The Policy Is Written. Now Prove It.

Something important happened in the last 14 months. The people running defense software acquisition, the actual officials who sign the memos rather than just the think tanks and advisory boards, said out loud what industry had been saying for years. The Risk Management Framework is too slow, redundant, and incompatible with how modern software works. The Authority to Operate process creates a catch-22 that locks out exactly the companies the Department needs most. The old model was not just inefficient; it was a strategic liability.

In December 2025, Kirsten Davies was confirmed as DoW CIO. At her confirmation hearing, she committed to consolidating and scaling software acquisition guidance, developing a new generation of cyber partnerships with industry, and bringing the voice of the warfighter into the DNA of the Pentagon's IT enterprise. The priorities are right. What comes next is the test.

That expectation is now the standard. Whether the system can meet it consistently, and not just when the stars align, is the open question.

At Second Front's Offset Symposium last week, smart people grappled with genuinely hard problems in a technology environment that does not hold still. Based on those conversations and our practitioner's view of where the friction lives, here are three recommendations that deserve direct engagement before the FY2027 budget cycle closes this window.

There is a meaningful difference between policy direction and implementation architecture. The Department of War has done the first part well. The Software Fast Track (SWFT), the CSRMC, the Hegseth memo, and the FY25 NDAA reciprocity mandate: these represent a coherent and ambitious vision for how software authorization should work. What does not yet exist, publicly, is the governing instruction that gives program managers and Authorizing Officials actual legal standing to operate differently.

The SWFT memo directed the CIO, in coordination with the Under Secretaries of War for Acquisition and Sustainment, Intelligence and Security, and Research and Engineering, to develop and submit a Framework and Implementation Plan within 90 days. That sprint produced a framework document. It did not produce a revised DoDI 8510.01, the governing instruction that program managers actually operate under. Until that instruction changes, the legacy RMF process remains policy at the program office level, regardless of what the E-ring has published. A program manager cannot deviate from an approved instruction based on a memo, however forceful. And even once instructions are revised, the systems and workflows that run the authorization process operate on their own update timelines; implementation lags policy by design, not negligence. That gap needs to be planned for, not discovered.

CIO Davies identified this challenge directly at her confirmation hearing. A published implementation plan is what makes her commitment operative at the program office level.

The relevant Under Secretary offices, in coordination with the DoW CIO and CDAO, should publish a consolidated software procurement reform implementation plan by the end of FY26 Q4. A concrete plan with fixed dates, named responsible officials, and specific first-phase deliverables in FY26; full implementation targeted by the end of FY27. That plan should include a revised DoDI 8510.01 incorporating SWFT and CSRMC as executable authority; the AO directory mandated by Congress in the FY25 defense bill, published as a machine-readable dataset; and explicit policy making cross-service authorization reciprocity a presumptive default rather than an aspirational principle. CJCS should issue a parallel directive making joint-force software interoperability an explicit planning requirement, connecting the authorization reform to the operational need that justifies it.

On the civilian side, our experience makes the case. Like many on our team, I spent years in uniform waiting for products that were already built, already proven, and stuck in an authorization queue while the mission kept moving. The people responsible for the delay were following the rules exactly as written. Nobody was wrong. The system was. Coming to industry did not change the system. It just put me on the other side of the same wall. The good news: there has never been such a collection of talent focused on addressing this problem from the government side.

At Onebrief, we spent months searching for a FedRAMP High sponsor in a market full of customers eager to buy but not willing to take on the work and responsibility of sponsorship. We stopped waiting. We are finalizing FedRAMP High availability through Second Front's platform, and we expect to be live within weeks. For the agencies waiting to buy, the wait is over.

That pivot is a data point, not a complaint. A pending policy proposal would create a path that does not require a sponsor for vendors who meet a defined evidence standard. Moving that from proposal to final policy, with a timeline attached, should be on the implementation plan. The industry has already built the workaround. The policy should catch up to the practice.

