulnerabilities. The department has received ZT plans from the services and other DoD agencies, but it now seeks a more automated, replicable process for evaluating them to free up man hours and keep to aggressive pacing.

After the initial assessment, Resnick said then a tool will go through a simulation that will actually test for weaknesses, providing feedback as many times as needed to fix holes. Then, the tool will need to go through a “purple team” report that summarizes the outcome of defensive and offensive attacks on the system.

“We are testing for specific ZT outcomes as each part of the step of the test,” said Resnick. “This is not just a random experiment for red teaming. This is actually very detailed, very specific on what we want the purple team to go after to prove it’s a zero-trust configuration.”

The process is well outlined, but there are some challenges in actualizing it. Resnick said his biggest constraint is the lack of purple-team experts.

“We don’t have enough talent,” he said. “We don’t have enough people. It is a drain. They have other missions that they need to do.”

To accelerate designs through purple teaming, Resnick said he wants to find a way to enlist the help of industry and to test in a neutral environment with minimal costs. He mentioned there has been thought around bringing in multicomponent Reserve or Guard personnel to perform some purple-team duties, but they have to be National Security Agency approved, and that’s hard to find, he added.

The end goal is to use technology and automation to create repeatable, efficient processes that ultimately result in a department official signing off on a ZT solution that has the backing of a well-informed examination.

“That would be the gate to allow the components to assuredly procure target or advanced level ZT solutions prior to 2027,” he said. “We want to allow the department to choose from a menu of solutions … to reduce the risk that what they’re buying doesn’t work.”

At the TechNet Cyber conference presented by the Armed Forces Communications & Electronics Association International in Baltimore, leaders from the Pentagon discussed capabilities for public, private and hybrid networks. Officials acknowledged there’s a natural appetite for the most exclusive, secure networks in the national security space. And sometimes there is no wireless network infrastructure available in remote warfighting locations far from population centers.

So as the services determine appetite for private networks that offer more control over information sharing, the DoD is guiding them to use open radio access networks, or ORAN, said Juan Ramírez, the director of the 5G Cross-Functional Team at DoD.

“I think what industry wants to hear is there’s actually going to be requirements that come out that … necessitate an open RAN architecture,” he said at the conference. “So you’ll start to see those come out in the next couple of years, pending budgets.”

Certainly, private networks aren’t the only way to go. In fact, sometimes that’s not the best solution, said Lt. Col. Benjamin Pimentel, who leads the Camp Pendleton 5G experiment for Expeditionary Advanced Base Operations.

“Think about when we deploy in a theater,” he said. “A lot of countries that we go to or locations that we go to already have roads and bridges, and it’d be silly to then go and build my own private roads and my own private bridges separate and apart from that to get where I need to go. If those roads and bridges meet my transportation requirement, and they’re not going to fall under the weight of a ‘seven ton,’ we’re going to drive over it.”

But, somewhere like the first island chain, for example, may not have adequate coverage to put up sensors for long-range precision fires. In cases like those, he said, it would make more sense for units to bring private capabilities.

Given China’s rising aggression and U.S. efforts to deter it in the Taiwan Strait, what Pimentel described is the type of environment where current threats seem to colocate.

Regardless, to ensure there is connectivity wherever the need is, Ramirez said the department is looking at ORANs, which allow multiple vendors to operate as one network and provide more flexibility to scale.

ORAN is something the DoD has been pushing aggressively to explore as it simultaneously journeys toward more standard 5G adoption on military installations and “smart bases.”

Ramirez said the department is hopeful it will get additional support from Congress via future defense spending bills that will backup forthcoming requirements with dollars.

The Pentagon’s 2024 budget requested $143 billion in research, developing and testing of emerging technologies including 5G, but also artificial intelligence. Much of the spending in recent years has been for prototyping, and though the Office of the Secretary of Defense has the lion’s share, Ramirez said his office is offering direction to the services for them to budget for 5G.

“We think that pursuing ideas like [ORAN] advanced by the ORAN Alliance all the way to fully open-source code … provides the feature velocity the DoD needs and the ability to innovate quickly,” said Pimentel.

Steve Wallace, the agency’s chief technology officer, said at the 2024 TechNet Cyber conference presented by the Armed Forces Communications & Electronics Association International that this is a way of getting at a common problem in the Defense Department: a focus on emerging technology without a clear understanding of the problem its intended to solve.

