The upcoming losses are due to some DISA employees accepting deferred resignation or voluntary early retirement programs, terminations of probationary employees and other workforce reduction initiatives inspired by Elon Musk’s DOGE, according to Lt. Gen. Paul Stanton, head of DISA and the Joint Force Headquarters-Department of Defense Information Network.

DOGE stands for Department of Government Efficiency.

However, the workforce reductions may glean some benefits for the agency, Stanton suggested during a Senate Armed Services cybersecurity subcommittee hearing.

“It’s giving us an opportunity to ruthlessly realign and optimize how we are addressing what is an evolving mission,” he said.

DISA is the Pentagon’s combat support agency responsible for providing IT and communication support to the military, as well as other federal organizations like the Department of Homeland Security and U.S. Secret Service. At the moment, DISA employs roughly 20,000 individuals — including around 6,800 DOD civilians and 1,200 active duty military personnel — and more than half are contractors, Stanton said.

Across the federal government, agencies are carrying out mandates from President Donald Trump designed to “maximize efficiency” by massively reducing the civilian workforce and making significant budget cuts. At the Pentagon, leaders are currently planning to slash more than 50,000 of the department’s 900,000-plus civilian personnel through deferred resignations, cutting probationary staff and implementing temporary hiring freezes.

Stanton told lawmakers that DISA is using the downsizing as an opportunity to reorganize its remaining workforce and direct more focus to some of its top priorities. 

“Things like the Multi-Partner Environment and initiatives like DoDNet are driving our workforce to perform roles that they hadn’t previously, and so we are doing a realignment,” he said. 

The agency also plans to request Pentagon approval to do a “surgical rehiring” in order to fill any gaps as a result of the workforce cuts that could negatively impact DISA’s missions.

“We need to hire the right people back into the right positions to then lead us forward,” Stanton said.

Along with cuts to its civilian workforce, the DOD is looking to cancel a number of IT consulting contracts following an April memo from Secretary of Defense Pete Hegseth. Components affected by the directive include the Defense Health Agency, the Defense Advanced Research Projects Agency and some of the military services.

Stanton told lawmakers that reviewing IT contracts is already a regular practice within DISA, as it allows the agency to adapt to emerging capabilities and stay aligned with its highly technical workforce.

“In the IT world, as technology changes, we have to continually evaluate whether or not we have the right industry partner performing the right mission, and so we routinely evaluate,” he said. “They’re not consulting contracts. These are individuals that are putting hands on keyboards, that are running fiber optic cables, that are performing server maintenance in a global footprint. And our contracts are healthy and are in a good spot.”

The post DISA expects 10 percent reduction in workforce due to DOGE-inspired campaign appeared first on DefenseScoop.

Brian Hermann, director and program executive officer for DISA’s PEO Cyber, told a small group of reporters Friday that the agency expects to complete all ICAM federation activities with the services by the end of fiscal 2025.

The plan is to build off ongoing work with the Army and federate its ICAM solutions in March. DISA will then work with the Navy and Marine Corps to federate their instances by the end of June, and finally complete federation with the Air and Space Forces before the end of September, Hermann said.

ICAM generally comprises a set of IT policies, systems and security tools that verifies users have the right credentials to access certain parts of a network — in this case the Pentagon’s. While various Defense Department components have worked to develop their own ICAM capabilities, the larger department has sought to create and implement an enterprise solution to streamline information sharing across the Department of Defense Information Network, as well as with international allies and partners. 

“ICAM is how we work across the department, as well as how we work with our mission partners,” Hermann said. “Enabling our work with allied and coalition partners means we have to have some connectivity and understanding of who we’re working with in that coalition, make sure that we have an understanding of their access rights and grant them access to DOD resources — as well as grant DOD users access to things that we have to share with those mission partners.”

Overall, ICAM is a key part of the Defense Department’s journey to operating under a zero-trust cybersecurity framework, which requires all users and devices connected to a network to be continually authorized as they move through it. Hermann emphasized that DISA’s federation activity is crucial in the department’s goal of achieving “target levels” of zero trust by the end of fiscal 2027.

