Recent assessments from the U.S.-China Economic and Security Review Commission’s 2025 annual report underscore the challenge ahead. According to the report, “China is aggressively positioning itself as a global leader in space technology and exploration, seeking to reshape international governance, influence standards, and displace the United States as the world’s premier space power.”

The report notes China’s operational satellite fleet exceeded 1,060 by mid-2025, with hundreds dedicated to intelligence, surveillance and reconnaissance.

Chief of Space Operations Gen. B. Chance Saltzman has signaled U.S. resolve on this front. During the opening keynote at the Air & Space Forces Association’s Warfare Symposium in March 2025, he made U.S. intentions clear to allies and adversaries alike, declaring, “The Space Force will do whatever it takes to achieve space superiority.”

The April 2025 release of “Space Warfighting: A Framework for Planners” codifies the service’s shift from primarily supportive roles to treating space as a contested warfighting domain, openly emphasizing offensive and defensive counter-space operations alongside traditional enabling capabilities.

In the document’s foreword, Saltzman writes that space superiority “unlocks superiority in other domains, fuels Coalition lethality, and fortifies troop survivability. It is therefore the basis from which the Joint Force projects power, deters aggression, and secures the homeland.”

‘Race to resilience’

Current core U.S. military space capabilities remain foundational but increasingly vulnerable.

Missile warning and tracking systems, such as the Space-Based Infrared System and emerging Next-Generation Overhead Persistent Infrared satellites, provide global detection of ballistic and hypersonic launches, often within seconds of ignition. This capability is supplemented by proliferated low-Earth orbit sensors, including the Space Development Agency’s Tranche 3 tracking layer, a $3.5 billion investment awarded in late 2025 for 72 new satellites planned for launch beginning in 2029.

Protected satellite communication and positioning, navigation and timing networks, including the jam-resistant Advanced Extremely High Frequency constellation and military GPS featuring enhanced anti-jam M-code, ensure resilient command and control in degraded environments.

Space domain awareness tools, such as the maneuverable Geosynchronous Space Situational Awareness Program satellites, operate in near-geosynchronous orbit to conduct close inspections of objects. Upgraded ground-based sensors, including the Ground-Based Optical Sensor System, track orbital objects and potential threats.

While robust, these systems are vulnerable to attacks such as signal jamming, sensor dazzling by directed-energy weapons and cyberattacks — reversible threats that U.S. officials report occur daily or near-daily. U.S. officials note that even temporary disruptions could significantly impair critical joint operations in wartime.

These challenges are driving the service’s “Race to Resilience” initiative, which aims to achieve battle-ready architectures by 2026. Several key milestones in the coming year will advance the Space Force’s readiness in these contested environments.

Boost-phase space-based interceptor prototypes, a proposed weapon system designed to destroy enemy ballistic missiles during the boost phase of their flight, were awarded under competitive contracts for the Golden Dome missile defense initiative in November 2025. Kinetic midcourse awards (hit-to-kill interceptors during the missile’s coasting phase) are expected in February 2026.

Speaking shortly after his appointment at the Space Foundation’s Innovate Space: Global Economic Summit in July 2025, program lead Gen. Michael Guetlein shared his optimism for the program, stating, “I firmly believe that the technology we need to deliver Golden Dome exists today,” highlighting the importance of integrated command and control.

The service will also finalize requirements for the Space Warfighter Operational Readiness Domain, a distributed digital training environment that builds on existing Space Flag exercises, enabling guardians across multiple locations to participate in virtual simulations of contested operations.

Four on-orbit servicing demonstrations are planned for 2026 to test satellite refueling, repair, inspection and maneuvering. These capabilities are essential for maintaining dynamic space operations, extending the lifespan of assets and enhancing resilience in these contested environments. These missions, funded by various DOD entities and commercial partners, mark a key step toward proving the viability of in-space logistics.

Additionally, the Commercial Augmentation Space Reserve will transition from pilot phase to full-scale operations in 2026, targeting 20 contracts by year-end to provide wartime access to commercial satcom networks. This resiliency measure is backed by record fiscal 2026 funding approaching $40 billion, reflecting priorities for hybrid military-commercial architectures.

With threats intensifying, including China’s rapid satellite expansion and Russia’s disruptive capabilities, 2026 positions the Space Force to deliver resilient architectures that ensure U.S. space superiority, enabling joint forces to maintain the edge in any conflict or contested environment.

The agreement announced by SAIC and HavocAI last month will see a link-up between HavocAI’s autonomous surface vessels and SAIC’s advanced joint range extension gateway. The JRE currently streamlines communications for U.S. and allied military forces worldwide and will extend the range of Link 16, a vast, all-domain global C2 infrastructure.

This new move puts nimble autonomous surface vessels able to sweep wide stretches of ocean at the click of a button at the immediate disposal of the Navy and other military forces linked to the JRE gateway. Leadership of both companies shared the details with Defense News in an exclusive interview.

“Being able to be interoperable with the existing network infrastructure with U.S., allied and partner navies is the biggest part,” Barbara Supplee, Executive Vice President, Navy Business Group at SAIC told Defense News. “We are piping the information on a much more expanded range. It’s taking the innovation that HavocAI is putting in the water and matching it with the existing networks.”