“How does the department understand what you all can bring forward?” he said to a crowd of industry leaders and other cyber professionals in Baltimore June 26. “And then at the same time, how do you understand what the heck we actually need? There’s always that friction there.”

It’s not just an attempt to speed up the acquisitions process as the Pentagon is in a race for digital dominance against China and other nation-state hackers. So much of the conversation around cybersecurity in national defense is around pacing, but with industry constantly coming to market with new tools, there’s a need by government to be a wary purchaser.

These problem statements are a potential way for the Defense Department buy the tools, not just the shiniest ones.

“I think there is that risk that we get excited by new things — which are exciting — and we want to play with them and explore and see what’s possible,” said Scarlett Swerdlow, a senior technical strategist in the DISA’s Emerging Technology Directorate. “But at the end of the day, we have to make sure we’re solving a real problem that a real person has.”

The government often tries to emulate industry. But startups in Silicon Valley aren’t tied to a congressional budget cycle. And they have the room, and often the in-house expertise, to fail fast and pivot often. And though the Defense Department is at the mercy of a constantly changing threat landscape, DISA officials said at the conference that it can be enough for DoD to allow industry to do what it does best and be an evaluator when it comes time to settle on a solution.

“It is our ability to interface with industry, but knowing that the dollars that mature the technology are industry dollars, and not tax dollars, and then understanding where to apply some tactical patience as industry develops tech and [then we] insert ourselves,” said Army Maj. David Courter, chief of combatant command plan integration with the J-5. “I think that’s much different than us writing an initial capabilities document and saying, ‘I need you to build this cool tool.’”

Cautionary tale

One cautionary tale came to mind: the Joint Regional Security Stacks, an ambitious plan to massively consolidate the DoD’s sprawling IT infrastructure that set to be wound down in 2021 following reports of cost overruns and unresolved complexities.

At inception, it was supposed to be a gamechanger for the department, but a 2019 inspector general audit revealed it ultimately wasn’t meeting end users’ needs.

“The whole notion behind JRSS was best of breed for every component in the doggone stack,” Wallace said. “We are going to have the very best of everything. And then we are going to attempt to integrate or interoperate between all these components. Didn’t go well.”

The other issue is ensuring that DoD can verify for itself whether a tool actually does what it claims to do when its adapted for military or defense purposes. That comes into play when the department thinks about how buying one system must be able to operate with existing ones and those to come.

“[That’s] another reason to add that in-house talent that can … test some of those claims that products make,” said Swerdlow.

At the TechNet Cyber conference presented by the Armed Forces Communications & Electronics Association International in Baltimore on June 25, Resnick said his office received pushback on its aggressive goals for meeting zero-trust and saw a need to codify its role in the governmentwide race toward network security.

The memo will give Resnick’s office “bite” and an “ability to command and control zero trust in the Department of Defense,” he said.

At the inception of the portfolio office, which was stood up in 2022, Resnick said he was told his office didn’t have Title 10 authority to set zero-trust requirements or priorities. Military officials said they had to hear orders from their commands. In a nutshell, Title 10 is what gives DoD power to make decisions. It assigns the defense secretary “authority, direction and control” over all subordinate agencies and commands.

When the zero-trust office came on the scene, it was new, and Resnick is now working to ensure his team has the ability to act as subject-matter experts on zero trust.

“You will see language in it that makes it very clear what the portfolio office’s capabilities are and the power that we have over telling the department just how to do things in terms of policy deadlines,” he said. “But it also clearly outlines … the military departments’ [and] the agencies’ roles and responsibilities for zero trust.”

Resnick did not give a date for the memo but said it was imminent.

In the next couple of months, Resnick is also aiming to clarify gray areas of shared responsibility of zero-trust, since both civilian and military agencies are tasked with implementing it.

Directive-type memos tend to have an expiration date, but they can be converted into instructions that establish policy.

That means he knows — more or less — what he’s got, and what he needs. And what he needs, is people.

“[In the services], we’re not having a problem recruiting cyber talent,” he said at the 2024 TechNet Cyber conference presented by the Armed Forces Communications & Electronics Association International in Baltimore. “Our retention is where we’re having a challenge.”

Gorak, the principal director for resources and analysis for the Pentagon’s Chief Information Officer, said DoD has 27,000 vacancies, down from 30,000 last year. The total cyber defense workforce is comprised of roughly 225,000 service members, civilians and contractors.