“We’re leading that effort for the department,” he said. “Any other ICAM implementations that may exist are going to depend on us getting this federation activity done.”

At the end of 2024, DISA stood up a federation hub to begin work consolidating the Pentagon’s existing ICAM instances, beginning with the Army’s, Hermann noted. The hub gives DISA a “total picture” of all the information users can access and ensures the agency can deconflict roles they might have in other systems across the department, he said.

Once the federation is complete with the military services, Hermann said DISA plans to connect with the Defense Manpower Data Centers — a repository of information on the Pentagon’s personnel and manpower. The agency plans to pick up ICAM federation efforts on classified networks in the future as well, he added.

While Hermann couldn’t provide an exact number of applications that will need to be federated across the Pentagon, he said it is more than first expected. He noted that federation work has also given different components insights on what systems they can modernize and others that have to be replaced in the future.

“This helps the exercise of determining whether something needs to get modernized and moved to ICAM, or it needs to potentially go away and cease to exist,” Hermann said. “I think there’s a lot of application rationalization that goes on across the department in this process, and that’s probably a good house-cleaning exercise.”

As it goes through the federation process, DISA is working with Pentagon components to determine whether an enterprise ICAM solution will meet their specific needs and avoid having too many instances across the department, Hermann said.

“We really want to prove that there’s no way that [something] could be supported by an existing ICAM before we create new ones because it’s not cheap to do this. There ought to be a real strong impetus for why we would have more of these,” he said. “I strongly believe in enterprise, and I want to try and make it work as much as possible. When we do that, then we have less requirements for federation because more users are being served by the enterprise solution.

Still, Hermann emphasized the importance of finding the right balance of ICAM solutions available, as having too few available would create bottlenecks for the Defense Department. To that end, allowing the military services to have their own ICAM solutions is helping DISA move faster with adoption, he said.

“My sincere hope is that at some point in the future, we can consolidate somewhat, but getting everybody to ICAM implementation and adoption quickly is served well by having some separate instances of ICAM,” Hermann said. “That, right now, is the longest pole in the tent of adopting ICAM — making sure that the application owners are able to work with their ICAM providers and get their applications connected.”

The post DISA aims to connect DOD services to federated ICAM solution by end of 2025 appeared first on DefenseScoop.

In 2023, DISA began its Joint Operational Edge (JOE) initiative, envisioned as an integrated mesh of edge computing platforms located at Defense Department sites that could provide cloud capabilities overseas. The agency then launched different beta programs to test and scale its OCONUS cloud offerings, one of which is a version of the Stratus private cloud capability at Joint Base Pearl Harbor-Hickam in Hawaii in support of operations in Indo-Pacific Command’s area of responsibility.

Col. Jeffrey Strauss, DISA’s acquisition deputy for programs, said that while the overall effort is going well — with one of the OCONUS cloud offerings already being used to its maximum capacity — the agency is competing for funds to do more.

“There is a demand [and] appetite to do more and to prototype some new ones,” Strauss told DefenseScoop on Friday during an event hosted by Washington Technology. “The challenge there is we don’t have a lot of free capital for DISA to invest if we don’t know we have a customer.”

Part of the strain comes from the large amount of infrastructure and capability that DISA must allocate money towards maintaining, Strauss explained. A significant portion of the agency’s annual budget is eaten up by operation-and-maintenance funding to sustain current ops, which restricts how much money it can dedicate to new investment in its research-and-development portfolio, he said.

For example, DISA requested $2.6 billion in its O&M budget for fiscal 2025 and just $258 million for R&D projects.

“When you have this big sustainment bill and it grows, what gets pressured is investments into new things,” Strauss said.

As a combat support agency to the entire Defense Department, DISA also receives money from the other components via the Defense Working Capital Fund, a type of revolving pot of money that supports buying and selling of services across the Pentagon. Individual agencies put a portion of their budgets into the fund, which is then used by DISA to perform the specific services that others order from them.