Unmanned teamwork

The small vessels made by HavocAI operate as teams using its Collaborative Autonomy Stack system. They can maneuver through harsh environments and perform various tasks independently with minimal human oversight, such as surveillance.

“The vessels communicate with each other. They’re always talking to each other to try to figure out how to execute something efficiently. The only kind of humans involved are in tasking,” Paul Lwin, co-founder and CEO of HavocAI, told Defense News.

Thanks to the new pairing with SAIC, the vessels will now feed information back to military command centers.

“They [the vessels] will connect to Link 16 and all C2 systems at the strategic level,” Lwin added.

Undersea experiments

The JRE has seen investments over the last two years to expand its cloud-based capabilities, but the communications infrastructure already offers robust opportunities for autonomous technology, Supplee told Defense News.

For example, both companies have already partnered to test technology using undersea vessels, which they believe they can potentially expand. “We’ve experimented with it. We believe it can be used prolifically. The communications can work today,” Supplee said.

Lwin said that HavocAI’s use of Starlink can expand the potential of the autonomous surface vessels to communicate with underwater systems. “We can put acoustic modems on our vessels and allow them to communicate with undersea vessels,” he said.

Potential areas of operations

The vessels’ new link-up to the military’s premier C2 infrastructure is hoped to strengthen the Navy’s hybrid fleet and project U.S. seapower in contested areas, such as near the Philippines.

“We believe that this partnership is going to help the Navy realize its vision of thousands of these small USV capable platforms of operating in tandem hybridity in these contested environments,” Supplee said.

“With autonomous systems, you want to remove humans from danger,” Lwin said. “You can send thousands of these out with their sensors, figure out what’s going on in these island chains and send that information back to the crews without putting humans at risk.”

The vessels could potentially be used in the Arctic as well, Lwin told Defense News.

Future uses

Both companies hope that being proactive in combining their strengths will not only expand their technology currently being used in the field but open up new possibilities, they said.

“We’re working to solve the problem at hand in advance of even the requirement so that we can help the Navy scale where it’s needed,” Supplee said.

HavocAI said that the vessels are easy to manufacture and could be produced en masse quickly over the next few years if needed.

“We want to be able to get the U.S. Navy the option right now to deploy thousands of these,” Lwin said. ”What we’re building right now is no longer science fiction. We’re showing with SAIC you can integrate them right now and start to use them as weapons systems right away.”

———————————————————–

Failing to ensure compliance with new requirements can magnify gaps and weaknesses for auditors, akin to writing the organization’s next audit findings and delivering them to its Inspector General with a neat bow on top.

Agencies often view the creation of policy, directives, guidance, and instructions as a self-contained task. Policy shops are established, and their measure of success often is the publication of a number of policy documents. Once a policy is published, the lines of business are left to interpret the policy and develop implementation solutions from the ground up. When looking at the federal government, policy shops can tend to take a hands-off approach to implementation, on the basis that it is best to provide the program with maximum flexibility to implement policy in a way that best suits their organization.

This approach very much emulates the relationship between the federal government and states, where the federal government sets a policy and program directive but allows the states wide latitude for implementation. This approach allows states to innovate and test approaches that suit their demography, culture, and particular needs, which can result in successful pilot programs being adopted and adapted by other states.

However, this process can take time and result in failed experiments. While this type of incubation can be beneficial for creating large scale social and economic programs, it’s not necessarily the most efficient way to implement enterprise data governance policy.

Most organizations are driven to revamp or create a new enterprise data governance policy because there has been an abundance of innovation, new solutions, and problem-solving at the “State” level within the organization, with the agency beginning to feel the pain of the proliferation of data-oriented solutions.

Ungoverned data

For example, one source of pain is that, at a certain point, the proliferation of ungoverned data and data solutions can actually hinder an agency’s maturation towards becoming data-driven.

Consider two different grant programs designing solutions to capture applicant information in an environment which lacks an effective data management policy and a compliance program to hold programs accountable.

The grant programs develop their solution to capture customer data separately in their own silo, and these two different solutions are unlikely to develop the same data standards, data naming conventions, or other aspects of data management that would allow the two programs to integrate easily.

As a consequence, analyzing grant data from the programs for insights on important factors that could make both programs more effective (such as identifying risk indicators that a grantee will fail to deliver) can become significantly more difficult and time consuming.

In this situation, most agencies wanting to adopt data-driven decision-making will turn to creating an analytical platform where data from both programs can be transformed, cleansed, standardized, and integrated. However, this means the development of another data solution with a cadre of data scientists required to curate and normalize the data, which in turn is likely to require a new budget item and new hiring.

Siloed technologies

A second source of pain in an organization with ungoverned data solutions is that the costs of maintaining and supporting these siloed technologies can increase exponentially over time.

Tighter budgets can hinder improvements, debugging, and sometimes basic maintenance, resulting in increasingly poor customer delivery. At this point, the agency may also have realized that while the subject matter of the programs is different, there are significant commonalities among the data services provided that could be streamlined—for example, multiple programs capturing customer data, managing cases, processing benefits applications, and accepting or delivering payments.

Under pressure to reduce costs and improve service, the agency begins looking for ways to centralize its data solutions, only to discover that doing so is expensive, complex, and few of their peer agencies have completed such projects on time and on budget.

