Dive Brief:

• The Department of Defense is streamlining its software-procurement approval process.
• The Pentagon on Monday announced that its “Software Fast Track Initiative” would define new requirements that software vendors must meet in order to sell their products to the DOD. 
• The initiative comes as the Trump administration considers what to do with Biden-era software security programs.

Dive Insight:

One of the biggest questions about the Trump administration’s cyber policy agenda is what it will do with the Biden administration’s software security programs, including an attestation process for civilian vendors. Trump’s team has already begun changing the FedRAMP cloud security review program, seeking to increase automation and reduce wait times. Monday’s announcement of the DOD Software Fast Track Initiative extends that theme into the military procurement space.

“Lengthy, outdated cybersecurity authorization processes frustrate agile, continuous delivery,” acting DOD CIO Katie Arrington wrote in an internal announcement memo on April 24. Arrington also warned of the dangers of the government’s use of unvetted open-source software.

As part of the new initiative, DOD will spend 90 days defining cybersecurity and supply-chain risk management requirements that software must meet; the processes to verify that software meets the requirements; secure ways for companies to share attestation information with the military; and government-led “risk determinations to expedite the cybersecurity authorizations for secure, rapid software adoption.” 

The Pentagon on Monday released three Requests for Information (RFIs) to gauge the tech industry’s ability to supply tools for the initiative.

DOD’s interest in sunsetting longstanding software approval processes could create opportunities for new vendors that have struggled with the current system. The fast-track program in particular could benefit startup companies, which might be able to respond more nimbly to the coming changes than their larger competitors.

An accelerated acquisition process could also introduce cybersecurity risks, however. It remains to be seen how much of an emphasis security will receive in the new procurement program. Given U.S. officials’ longstanding concerns about supply-chain integrity, however, it is likely that the process’s emphasis on supply-chain transparency will benefit companies with no ties to China or other U.S. adversaries. The announcement criticizes existing processes for incorporating “little to no supply chain visibility.”