The University of South Florida (USF) recently opened a new lab aimed at providing quick, innovative solutions to the different challenges facing the Department of Defense. The new Rapid Experimentation Lab (REL) hopes to provide a unique, collaborative space to rapidly test concepts. To learn more, Federal News Network’s Eric White spoke with Taylor Johnston on The Federal Drive with Tom Temin , COO of USF’s Institute of Applied Engineering, which is managing the lab.

Interview Transcript:  

Eric White Absolutely. So why don’t we start from the beginning? How did this all come together? How did you find yourself in business with the Department of Defense? Trying to solve some of their always complex problems.

Taylor Johnston Thanks for the question. I am actually a 21 year Air Force veteran, so I’m a buyer by trade. I flew the C-21 C-130 and KC-135 in the Air Force. And while I was in the Air Force, I got to community and help a unit called Contingency Response Units. Contingency response units are challenged with setting up an air base anywhere in the world at a moment’s notice. And this is back in the mid to 2015-2016 timeframe, where essentially the problems we got were, hey, you’ve got two planes coming tonight. Figure what you can put on board and go. At that time we were dealing with antiquated generators and some other old equipment where that really got my innovation green and innovation meter ideas going, and we started looking at new ways to do power generation, new ways to use communications. And this is also at the start of AFWERX and some of the DIUs at the Defense Innovation Unit. And I got to be at the ground floor of that as an active duty member. Following my tours and the contingency response units, I ended up as the Director of Innovation for the six day Refueling Wing, which is MacDill Air Force Base. After retirement, one of the universities that I dealt with at the time was the University of South Florida. Now, the University of South Florida has this interesting arm that is a 500 1C3 nonprofit that connects those academics to federal money via contracts basis. So that’s kind of how I got involved in it. And what we do for the DoD writ large is try to solve and bring those academics to solve those tough problems for the DoD. So it’s not from a business where a 501c3 attached to the university. It’s more providing that PhD lift of  talent to the top problems of the DoD.

Eric White So before we get into the lab itself, we say complex problems. Why don’t we put a label on that? What kind of problems are you looking towards. And obviously they’re complex. So don’t feel the need to get too into the nitty gritty. But overall, what are you all going to be looking at?

Taylor Johnston Well, the Institute of Applied Engineering started in 2019 as a primarily an engineering solutions program to solve everything from a rapid mechanical design problem or some software solutions for some unattended ground sensors. What we figured out over the course of the last five years is you don’t just need that unattended ground sensor that talks to the tech network, that talks across the spectrum. You need a holistic approach to some of these new designs and new solutions. Because if I’m building anything on a mechanical thing, it’s obviously going to have some sort of electrical component, which is going to involve a chip. Where does that chip come from? How do I look at this from a business case example to an engineering solution? And then what are the policy implications of that incident solution. So we’re able to bridge the entire university to come to a solution for the DoD that actually is able to attack those wicked problems.

Eric White Gotcha. All right. So let’s get into the facility itself. You had mentioned some experience that you had with AFWERX and DIU. What lessons did you take from those agencies when modeling this lab? Did you take anything of, Oh, they do it real well over there. Let’s make sure to implement it here.

Taylor Johnston Well, one of the things that I noticed both from AFWERX, and the beautiful thing about AFWERX is there’s no real innovation, what we call Air Force specialty code. They take an airman that could be a maintainer, could be a medic, could be a troop, could be a flier like myself. And they bring them into a room with a whole bunch of different experiences. Let them ideate, let them try to solve the problem and think about different solutions, because those different perspectives usually bring about a better solution than a stovepipe kind of answer, solely by the troops or solely by the maintainers. That’s what we try to do at the lab is create a space where I have mechanical engineers, electrical engineers, RF engineers, physicists, medical folks all in the same room, and all with that collaboration space that they’re able to go from the whiteboard to a 3D printer to a welder, to an RF chamber, an anechoic chamber, and able to bring an idea to a solution, interdisciplinary wise.

Eric White We’re speaking with Taylor Johnston. He’s the chief operating officer of the Institute of Applied Engineering at the University of South Florida. So an 8,000 square foot facility is what you have, and you want to let your engineers cook in there. What sorts of new tools and innovative technologies are you bringing in there to make sure that these engineers, they’re not going to be there forever, obviously, and they’re in high demand, I’m sure once they graduate, what do they get out of this?

Taylor Johnston Well, we do have everything from our student interns to graduate assistants to professional staff. So I have 21 engineers on my staff that are permanent members of the institute, and we’re able to actually bring in university professors to the lab. The beautiful thing about the lab is that there are seven different types of additive manufacturing machines. There’s also soldering and welding equipment in there. There’s also printed circuit machines in there, sort of print circuit boards. And there’s also RF and anechoic chambers in there too, and also everything from drill presses to laser engravers to CNC machines. Basically, everything you need to make a product that we all know is not just fabricating a product that is also incorporated in electronics in the product.

