This is part one of a two-part series on how the Army is looking to acquire and field capabilities faster.<\/i><\/p>\n\n\n\n
In cyberspace, seconds matter. That\u2019s why the Army is looking to a new construct to acquire defensive cyber capability to pace advanced threats on the network.<\/p>\n\n\n\n
By leveraging a contract vehicle known as the IT box, the Army is hoping to cut down timelines from over 500 days to 30.<\/p>\n\n\n\n
\u201cIf it takes 574 days to get a requirement approved in cyberspace, you\u2019re done before you start,\u201d Maj. Gen. John Morrison, commander of the Army\u2019s Cyber Center of Excellence, said during a keynote presentation May 16 at the AFCEA Defensive Cyber Operations Symposium in Baltimore, Maryland.<\/p>\n\n\n\n
\u201cIt is a fool\u2019s errand. It will not work in a dynamic battlespace like the cyber domain.\u201d<\/p>\n\n\n\n
To illustrate the benefits of IT box, Morrison recounted how the Army desired a defensive cyber capability, got the initial requirements document approved in December and had the first two discrete capabilities approved through the process in February. The initial prototypes already showed up in the Army\u2019s cyber protection brigade and by June are going to make a decision on whether or not to field that kit to the full cyber protection brigade.<\/p>\n\n\n\n
\u201cThat is moving with some speed inside cyberspace,\u201d Morrison said. \u201cThat is the only way that we\u2019re going to be able to do capabilities development in such a dynamic environment where, quite frankly, our adversaries don\u2019t need to follow the [Joint Capabilities Integration and Development System] process.\u201d<\/p>\n\n\n\n
Providing more granularity, Russell Fenton \u2014 who works in the Army\u2019s Training and Doctrine Command\u2019s capability manager office for cyber \u2014 described how the service is looking to improve further to a 30-day prototyping process during a separate presentation at the conference.<\/p>\n\n\n\n
When a cyber protection team has a need, they\u2019re going to fill out a form asking for a broad capability to fill that need, not a solution. Once the request is received, it will be sent within 10 days to industry for a contract through other transactional agreements. Then, within 20 days of the request, a \u201cshark tank\u201d will take place to allow industry to pitch ideas, and the Army will select solutions that it believes will best meet that requirement. Additional prototyping will take place, followed by an operational assessment in the 30-day time frame.<\/p>\n\n\n\n
This IT box construct has been around for roughly 10 years, but Morrison said the Army never operationalized it despite the benefits.<\/p>\n\n\n\n
According to Fenton\u2019s presentation, the IT box streamlines the requirements process by delegating requirements down to lower levels; provides greater flexibility to incorporate evolving technologies and achieve faster responses; and enables potential streamlining of acquisition processes to be at the discretion of the milestone decision authority.<\/p>\n\n\n\n
It can be for procurement or modification of commercial or government off-the-shelf technology, if additional production of previously developed technologies are appropriate and for development and acquisition of customized software.<\/p>\n\n\n\n
However, it is limited more to software, not hardware solutions.<\/p>\n\n\n\n
Morrison said the new direction the Army is moving is iterative, adopting a devops model seen in Silicon Valley.<\/p>\n\n\n\n
\u201cThe key is it never, ever stops. It is incremental improvements that we continue to spin into these capabilities and just as important, when we don\u2019t need a capability we spin it out,\u201d he said. \u201cEver changing, ever evolving.\u201d<\/p>\n\n\n\n
He also noted this will be applied to offensive capability and defensive capability inside tactical formations.<\/p>\n\n\n\n
However, Fenton noted that capability under the IT box must have a projected life-cycle cost that exceeds $15 million, which will most likely apply to defensive capability that can be continuously applied. This could limit certain offensive capability, as often offensive capability in cyberspace is time sensitive, exploiting vulnerabilities that in days or even hours might not exist anymore, making the tool useless. As such, these tools are typically single use and are unlikely to meet a total life-cycle cost over $15 million.<\/p>\n\n\n\n