Strauss indicated that although DISA hears the demand for OCONUS cloud capabilities from the military services, that doesn’t necessarily translate into what they provide financially — creating another barrier in deploying more cloud capabilities outside of the United States, he said.

In a separate interview with DefenseScoop, DOD’s Chief Information Officer John Sherman noted that OCONUS offerings weren’t initially part of the Pentagon’s push to deploy enterprise cloud capabilities under the Joint Warfighting Cloud Capability (JWCC).

However, there was recognition that future operations in the vast distances of the Indo-Pacific might require additional infrastructure, he said.

“JWCC’s infrastructure is in the continental United States, and the cloud service providers have edge capabilities that you could carry around in a [Joint Light Tactical Vehicle] or maybe even a personal portable sort of thing,” Sherman said Wednesday on the sidelines of the GEOINT Symposium in Florida. “There’s a real tyranny of distance from the Marianas Islands all the way back to California or Arlington, Virginia. You need a lily pad somewhere so you don’t have to backhaul the information.”

The larger JOE program is tackling how to provide those cloud capabilities to warfighters operating in remote locations. Along with the initial prototypes for Indo-Pacom, Sherman said his office is already looking at other deployment options in the Western Pacific, Europe and elsewhere.

“Part of this is cloud tradecraft. We’re learning this as we go along here with the intelligence community to figure out how to do cloud capabilities from the continental United States out to the tactical edge,” he said. “JOE cloud is one of those things we’ve learned that we need in place to have that sort of connectivity.”

DefenseScoop reporter Brandi Vincent contributed to this story.

The post Despite demand, DISA financially constrained to scale cloud capabilities overseas appeared first on DefenseScoop.

A provision in the committee’s version of the fiscal 2024 National Defense Authorization Act would require the Defense Department to transition its existing ICAM initiative into a program of record “subject to milestone reviews, compliance with requirements, and operational testing” within 120 days after Congress passes the defense spending bill, according to the legislation, which was approved by SASC in June and released Tuesday.

ICAM generally comprises a set of information technology policies and systems that verifies users have the right credentials to access certain parts of a network. As such, it is a critical part of the department’s journey to embracing zero-trust cybersecurity, which requires all users and data to be continuously authenticated and authorized as they move around the network.

An enterprisewide ICAM solution could also be beneficial to the department’s user experience as DOD personnel look to log in to digital systems from across the globe in a quick and easy fashion.

The Defense Information Systems Agency (DISA) tapped General Dynamics Information Technologies to deliver an ICAM capability throughout the department, although SASC lawmakers noted in a report released alongside their NDAA bill that there are current limitations in the technology’s scalability and interoperability.

“An enterprise-wide ICAM capability is a critical and pressing need for the Department of Defense (DOD) not only for cybersecurity, but also for managing complex multi-domain military operations involving information and systems classified at multiple levels,” the report said.

Senators are requiring the Pentagon to fix deficiencies in ICAM’s authentication and credentialing security capabilities that were outlined in a report submitted to Congress in April, the bill text states. That includes the department’s Public Key Infrastructure program, which facilitates secure data exchanges between users on potentially unsafe networks.

The department must also implement “improved authentication technologies, such as biometric and behavioral authentication techniques and other non-password-based solutions,” according to the provision.

Per the legislation’s accompanying report, the Pentagon will be required to replace the current enterprise ICAM’s core identity provider component with a cloud-based capability that better enables the technology to scale and integrate throughout the department.

“The committee further notes that the military services are left with the responsibility for fielding ICAM solutions for operational forces out to the tactical edge that must work seamlessly with the enterprise ICAM solution,” the report read. “Similarly, the enterprise and tactical edge ICAM systems must seamlessly operate across multiple classification levels and networks, including at the special access program level, and with multiple enterprise cloud solutions under the Joint Warfighting Cloud Capability program.” 

Committee members are asking the Secretary of Defense for a brief on the enterprise-wide ICAM program of record no later than 150 after the legislation is passed.

A reconciled version of the NDAA must be passed by the Senate and House and signed by the president before becoming law.

The post Senators push DOD to create enterprisewide ICAM program of record appeared first on DefenseScoop.