Integrating data solutions is significantly more difficult when solutions develop in the absence of an overarching data governance policy and compliance program to help ensure that, as solutions emerge, they are growing in a manner that will be sustainable.

Establishing an enterprise data governance policy is a good first step to bring consistency, interoperability, and other benefits to a data ecosystem, but programs will need to effectively implement that policy in order to create a healthy and sustainable data environment.

Furthermore, if the governance program stops with policy and guidance that merely establishes high-level principles such as “new and existing data systems must adopt standards to ensure data interoperability,” then it is not likely that an actual change will occur in organizational processes or staff behavior.

Sticking with the grant example, for a data governance program to be more effective, it would need to take an active role in designing standards that could work for both grant programs, facilitating discussions and brokering an agreement on the standards for specific required data elements.

It would also need a compliance program with a deadline by which the standards must be adopted to help ensure that those standards were actually being implemented.

Effective compliance

Successful data governance policy programs integrate policy into implementation by using their compliance program as the bridge between policy principles and driving change in data management practice.

Compliance programs achieve this in part by painting a clear picture of what implementation looks like, and does this by establishing concrete expectations of what will be considered successful compliance with policy.

For example, if a data governance policy included a principle of strengthening data quality, the compliance document could articulate that lines of business must establish specific parameters for monitoring data quality aligned with the needs of the program they serve.

A data quality parameter that the compliance program establishes could be that grant recipient payee data will have less than 1 percent of missing values to help ensure timely and accurate delivery of payments.

An effective compliance program should be able to envision a path to evaluate successful compliance. If it cannot do that or needs to rely on a program official’s attestation of compliance, then it is not reasonable to expect the lines of business could comply with a policy directive on their own.

These expectations should be published as part of a compliance policy or procedure so that the lines of business have a yardstick by which to measure their efforts. Ideally, this should focus on the changes the lines of business would need to implement.

For example, a policy principle related to data quality as data is moved across an enterprise might state that data must be complete and maintain its integrity as it moves from one system to another or ingested from an outside source. The compliance program could set criteria that data must be monitored for completeness and integrity such as not incurring any unintended transformations.

The compliance program would further identify any technology performing data movement (including automated data quality monitoring) that would meet this compliance standard, as well as alternative processes a program could implement that would constitute appropriate monitoring of data movement.

This type of information not only paints a clear picture for the program of how they can comply, but also gives them enough information to assess how much effort the program will need to meet the compliance criteria.

‘Easy path’

It is worth noting that the technology and processes cited by a compliance program do not mean that other solutions a program may develop to demonstrate compliance are not to be considered. Rather, the cited technology and process can be examples of an “easy path” to compliance that programs can either adopt or know they already have in place.

In situations where a program develops an alternative approach, the compliance program could evaluate that approach against its criteria—in this case being able to demonstrate that data is moving completely and with integrity.

If the evaluation finds that the program has developed an effective approach, this approach can be added to the compliance program’s list of accepted technologies or processes and shared with other programs as a best practice or, if you will, an additional “easy path” to compliance.

When data governance policy is completed with the publication of a policy document, they can leave program and business leads without direction on prioritization, timelines, and the necessary level of effort and resources needed for implementation.

In many cases, the absence of this information can cause what was previously a willing coalition of business support for better data governance to get cold feet and hinder the passage of new data policies.

A compliance program can help program and business leads set priorities, determine timelines, and plan resources to ensure compliance by adopting and publishing clear criteria for what compliance looks like, as well as a risk-based schedule for its compliance reviews and setting.

Reducing uncertainty for programs regarding how they will be evaluated and what will constitute successful compliance will not only keep a coalition supporting data governance together, but will also drive implementation and change.

Joah Iannotta is Senior Data Governance Expert at ABSG Consulting Inc. Part 2 of this series will explore the practices that data governance compliance programs can adopt to help drive change management.

Recognizing that critical infrastructure owners and operators often lack significant resources and struggle to implement basic cyber protocols, the federal government is prioritizing protecting this sector, with the new National Security Memorandum on Critical Infrastructure and updated National Cybersecurity Strategy Implementation Plan.

Federal agencies need to serve as role models for secure and resilient systems by bridging the gap between outdated technology and modern security processes; lest critical infrastructure sectors remain easy targets and the prospect of devastating disruptions to essential services will grow.

Back to basics

To protect critical infrastructure, a vital part of the NSM and other federal plans that involve sector risk management is “ensuring critical services have minimum cybersecurity practices in place.” Existing protections and processes have been unable to keep up with a mushrooming attack surface due to resource constraints, which means critical infrastructure owners and operators need to be in alignment with the federal government.

With 85 percent of critical infrastructure owned or operated by the private sector, public-private collaboration has now become a necessity in order to establish minimum requirements and help critical infrastructure organizations achieve basic cyber hygiene.

Greater collaboration with the private sector can also help ease the gaps in resources and expertise needed to address the challenges associated with growing and more sophisticated cyber threats.

The updated NCSIP emphasizes that in order for the federal digital ecosystem and critical infrastructure stakeholders to grow their cyber posture, they need to share information and best practices. This is a cornerstone of a whole-of-government cybersecurity approach where federal, state, and local governments collaborate closely with private industries to create a unified cybersecurity framework.