Publishing plans with aggressive timelines is not a bureaucratic exercise. It is the mechanism by which senior-level intent reaches the program manager who is still obligated to use the 2022 process.

The government got something right in the SWFT process that deserves to be said clearly: they asked. Three RFIs drew 420 responses, 162 on tools alone, demonstrating that industry was ready, willing, and capable of building what the new authorization model requires. The follow-on contract has not appeared.

Building the SWFT authorization toolchain as a government-developed system would be slow, underfunded, and obsolete before it ships. Buy it instead. Issue a competitive solicitation using the faster contracting instruments the Hegseth memo already directed as the default. Scope it to three things: an AI-assisted software risk scoring engine that can process vendor security documentation quickly and consistently; an authorization routing layer connected to the published AO directory; and a common data standard that lets existing authorization artifacts from different services be compared and accepted without manual re-review.

The model for this exists. Second Front built Game Warden because the government had not solved the classified deployment problem commercially. Platform One built Iron Bank because containerized software security was not going to standardize itself. FedRAMP 20x is gaining traction precisely because it shifted from government-as-assessor to government-as-standard-setter, with commercial assessors doing the validation work. SWFT should follow that pattern.

The Cybersecurity Maturity Model Certification (CMMC) is instructive here. The DoW created a cybersecurity maturity requirement for defense contractors that was genuinely complex, genuinely important, and genuinely difficult to navigate alone, especially for lean start-ups. Rather than building a government compliance engine, the framework licensed a commercial assessment ecosystem. Hundreds of third-party assessors now compete to help companies get certified. The compliance market may not be perfect, but it is functional, scalable, and largely self-sustaining. The authorization reform effort would benefit from an equivalent commercial engine.

The first phase of contractor cybersecurity requirements took effect last November, thanks in large part to an ecosystem which sprang up overnight.  Now it’s time for a SWFT acquisition vehicle to build the authorization toolchain the framework envisions. The RFIs were the right first move. The solicitation is the necessary second one. The government has signaled clearly what it wants; 420 companies answered. It is time to buy something.

Without clear measures of success, this round of reform is indistinguishable from its predecessors.

The DoW does not publicly publish data on how long software authorizations actually take. There is no published baseline for the path from initial testing approval to full authorization across components; no tracking of how many cross-service reciprocity requests are made, accepted, or quietly ignored; no visibility into how often an authorization earned at one command is successfully transferred to another.

Culture changes through accountability structures. Accountability structures require data.

Direct DISA to publish a quarterly performance report from existing authorization tracking data: average time from initial approval to full authorization, reciprocity request outcomes by component, continuous versus legacy authorization counts. This data already exists; publishing it requires a policy decision, not a new system.

The FY2027 NDAA should include language directing each military department CIO to certify annually that their authorizing official processes include reciprocity defaults as Congress already required. Authorization committees have used that mechanism for years to enforce policy compliance without separate legislation. Pair the mandate with the measurement and the accountability structure becomes self-reinforcing.

Name the vendors. Name the programs. Publish the timelines. A program manager who knows the outcome is being tracked has cover to accept the new process. An authorizing official named in a public success story has positive incentive, not just risk exposure. Companies deciding right now whether the defense market is worth the investment get visible proof points that the system can work.

The technology ecosystem is complex. Technology is moving faster than policy, and the organizations involved are large and consequential. Nobody, certainly not us, has complete visibility into every dimension of this problem. What we understand from the field is the gap between the deployment that worked and the authorization search that did not, until industry solved it. That gap is not a failure of ambition; it is a failure of plumbing.

The ambition is well written. The policy is directionally correct. 420 companies told the DoW they are ready to build what the new model requires. What the next six months need is less inspiration and more installation: updated instructions, issued contracts, published data.

The warfighter who needs this software is not waiting for the framework to mature. Neither are our adversaries.

Adam Lackey is Chief Operating Officer of Onebrief, an AI-enabled military planning platform recently named one of Fast Company's Most Innovative Companies for 2026. The views expressed are the author's own.