The service recently issued a request for information for the contract, which it’s calling Cloud One Next (C1N), to help chart a course for how to manage and modernize Cloud One in its next iteration, all “while taking recent government leadership direction into consideration.”

The cited recent leadership direction refers to the new National Defense Strategy, as well as the Pentagon’s 2021 OCONUS Cloud Strategy, and the Air Force’s own operational imperatives and CIO public strategy documents. Each of these strategy documents were published this year.

Referencing Cloud One’s offerings — which include “a standardized set of guardrails and tools throughout the Department of the Air Force (DAF) cloud infrastructure,” marketing support and migration services — the Air Force writes in the RFI: “Cloud One is committed to improving these common services and architecture to reduce complexity, increase security, eliminate duplication of effort, increase resiliency to failures, and accelerate cloud adoption while keeping cost in mind.”

Responses to the Air Force’s RFI are due by Dec. 4.

The development of Cloud One Next comes as the Pentagon prepares its own $9 billion Joint Warfighting Cloud Capability (JWCC) contract, which is meant to create a multi-cloud environment that can support Joint All-Domain Command and Control (JADC2) and greater adoption of artificial intelligence, among other things.

But Air Force CIO Lauren Knausenberger has been vocal that until a better option comes along, the service will continue building out its Cloud One platform as its fit-for-purpose cloud environment of choice.

“The short story is we’re not waiting, we haven’t waited, we will continue to not wait for anybody else to come and provide us with capability,” Air Force CIO Lauren Knausenberger told FedScoop during an interview for the Let’s Talk About IT podcast in July when asked about the service’s plans for cloud adoption with JWCC eventually coming. “We’re moving forward, we’re moving out, we’re continuing to improve [Cloud One]”, she added.

Meanwhile, top DOD IT officials, including CIO John Sherman, said this week that JWCC awards will be issued next month, roughly “30 days from now.”

Sherman said at a forecast to industry event hosted by the Defense Information Systems Agency that the lessons learned from JWCC’s failed predecessor — the Joint Enterprise Defense Infrastructure (JEDI) contract — and service-specific clouds like Cloud One have fed into making DOD “a cloud-conversant enterprise.”

Ultimately, programs like Cloud One are complementary — rather than competitive — to the forthcoming multi-cloud environment JWCC, Sharon Woods, head of DISA’s Hosting and Compute Center, said during a media roundtable at the same event.

“JWCC is meeting specific capability gaps in the areas of having all classification levels — so unclassified, secret and top secret, as well as tactical edge capabilities that work in those denied latency or communication-deprived environments, again, at all classification levels,” Woods said. “So JWCC will provide those capabilities and more at scale. The services have matured in their cloud journey and delivered high-quality capabilities. And we see them as being complementary, not in competition.”

Mark Pomerleau contributed to this story.

The post Air Force kicks off Cloud One follow-on contract with new RFI appeared first on DefenseScoop.

Alex McFarland, the technical lead for Vulcan in DISA’s Hosting and Compute Center, described Vulcan as similar to the software factories popping up across the Department of Defense, like the Air Force’s Kessel Run and Platform One, which have been instituted to specialize in scaling modern, agile software delivery across mission sets.

Speaking during a panel at this week’s Trellix’s Cybersecurity Summit, produced by FedScoop and CyberScoop, McFarland shared the vision for Vulcan as both a toolset for developers “to help bootstrap some of these [DevSecOps] processes” — things like CI/CD and collaborative tooling to jumpstart their secure, modern software development efforts — but also a mechanism to spread the cultural transformation associated with such modern software workflows.

“One thing I promised myself, I just didn’t want to sell a program,” McFarland said. “I want to sell them with cultural change in the work management side of it. Because if you’re going to effectively use these tools, if you adopt CI/CD practices, but then you’re only deploying quarterly … what have you really changed, right? Like how much have you actually improved it? And if we’re not working across silos and collaborating better, then we missed the mark, I think.”