Sharing information and best practices facilitates open and transparent communications between public and private sectors, enabling quicker dissemination of threat intelligence, streamlined responses, reduced downtime, and more agile operations.

Not only does this approach break down inefficient, risky silos, but it also allows for a unified response to cyber incidents and the pooling of resources, expertise, and intelligence for real-time sharing and faster decision-making.

Accelerating digital modernization

The combination of insecure internet-facing connections, legacy tech, and traditional security approaches make critical infrastructure easy targets for malicious actors. Improving critical infrastructure resilience is more than just IT and security; it’s about looking at the bigger picture to reduce downtime and risk to people and property.

The federal government should continue pushing technology developers to use secure-by-design tactics, ensuring “out of the box” security and significantly reducing the strain placed on infrastructure owners and operators.

In addition, the adoption of zero trust architectures emerges as a crucial step to harden remote access to industrial control systems (ICS) that rely on a mix of IT and operational technology (OT) assets.

Zero trust is inherently designed to reduce a network’s attack surface, prevent lateral movement of threats, and lower the risk of a data breach. This model leverages least-privileged access controls, granular microsegmentation, and multifactor authentication (MFA) to provide continuous verification of identities and devices, regardless of location, type, or network connection. Crucially, these controls are dynamic and happening continuously.

Historically, OT assets were not designed with security in mind. And almost always, Internet of Things (IoT) devices cannot be modified to accommodate security stack: software, agent, etc. But most critical infrastructure organizations still depend on these antiquated technologies to monitor and control industrial processes.

Considering the unique nature of OT assets, coupled with their specific requirements for operational safety and reliability, owners and operators have strong business justifications for operating older equipment that are incompatible with zero trust security.

Yet, in the absence of zero trust capabilities, these assets have become key attack vectors for malicious actors. While IoT devices may not be the first compromised, they become a “land bridge,” often allowed through by traditional firewalls, to critical backend servers and data centers. Secure digital modernization is therefore essential.

Overcoming challenges

When it comes to critical infrastructure, the risks are limitless, but the resources aren’t.

Requiring and enforcing minimum resilience and security requirements, as well as encouraging minimum cyber hygiene requirements and information-sharing, reinforce that safeguarding national infrastructure is a shared responsibility.

While OT presents challenges to implementing zero trust and modern security, a whole-of-government approach in support of greater collaboration, modern technology with zero trust capabilities, standardization, and accountability – is the only way to secure our critical infrastructure ecosystem and mitigate the risk of disruptive and destructive cyberattacks.

Hansang Bae is Public Sector Chief Technology Officer at Zscaler, a California-based cloud security company.

“When it comes to emerging technology,” she said, “you cannot be both in China’s camp and our camp.”

Those are powerful words as the secretary’s agency seeks comments on a proposed Know-Your-Customer, or KYC, rule designed to keep valuable U.S. technology out of the hands of countries like China and Russia. In that spirit, one critical concern should be closing a significant loophole in the proposed rule that would allow some of the U.S. government’s largest cloud service providers to continue pursuing profits in China at the risk of compromising U.S. national security.

Commerce’s proposed rule would require U.S. cloud companies to identify and disclose instances where “foreign malicious actors” might use their products and services to undermine national security. It would also authorize the U.S. government to audit companies’ processes and procedures in these instances and recommend/enforce remediation measures to prevent future issues.

Where the Commerce rule falls short is the exemption of independent subsidiaries that operate as overseas arms of U.S. companies. Even if the proposed rule compels Microsoft or Amazon to proactively shrink their operations in China to avoid long, drawn out audits, their de-facto foreign subsidiaries will allow them to continue profiting off the sale of products and services to the Chinese government. The KYC rule may paradoxically help the Chinese by making it harder for the U.S. government to know the details of some U.S. cloud providers’ customers and operations in China. This omission is not consistent with the overall goal of the KYC rule to enhance national security .

Companies have faced few repercussions for allowing China and other adversaries to use their advanced technologies to undermine U.S. interests. That’s despite mounting criticism in Washington –While the proposed rule aims to address these risks, it can’t be truly effective unless it scrutinizes the murky relationships U.S. cloud companies enter into with foreign-owned companies.

One example is 21Vianet which serves China’s government, enables its military, and aids and abets its oppressive surveillance regime. 21Vianet, is a Chinese company operated by the holding company VNET Group, Inc., and is the exclusiveoperator of Microsoft’s cloud computing platforms in China. 21Vianet brought Microsoft’s Azure cloud platform to China and has expanded its services to the Chinese government, operating as a Microsoft subsidiary in virtually every function but its name.

Amazon operates similar partnerships, including with Ningxia Western Cloud Data Technology Co., which is partially state-owned. Through the company, AWS delivers cloud services for Chinese state and defense agencies, yet another example of a China-based company that exists only to sell the products of a single U.S. tech company and operates almost entirely at the direction of its U.S. tech “partner.”

Despite their vast presence and robust partner networks in China, U.S. cloud companies are all too aware of – and public about – the risks that China and our other adversaries pose to U.S. national security. And the technology being marketed by U.S. companies in China is enabling the country to attack U.S. interests.