Gorak said there is interest in working for the government or serve in the military. The public sector has always been able to emphasize a unique mission and a stable career. While that has been — and is — a selling point, leaders said they also need to use authorities to pay competitively and offer training. Otherwise, government will lose workers to the private sector or other agencies who are also competing for this great need.

Messaging is a part of the problem, Gorak said, especially in the search for early career talent.

“I talk to students and I tell them, ‘You can join the Department of Defense as a civilian,’” Gorak said. “They look at me like I’m cross-eyed. [They say], ‘I had no idea that we have 900,000 civilians in the DoD.’”

There is some headway being made, with the department announcing on June 12 its new Cyber Academic Engagement Office, led by Gorak. The goal is to have a dedicated office for coordinating and funding academic engagement programs for the department.

The other aspect of solving the people problem is organizing all the different pay authorities, work roles, skill requirements and types of hires across the Defense Department.

Take, for example, the basic IT job in the government, called a “2210.” Gorak said there are 54,022 employees with this position description performing 72 different work roles, illustrating how one occupation can manifest into different work depending on the office.

That’s part of what makes classification difficult, especially as technology constantly evolves to require new skills or training. The DoD Cyber Framework originally had 54 distinct work rules; now it has 72.

So, recruiters need to understand the actual work being done in order to look for it in the job market, classify it correctly, and then compensate it competitively, Gorak said.

“If you’re a GS-12 and you’re an expert, you should get paid a lot more than a GS-12 who’s at a basic level,” he added. “Pay for performance. Pay for what your actual expertise is. That’s the system we have to get.”

DoD has a number of authorities available that allow it to pay recruitment and retention bonuses, set higher starting salaries and reward high achievers. The department has direct hire authority to circumvent the USAJobs application process. The DoD Cyber Excepted Service offers a market-based pay structure that can offer as much as a 40% salary increase, Gorak said.

So far, about 15,000 positions are eligible for CES, but only 9,000 of them have actually been converted. Gorak’s team has worked to make some improvements to encourage conversion, including allowing individuals to convert instead of requiring that of an entire organization and letting the services delegate that process in-house instead of relying on one office process all conversion packets.

The only combatant command that is fully eligible for CES is Cybercom. Army Cyber Command is the second biggest.

Still, part of the reason available flexibilities haven’t been used is they’re expensive. In other cases, HR personnel don’t know they exist or aren’t trained on how to use them. That’s also why time-to-hire even for positions that should be fast-tracked remains lengthy.

On the civilian side, hiring timelines hardly improved from 2022 to 2023, and 2210 IT workers remain among the slowest to onboard.

In the meantime, the department — alongside other civilian agencies — has recognized that young people can attain digital skills without a college degree. The government is coming around to that trend, but it’s still a new way of thinking for some.

“I contend to you that there are people out there today … working in their bedroom upstairs who are outstanding cyber professionals who can do this job, but because they don’t have the experience and they don’t have the degree and they don’t have whatever certs we think are hot right now, we don’t hire them,” he said. “I think that is a mistake by the federal government, and we have to get past it.”

“So, imagine the [Defense Department] being a really big ship, with the smallest rudder you ever saw in your life trying to try to turn that ship,” he said at the 2024 TechNet Cyber conference presented by the Armed Forces Communications & Electronics Association International on Tuesday. “That’s what the Department of Defense is.”

He doesn’t mean it derogatorily. He said it as more a statement of fact than a judgment. And, to the department’s credit, with help from outgoing Chief Information Officer John Sherman and a great deal of documents to keep these offices on the same page, they’ve made progress on the “gargantuan challenge” of getting workforce culture to support cyber security imperatives. But there’s still some work to be done.

Much of the discussion Resnick led at the event in Baltimore centered around the complex technology undergirding zero-trust, which both the military services and civilian agencies are tasked with implementing to some effect in the next few years. The DoD offices has until 2027 to hit almost a hundred different targets for zero trust. Meanwhile, the department’s 2025 budget requested roughly $977 million for zero-trust transition, C4ISRNET previously reported.

Zero-trust is, as Resnick said, just that: nothing is trusted, and as a result, there are behind-the-scenes tests that verify and validate access with, ideally, minimal intrusion on user experience. It’s an access control strategy, but it’s also analytics, automation and data.

Zero-trust is very specific but it’s also seemingly ubiquitous. The White House, even, has made cyber defenses a priority of every federal agency.

“Really, zero-trust is all of us,” said Leslie Beavers, the principal deputy CIO at the Defense Department, on Tuesday.