The DevSecOps idea behind Vulcan — named after the Roman god of forging and engineering — is that with the right tools and best practices on the security and compliance side, developers can continuously make small updates to software on a continuing basis rather than waiting for the expiration of an authority to operate to make a big, lengthy push for recertification.

“Let’s keep trickling changes in and stay compliant and figure out that fast feedback loop: Well, that didn’t go that well. What can we do different, where can we speed it up? … Where was the lag?” McFarland explained. He added that with these constant small changes and “all this testing, we’re increasing safety” in systems.

Currently, Vulcan is offering some free open-source tools through GitLab, but McFarland expects to expand that to a fully supported, accredited environment early next year with the program’s first customers.

The plan is to start small and to bring change incrementally across DISA to partners who can benefit from outsourcing some of their secure software development stack, before then “opening up wider and wider as we go,” McFarland said.

In the federal government, “we have a lot of legacy applications. And legacy applications are sometimes more difficult to do infrastructure as code and modernize in this way,” McFarland said of working with partners across DISA and the DOD.

“I think bringing some of this stuff to bear is going to be really interesting. And this is where you know, your first bite, sometimes it’s the way you manage work and not necessarily refactoring the whole system,” he said. “Like there gets to a point where you do refactor your code base to achieve the velocity you want to achieve. But you can also make things better just by having these conversations and talking and doing DevSecOps without having to change the whole thing.”

The post DISA to launch ‘Vulcan’ DevSecOps program appeared first on DefenseScoop.

Bringing the classified network into the Thunderdome initiative — which is aimed at helping the Department of Defense move toward a zero trust architecture — is a major evolution for the program.

“The six-month extension is essential to allow DISA additional time to expand the Thunderdome pilot to include the Secure Internet Protocol Router Network and complete development, testing and deployment planning for the original unclassified prototype,” the agency said in a July 28 press release.

In January, DISA announced that it had awarded a $6.8 million Other Transaction agreement (OTA) to Booz Allen Hamilton for Thunderdome prototyping, with a six-month development timeline. The recently announced extension of the pilot will push the expected completion date to January 2023.

The agency said the ongoing Ukraine-Russia war — which began in February and has reportedly included cyberattacks from both sides — underscores the importance of securing systems like the SIPRNet, which is used globally by the Pentagon and the U.S. military to transmit secret information.

“While we have been working on developing a zero trust prototype for the unclassified network, we realized early on that we must develop one, in tandem, for the classified side. This extension will enable us to produce the necessary prototypes that will get us to a true zero trust concept,” DISA Deputy Director Christopher Barnhurst said in a press release July 28.

The SIPRNET framework “is antiquated and needs updating,” according to the release.

“Thunderdome will be a completely comprehensive and holistic approach to how the network operates — a major shift from the current architecture,” it added.

The new capability’s “secure access service edge” is expected to integrate with DISA’s Cloud Defensive Cyber Operations, Enterprise Comply to Connect, and Identity, Credential, and Access Management solutions.

“While Secure Internet Protocol Router Network is undergoing a number of modernization efforts led by DISA, the Thunderdome prototype is an important part of the SIPR redesign process and will provide SIPRNet with the security benefits of a zero trust architecture. During this extension period, DISA will design and implement a SIPR zero trust production solution that is focused on improving and better securing the SIPRNet core infrastructure. This will provide DISA with improved visibility to ensure that people cannot access documents that they do not have the need to see,” the agency said in the release.

In an executive order last year, the White House directed federal agencies to develop plans for implementing zero trust. The directive was part of a larger push to modernize the U.S. government’s cybersecurity in the wake of cyberattacks that compromised federal agencies through the exploitation of software.

Jason Martin, digital capabilities and security center director at DISA, told reporters in April at AFCEA’s TechNet Cyber conference in Baltimore, that Thunderdome will “fundamentally change” the Defense Information Systems Network (DISN) and the way that the Department of Defense Information Network (DODIN) interoperates with the DISN.

“I think those are all obviously critically important to what we’re trying to do across the department,” he said.

DISA is developing a departmentwide strategy for transitioning the DOD from today’s cybersecurity frameworks and tools to Thunderdome or other zero trust solutions.