Recently, Microsoft disclosed that it has caught China, Russia and Iran using its AI tools to hone malicious hacking campaigns and warned that China may use its AI technology to influence the 2024 election. Both Microsoft and Amazonhave repeatedly warned about increasing sophistication of hackers from the likes of Russia and China.

Last year, the American Security Project released a report detailing the sprawling web of exclusive, independent partners and affiliates that Microsoft, Amazon, other U.S. companies like Oracle, use to sell their products in mainland China, including to the Chinese government and its military.

The structures of these arrangements are intentionally murky, strategically employed by the companies to avoid U.S. regulations while complying with China’s increasingly stringent laws governing foreign-owned companies. The partners – de-facto Microsoft and Amazon subsidiaries – are prone to cyber intrusion because of source code and vulnerability disclosure requirements and compliance with arbitrary “state secrets” laws that are known to have compromised the U.S. government’s data security.

The proposed KYC rule seeks to directly address such issues by stopping adversaries from getting their hands on advanced U.S. cloud and AI technologies. Regulators cannot miss this opportunity to compel Microsoft, Amazon and their peers to prioritize U.S. interests instead of chasing profits with our adversaries. If not now, when? We must act before it’s too late.

Paul Rosenzweig is the founder of Red Branch Consulting PLLC, a homeland security and cybersecurity consulting company, and a Senior Advisor to The Chertoff Group. Mr. Rosenzweig formerly served as Deputy Assistant Secretary for Policy in the Department of Homeland Security. He is currently a Professorial Lecturer in Law at George Washington University, and a Senior Fellow in the Tech, Law & Security Program at the American University, Washington College of Law.

To leverage data effectively and securely, the Federal Data Strategy directs agencies to “assess and proactively address the procedural, regulatory, legal and cultural barriers to sharing data within and across federal agencies and with external partners.” As such, the importance of data sharing and cross-agency collaboration took center stage at the Census Open Innovation Summit earlier this year.

The Census Bureau serves as the nation’s leading provider of data and insights about its people and economy, which means optimal data utilization and sharing is fundamental to its mission.

Like many data-rich or data-dependent agencies, the Census Bureau must balance maximum utility and security. In the case of the decennial census, the Bureau is expected to share the data it collects to improve a myriad of federal programs, employee experience, and overall CX. These objectives are critical but cannot come at the expense of privacy and confidentiality.

The key is determining which barriers to data-sharing are redundant or unnecessary and which are essential to preserve the security of sensitive personal and government information. To strike this balance, agencies such as the Census Bureau will need to engage in continuous, extensive discussions with one another and with industry partners.

Means to an end

As a starting point, agencies should look at data as a means to an end. Data users must assess their final desired outcomes and determine the minimally invasive data elements that meet them.

Too often, data recipients, especially in cross-agency data-sharing relationships, want the flexibility of receiving raw data to process and utilize to meet their changing needs. While this is an understandable desire, it must be balanced against the paramount need for personal data security. Starting with the desired outcome is an effective approach to resolving this conflict; asking data providers to contribute insights and outcomes rather than raw data makes it far easier to resolve data privacy concerns.

For example, while the Census rightfully protects individual data, aggregated data can often be just as useful while preserving privacy. It is challenging to decide what data best meets desired outcomes and what degree of risk is acceptable to meet them. Fortunately, differential privacy and other approaches can provide structured ways for determining how much and what type of aggregated data or insights can be shared while mitigating individual privacy risks.

Data governance around sensitive and non-sensitive data can significantly reduce data-sharing barriers. Agencies that distinguish appropriately between sensitive and non-sensitive data and label accordingly foster interoperability and help agencies make decisions about their data faster. By working with trusted industry partners to create a data governance strategy, agencies can be more deliberate about data integration and security decisions, breaking down inter-agency and intra-agency siloes.

In addition to privacy concerns, cybersecurity risks must be considered. The federal government is subject to a barrage of cyberattacks daily. As such, agencies adhere to stringent cybersecurity protocols, which can restrict data access. All federal data architectures should be shrouded in cybersecurity measures that account for requirements such as zero trust and the Evidence Act.

Fortunately, there are innovative solutions to keep data secure yet accessible. Data fabrics or data meshes allow agencies to leave data where it is and expose it through APIs. This allows the information to remain secure and be analyzed to illuminate critical insights and enable effective decision-making.

Focus on efficiency

Once agencies and their private-sector partners account for privacy requirements and security concerns, the next objective is to efficiently sort, analyze and share the data to extract meaningful value. While the amount of data available to agencies has multiplied, so too have the tools available to analyze them and provide insights. Artificial intelligence and machine learning can play important roles and, when used appropriately, save time and deliver valuable insights.

In concert with good CX practice, agencies and their industry partners should connect their analytics initiatives directly to mission outcomes to accelerate the use of data as a strategic asset throughout the federal government

Data platforms that are loosely coupled and tightly integrated can address hindrances to data sharing across agencies. This creates open architectures that allow federal employees and the public to access the information they need while putting enough controls in place to ensure the data is not misused.

Standardization is another powerful tool to accelerate data sharing. When systems are not interoperable, the transfer of information is hindered. Standardizing methodologies and technologies whenever possible can speed up and enhance these transactions. For example, DataOps, which leverages DevSecOps principles for secure data analysis, will solve inefficient data generation and processing problems by improving data quality and applying controls in an automated manner.