However, for it to work, zero-trust needs to be defined. And all the players need to be one the same page. That’s something that has happened only recently, said Resnick.

“Industry was all over the map with zero trust,” he said. “Everybody had a ZT solution. Everybody was approaching government employees and purchasers, and people were very, very, very confused in the government.”

So, Resnick’s office put structure around zero-trust. The goal, first and foremost, was to stop adversaries’ exploitation of DoD data, he said. Then, they got to work on a number of foundational documents to lay out goals and plans for achieving them, including the DoD Zero Trust Strategy and Roadmap and the “Overlays” plan.

It was an effort to synchronize the theory and actual approach of zero-trust, but inadvertently, it also influenced other countries’ zero-trust plans and reset industry’s understanding of what DoD needs, Resnick said.

“Without a doubt, I now have conversations with industry that are completely aligned to the DoD zero trust approach,” he said. “We didn’t have this two years ago. It’s a pleasure to have a conversation now, because now we’re all on the same page.”

Now that the level setting has been done, there remains the issue of change management.

The federal workforce, for one, skews older than the private sector. Data from 2022 less than 6% of government IT employees are under the age of 30, and 30% are 55 or older. While officials said the Defense Department often has more reliable and robust funding to go after new technology, federal civilian agencies may not, creating an environment where government is at various stages of adoption, and not always willing to embrace change. The pervasiveness of legacy systems also makes change hard, especially when the skills needed versus the skills available vary.

Resnick said he has seen the spirit of innovation in leadership, but it’s the mid-tier of the workforce that sometimes pushes back — the “permafrost,” as he calls it.

“They feel threatened because they do the old style of cybersecurity,” he said. “I did it myself; I totally understand. But … if they haven’t learned now, then [they’re] never going to learn. And so I truly believe it’s a generational thing. We’re going to have to wait them out until they retire out.”

That’s not to say training isn’t happening. Resnick said they worked with Defense Acquisition University to get access for CAC-holders to cyber classes that vary in length and intensity.

He said he sees a gap in industry training for zero-trust and urged members to populate that space.

On June 20, Deputy Defense Secretary Kathleen Hicks approved the strategy, and the department announced it on June 25, coinciding with the 2024 TechNet Cyber conference presented by the Armed Forces Communications & Electronics Association International in Baltimore.

“Fulcrum describes ‘what’ the DoD must achieve with respect to advancing IT for the warfighter and ‘why’ it matters,” according to a department statement.

The strategy offers specifics on broad, sweeping goals by the Pentagon to communicate faster and more securely with warfighters and allies. To date, the government has issued a number of strategic plans and frameworks to double down on cybersecurity and accelerate the military’s development of tools like AI, but this plan takes that a step further by prioritizing user experience and scalable, agile investments.

“It’s called ‘fulcrum’ because it sits at the nexus between our national security strategy, our strategic management plans — our really ‘big thinking’ strategies,” said Leslie Beavers, principal deputy chief information officer, on Tuesday.

With so many tools coming to market from different vendors and small businesses also hoping to break in, the strategy gives leaders guideposts for how to assess what tools and internal resources are needed.

Critically, it also devotes a category to developing the workforce, specifically by broadening the DoD Cyber Workforce Framework to focus more intently on roles for data, AI and software engineering.

The DoD has long said this is an established need.

“There is a recognized shortage of skilled cyber personnel that could potentially impact operational readiness across the Department and put national security at risk,” according to the department’s 2023 Cyber Workforce Strategy. “Despite the vast expansion of cyber educational and experiential opportunities, the nation’s cyber talent pipeline remains limited.”

As in the private sector, government, too, is struggling with too few tech practitioners that make new cybersecurity practices difficult to implement. At the same time, much of the technical guidance handed down by experts in tech shops is written for the actual programmists, not senior executives, so there needs to be an available reserve of workers, DoD officials said at the conference.

“Leadership is a force multiplier and to outpace [adversaries] we have to maximize the talent from our broad array of partners, and recruit and retain our own talent,” said Gen. Timothy D. Haugh, commander of U.S. Cyber Command and director of the National Security Agency, at the conference.

Finally, the new strategy also seeks to streamline governance and enhance use of data to backup decision-making and identify cost savings to deliver joint warfighting capabilities faster amid high-tempo, multi-domain operations.

“We must challenge legacy approaches and move move toward rapid innovation for them,” said Haugh. “We cannot succeed when our existing processes move slower than the rate of innovation change.”