The six-month extension of the OTA with Booz Allen Hamilton will give DISA additional time to work on the strategy; conduct operational and security testing beyond what was planned for in the initial Thunderdome pilot; and mitigate the overall risk of deploying zero trust capabilities, Martin said in the release.

Booz Allen Hamilton declined to comment.

The post DISA expanding Thunderdome cybersecurity project to include classified network appeared first on DefenseScoop.

Under the indefinite-delivery, indefinite-quantity Defense Enclave Services contract, Leidos will lead what DISA calls the Fourth Estate Network Optimization (4ENO) initiative — an effort to modernize and move the Department of Defense‘s 22 Fourth Estate agencies and field activities to a single platform.

Called DoDNet, the platform will house common IT elements like personnel, contracting and communications systems.

“We have to evolve the [Fourth Estate Defense Agencies and Field Activities] from unique information environments to a single digital enterprise. This will address the cost, security and integration issues that result from having separate networks, compute, and cybersecurity services and it will allow us to establish the modern infrastructure foundation and unified architecture needed to deliver cohesive combat support capabilities to the warfighter,” said Don Means Jr., director of DISA’s Operations and Infrastructure Center, in a statement.

Leidos will lead the management and operation of the greater network architecture for the 22 agencies and be responsible for helping those agencies in optimizing their IT portfolios in the move over to DoDNet.

Unifying the 22 Fourth Estate agencies on a single, streamlined network will provide cost-efficiency, defendability from cyberattacks and agility for modern IT development by eliminating “unnecessary complexity within the IT space,” DISA said in a release.

The contract has a potential 10-year period of performance, with a base ordering period that runs through February 2026 and three optional two-year periods to extend.

The post DISA awards $11B Defense Enclave Services contract to Leidos appeared first on DefenseScoop.

Oracle cloud is now authorized to host top secret/sensitive compartmentalized information (TS/SCI) and special access program data, according to the company. Its accreditation applies to Air Force for now.

The company built special “National Security Regions” that are walled off from the open internet to ward of adversaries attempting to access sensitive data hosted in the cloud. Oracle said its systems also include strong encryption and security controls and in-depth auditing.

“DoD assessors granted the Authority to Operate (ATO) which will enable secure processing of some of the Air Force’s most sensitive data,” the company said in its press release.

Oracle is already used across the DOD at other security levels known as “Impact Levels.” Some of its tech offerings already being used include data base cloud services and data analysis tools, the company said.

Obtaining an ATO is often the most time consuming part of deploying a new technical system or piece of software across the DOD. It is a formal declaration by a designated authority that explicitly accepts risk to agency operations.

Microsoft and Amazon Web Services have previously said they have also been accredited to host highly sensitive data.

The post Oracle cloud authorized to host top secret data for DOD appeared first on DefenseScoop.

Maj. Gen. Garret Yee has been DISA’s assistant to the director since June 2019, leading an 8,000-person workforce of military and civilian staff working on global communications and IT systems.

“I guess the word is out #transitioningmilitary,” the two-star general wrote on LinkedIn while sharing an article about the news.

A DISA spokesperson said Yee would retire on April 28, and that no acting member of staff had currently been named to fill his position.

Prior to joining DISA, Yee worked in the Army’s CIO/G-6 office, before it was split into two. While at the Pentagon he oversaw network modernization and security issues for the Army.

In a personal farewell note he wrote when leaving the CIO’s office in 2019, he cited his family history in the military and Asian American heritage as a prime motivator to join and remain a soldier for nearly three decades.

“Including my service in Iraq and Afghanistan, our family has served in World War II, Korea, Vietnam, Iraq, and Afghanistan,” he wrote. “It turns out that I come from a family fairly rich in military service. And if not for those that came before, starting with my uncle in the 442nd, I would not be serving in the military today.”

Yee was a 2021 FedScoop 50 winner in the federal leadership category.

FCW first reported the news.

The post DISA’s MG Garret Yee plans to retire in April appeared first on DefenseScoop.