Federal agencies like the Census Bureau have access to massive amounts of data that will transform how the government interacts with and supports the nation’s residents. However, before agencies can capitalize on the full potential of that data, agency leaders must collaborate with one another and with their vendors to establish comprehensive strategies and procedures for effective data usage and management.

To ensure the appropriate and secure use of data, agencies must account for many competing priorities. Resolving those can be challenging, but when all parties focus on the outcome that the data serves, potential conflicts become collaborative solutions. When multiple parties work toward commonly understood goals, their unique challenges can be overcome to enhance constituent service and safety.

Evan Davis is Executive Managing Director, Business Process Services, at Maximus.

As the name implies, the National Cybersecurity Strategy’s main objective is to enhance cybersecurity across the government. However, these new rules also directly affect how cloud architectures should be modernized and configured. For example, cloud infrastructures capable of doing so must support more robust digital identity solutions to foster a “safe and efficient digital economy.” As another example, new regulations for IoT governance require more traceability and control for sensors and other devices, including better automated systems for patching and upgrades.

These and other imperatives will shape the to-do list of federal cloud development teams for years to come as they seek to evolve their architectures to be more agile, interconnected, and automated. While some agencies choose to modernize by relying on hybrid environments, like cloud-native networks working with storage and compute architectures on-prem, others have already made major progress moving assets to the cloud.

For instance, the Defense Logistics Agency has moved the majority of its assets to the cloud in recent years, leaving just two applications on-prem.

Whatever the specific IT landscape, the transformation imperative is for agencies to ensure compliance, security, observability and maximum return on investment and efficiency as they transfer data and applications to and from the cloud. Of course, this is easier said than done. At the outset, there’s a need to blend legacy standards and practices with modern components to ensure all systems can communicate effectively.

There’s also a need for more government-wide consensus on zero trust – a lynchpin element of the strategy whose standards can vary in domain focus and level of centralization, depending on the agency.

Additionally, cost management remains an issue, especially given the number of under strategized migrations that public and private sector organizations pursued in the frenzied pandemic era to adapt to remote work scenarios quickly. Consider the impact of double infrastructure costs for an application whose front end was moved to the cloud, with the back end left back on-prem, for instance.

Ensuring compliance with the right strategy

Solving the above challenges requires cloud modernization teams to conduct thorough research and planning from both a performance and cost standpoint. The best methodologies embrace a cloud-first approach to software developement, data organization and application refactoring – regardless of whether these activities are happening in the cloud or on-prem, and regardless of which direction a migration may be going between these destinations.

To support such an approach, agencies must ensure strong data standards, auditing and availability across the IT estate; and they should thoroughly utilize containers, microservices and other cloud native DevOps techniques– not just in the cloud, but also on prem and even with support from SaaS providers, MSPs or other third-party partners. Furthermore, the odds of success can be increased by embracing four key priorities in the planning and implementation phases:

— Adopt an outcome-focused mindset: Conduct thorough analysis that includes both technical and domain specialists to clarify the desired outcome of a modernization task, and then architect toward that outcome with only the data and tools that are necessary to achieve it.

— Enforce open standards and interoperability: No single technology solves every problem. This places a premium on interoperability across multiple best-of-breed technologies. Open standards and common protocols for ITSM, log management, patching and other critical functions are essential to enabling this interoperability.

— Take a direction-agnostic approach to migration: The cost management examples mentioned previously underscore that migration is not a one-way street into the cloud. Rationalize the IT investment based on whichever destination – cloud, on prem or a third-party SaaS or MSP vendor – is the best candidate to resolve an issue with performance, security or cost.

— Ensure automation is grounded in knowledge management: Automating an application or function without adequate business context applied to the underlying processes can limit the tool’s effectiveness at scale. Ensure knowledge management is part of the process by looping in domain experts and validating the business context before automation and scaling.

The cloud adoption requirements stemming from the National Cybersecurity Strategy provide federal agencies an important opportunity to optimize their cloud configurations as they work to align with mandates. While every agency must customize its approach to suit its unique environment and mission objectives, a strong modernization strategy can ensure compliance through better visibility and management across all IT assets, processes and systems.

Lee Koepping is Chief Technologist, Public Sector at ScienceLogic

Unfortunately, there are millions of similar stories across the country. According to a new report from the FTC, American consumers lost a record $10 billion to fraud, including rampant imposter scams like this one, and filed more than 1 million reports of identity theft in 2023.

The report underscores the pressing need to build a robust and trustworthy digital identity ecosystem. Doing so will prevent identity fraud without making it harder for legitimate people to access critical government services.

Bad actors steal personal data, and then use it to commit identity fraud. They do this by targeting every part of the digital identity process from validation to verification to authentication.

Recent analysis released by the Financial Crimes Enforcement Network found that of the 1.6 billion identity-related reports filed by financial institutions in 2021, 69 percent involved attackers impersonating others (validation); 18 percent involved attackers using compromised credentials (authentication); and 13 percent involved attackers exploiting insufficient verification checks (verification). In total, the agency identified $212 billion in suspicious activity related to identity in 2021 alone.

Identity fraud is estimated to continue to increase in 2024 as fraudsters become more networked, data compromises become more prevalent, and massive amounts of personal identifiable information continue to be available on the dark web. Artificial intelligence is making it easier to either steal one’s identity or combine real and/or false information to create a new fake identity, called a synthetic identity.

There has been progress toward this goal. But too many digital identity providers continue to rely on outdated approaches that keep legitimate people from receiving benefits while failing to prevent fraud.

There are three steps our leaders in government can do to prioritize a strong digital identity ecosystem in 2024.

A layered defense approach

First, government leaders should take steps to move away from relying solely on images of physical documents that are often lost, misplaced, stolen or fabricated. The pace of technology has made it far too easy for fraudsters to defeat unsophisticated systems that evaluate only images of these documents.

Layered defenses which simultaneously evaluate document, device, and behavioral elements are essential for preventing deep fakes, fake IDs, and stolen and fabricated identities from intercepting government digital services and benefits. Congress should reintroduce, and pass legislation such as the Improving Digital Identity Act which would advance a government-wide effort to address the U.S.’ fragmented digital identity infrastructure.

Beyond credit header data

Additionally, we must also move away from legacy approaches that rely on credit header data to verify identities. This is problematic because the same personal information used by credit bureaus to verify identities is too often compromised data that is easily acquired on the dark web.

In addition, certain populations, including new-to-country individuals, young people, and underbanked communities, are more likely to have an insufficient credit history and have a more difficult, if not impossible, time receiving the benefits they are due. Instead, government leaders should work to incentivize the adoption of approaches that use the latest in AI technology to deliver more equitable outcomes.

Advance transparency

Finally, government leaders must take steps to create a transparent reporting environment for the digital identity ecosystem. This can be accomplished through the long-awaited executive order on digital identity, through the creation of performance reporting standards, or inserted into contracts with digital identity providers. Government should also require digital identity providers to regularly publish their auto-approval rates, with a focus on coverage, accuracy, precision, and equity. And all data reported must be validated to ensure that we are clear on what is working and what is not.

Prioritizing a modern digital identity ecosystem is long overdue. Doing so will help us stay ahead of bad actors who are only focused on lining their pockets, while simultaneously confirming that good people can be included in an ever increasing digital economy.

Jordan Burris is VP and Head of Public Sector Strategy at Socure. He is also a board member at the Identity Theft Resource Center and a former chief of staff to the Federal CIO.

Whether applied to military, commercial or consumer domains, interoperability can benefit every step of the supply chain by reducing overall costs and enabling rapid integration, as well as by improving the long-term sustainability and maintainability of fielded systems. Interoperability promotes cohesion and efficiency across these diverse systems, and the most obvious beneficiary of this is the system integrator.

Well-defined, standardized interfaces enable integrators to select “best in breed” capabilities from multiple potential suppliers without having to absorb the additional costs associated with proprietary or custom interfaces.

In addition, the use of interoperable interfaces across subsystems and components lets integrators keep up with constantly improving technology and capabilities. In growth areas like unmanned systems, interoperability is critical to sustainability since the current “state of the art” can be quickly replaced by a next-generation breakthrough. By focusing on interoperability, new capabilities can be quickly adopted and rolled out without significant system redesign.

Interoperability also can benefit industry vendors – particularly, small- and medium-sized ones. After all, modern systems have become too complex for a single vendor to excel in each of the system’s hardware, software, and mechanical requirements. Interoperable interfaces enable vendors to specialize their offerings and compete in niche areas, while targeting products toward a broad market.

When the same interoperable interfaces are used across the military, civilian, and commercial spaces, vendors can offer a single product that can be integrated into each of these domains. This can foster a broader market and improve both quality and cost. We can look at standard interfaces in our everyday lives as proof of this, where well-supported, standardized interfaces like HDMI, USB and Ethernet gives consumers a robust set of choices across a broad market.

Eliminating ‘vendor lock’

In addition, a system comprised of interoperable components, each offered by a vendor that specialized in that capability, is likely to perform better than a “stovepipe” solution created by a single supplier. Interoperable interfaces also help to eliminate “vendor lock,” where a single supplier can dominate a market with higher price points. They also prevent the vendor lock that occurs when a supplier draws customers into a service-based model around a proprietary core functionality while promising “interoperability” for certain peripheral features.

The interoperability of products across market segments yields better options for vendors, system integrators, and acquisition agencies. For example, the Department of Defense (DoD) has made it clear that they seek to reduce costs by leveraging cost savings often seen within the larger scale of commercial markets. On the other hand, commercial organizations often balk at the high costs of research and development associated with fledgling technologies – costs the defense industry is more willing to tolerate. With interoperable interfaces, commercial markets can embrace the new capabilities developed for the defense sector while minimizing their R&D budget. And the civilian market, often price conscious, benefits from both: emerging capabilities from the defense sector with lower price points often achieved in commercial markets.

Achieving the benefits of interoperability is not without its challenges, however. Notably, achieving compliance with interoperability standards can come with significant one-time costs. Developing interfaces to standards often involves specialized knowledge and talent. Furthermore, getting those interfaces tested and validated can be costly as well. Despite these challenges, the cost-saving benefits of interoperability hopefully outweigh these start-up expenses over the long term.

In addition, to be effective, interoperability and the standardization of interfaces are best applied at critical points in the lifecycle of a new technology. During the early stages of development, things are changing too rapidly, as researchers push boundaries in new directions. Attempting to apply interoperability standards at this stage is a fool’s errand, as any agreed-upon standard is likely to become immediately out-of-date with the next major breakthrough.

On the other hand, attempting to apply standard interfaces to a mature and stable market can be equally as challenging, as organizations are unlikely to embrace an approach that might risk their market share. Consequently, interoperability standards often have a Goldilocks “just right” period in which all parties can benefit.

These challenges are often addressed through a single common driver: market demand. Anyone with a junk drawer full of outdated cables and chargers knows that the push to USB-C has made life easier. We’re now seeing a similar push in the defense segment, where the DoD is pushing hard towards adoption of Modular Open Systems Approach principles to prevent the aforementioned “vendor lock.” A key component of MOSA is interoperability through well-defined, standardized interfaces.

At the same time, standards organizations like SAE, IEEE, ISO, and ANSI have made it easier than ever for companies to collaborate on the development and publication of interoperability standards. Interoperability is almost impossible without compliant interfaces driven by industry standards. Still, even standards themselves are not enough to achieve interoperability; rather, vendors also need a way to verify and certify their products are compliant to that standard. Interoperability only works if both sides of any interface are compliant, and unambiguous standards and rigorous testing methods are the only way to ensure that. For organizations that are willing to embrace it, there are plenty of opportunities to join the effort to help steer and drive interoperability into the future.

David Martin is the Director of Software and Architecture at Neya Systems. Martin joined Neya Systems in 2011 and is the company’s subject matter expert on interoperability and extensible architectures, as well as principal Robotic Technology Kernel engineer. He has been a leading developer of JAUS standards since 2007, during which time the group transitioned from an informal working group to a formal SAE committee. In addition to his role at Neya, Martin currently serves as the Chair of the SAE International AS-4 (Unmanned Systems) Steering Committee.

A bold vision requires bold action, and the most effective way for the U.S. government to take the lead in realizing the change it and its partners seek in the digital world is to get its own house in order. To do so, it must prioritize ensuring that its marketplace reflects the values it promotes by addressing the risks that persist from its IT monoculture.

The federal government is the largest consumer of goods and services in the world, spending roughly $600 billion each year—including more than $100 billion on IT and cyber investments. A large majority of these investments are directed toward Microsoft. Relying so heavily on a single IT provider not only increases the target profile of that provider, but also limits the ability of the government to defend itself against future cyberattacks. As Sen. Eric Schmitt, R-Mo.,recently stated, “only meaningfully employing one vendor” creates a single point of failure that adversaries can exploit.”

These concerns have been echoed across government agencies, including the U.S. Departments of Veterans Affairs and Defense. Current and former officials tied the VA’s move to go “all-in” on a single vendor to the accidental disclosure of 1,500 U.S. veterans’ personal data. Similarly, former DoD senior officials questioned the department’s decision to replace its long-running cybersecurity program with off-the-shelf tools from the same vendor providing the DoD’s software and cloud services, calling the move an “unacceptable level of risk” for the department.

In December, with the passage of the 2024 National Defense Authorization Act came lawmakers’ agreement to a key insert to the act by Sen. Schmitt (section 1553) compelling the Department of Defense (DoD) to assess the cybersecurity capabilities of the technologies it uses so as to ensure competition and interoperability—the concern being that both competition and interoperability are hindered by the DoD’s overreliance on legacy vendors. Cybersecurity experts know that an impartial analysis will likely find the DoD’s overreliance on a single vendor is severely limiting competition and interoperability, and is as a result a threat to U.S. national security.

The DoD represents the largest portion of the U.S. government marketplace, but the need to diversify IT and cybersecurity vendors extends across the government and aligns with the Biden Administration’s National Cybersecurity Strategy. The strategy is rooted in two central themes: rebalancing the responsibility to defend cyberspace and realigning incentives to favor long-term investments. As part of this, the U.S. government and major technology providers are called on to protect data, assure the reliability of critical systems, and make cyberspace more resilient and defensible over the long term.

The best place to start is in its own marketplace—where the U.S. government has the most control. For the government to best protect its systems and invest in a secure digital ecosystem, it must foster greater competition and diversify the vendors it relies on to provide and secure its digital ecosystem. Doing so would drive the values the administration seeks to realize in the broader digital world and enhance our national security posture. Additionally, such a move in the largest marketplace in the world would be a major incentive to drive change and almost certainly reduce the need for extensive regulation to enforce an open, free, interoperable market.

Until the U.S. government’s marketplace exemplifies its vision for the broader digital world, it can’t expect to lead others in realizing such a vision—at home or abroad. The U.S. government should prioritize leading by example and ensure its IT marketplace fosters competition, privacy, and security, and ultimately by selecting a more diverse set of cybersecurity and IT vendors. In this way, the U.S. government will lead by example, not exception, in bringing about the global internet and technology ecosystem that it envisions at home and abroad.

Cory Simpson is the founder and CEO of Gray Space Strategies, Inc., a professional services and strategic advisory firm based in Washington, D.C., and serves as CEO of the Institute for Critical Infrastructure and as a Senior Advisor to the Cyberspace Solarium Commission.