Eric White Yeah. And I want to go back to this concept of you just kind of letting the engineers do their thing. What space do they have to also conduct some experiments where it may not all work out, but tinkering is how a lot of things are discovered. What can you tell me about that aspect of things?

Taylor Johnston I’ll go back to a little bit of the fact that we are primarily a task driven organization. So the DoD comes to us with that, Hey, I need a solution to this. And we’ll go out and either do an analysis of alternatives, or we’ll go out and try and prove what they’re trying to do and actually build what they want to have built. Part of that also, as you intimated towards, allows our engineers to figure out things that they may or may not be useful in applications towards the DoD, but they are something like using the iridium satellite network for communications versus the new Starlink. What’s capable of this? Some of the things that are out there that may or may not be useful today. And how are we able to parse things and do edge computing for things that may or may not be done on the cloud? So a lot of the things today are cloud computing and cloud infrastructure. But when you start to talk about the Department of Defense’s needs for able to be computed on edge on device in a remote environment, you start to see some different types of problems there than usual businesses face.

Eric White What can you tell me about where this facility stands as far as setting apart other opportunities at other universities? Is this a unique opportunity for University of South Florida students, or are there facilities like this at other universities, and if so, what makes this one different from those?

Taylor Johnston There are seeing these around the nation. There are 13, I believe, university affiliated research center. So those are dedicated sponsored activities from the DoD at specific universities around the nation. The University of South Florida is more of a startup in an established ecosystem. So there’s the behemoths out there, like Johns Hopkins Applied Physics Lab and Georgia Tech Research Institute. We do a lot of research for the DoD. Those are both. The University of South Florida is well positioned just because of its geographical location, next to two combatant commands, which know where the university can really offer next to CENTCOM and SOCOM, and able to be basically a young, scrappy startup that’s able to do things a little bit outside of the box, that these older institutions may or may not have the capacity to do.

Eric White And of course, the weather’s not too bad.

Taylor Johnston The weather is absolutely perfect. Today it’s about 76 degrees and I do not see a cloud the day.

Eric White Can’t beat that. All right. Anything else that we didn’t touch on that you think is important for the conversation?

Taylor Johnston One of the important things here to note, when you think of universities, you usually think of what we call 6.1 or 6.2  basic and fundamental research dollars. It’s usually grant based. The institute is primarily designed around doing things these contract based and federal acquisition regulations and agreements with researchers, which is rare, and the ability to do things at both the controlled, unclassified level and also up to the top secret, secure compartmentalized information level so it allow researchers to do things on contract, which means that you actually do get something at the end, on time and on the schedule, versus a researcher doing things that a researcher may or may not want to do, that may or may not have applicability with the DoD. You get something that’s on time, on schedule, and it is able to be at the classification of the customer.

The post DoD gets partner from academia to help tackle complex problems first appeared on Federal News Network.

DISA released the Workforce 2025 strategy June 1. It outlines four lines of effort across the DISA workforce: expanding the knowledge base, connecting to the mission, gaining an edge and recruiting the best.

“This is solely focused on the people aspect, the right education, the right training. Is the person in the right position, versus just an assignment cycle that has an individual going to a position with no forethought,” said Air Force Lt. Gen. Robert Skinner, director of DISA.

Speaking at the AFCEA Rocky Mountain Cyberspace Symposium in Colorado Springs, Colorado, in February, Skinner said DISA was actively hiring, but the emphasis would be on fitting the right person to the right job. Recruiting features prominently in the new plan, and Skinner said while he won’t use the word headhunter, the agency plans to invest in talent recruitment and use third party sources to bring in new staff.

“We are going to have an individual whose sole focus is finding the right talent, whether it’s in high schools, whether it’s in colleges or internships or whether it’s other organizations — we are giving them a new opportunity,” Skinner said.

The workforce plan also calls for changes in the way talent is developed and retained over a longer term. Employees and service members will rotate in and out of positions more frequently and spend more time on professional development. As part of a career progression, DISA staff will have opportunities to complete higher education degrees or certification courses.

“From an education and training standpoint — what are some of the courses that they can go to? The more you develop that individual, the better they’re going to be. As they continue to go, you’ll get more out of them either at your organization or a different organization in the future,” Skinner said.

All employees will get dedicated downtime to pursue education, and a structured agency placement process will then help move personnel into positions that use new skills. A modernized learning management system will track talent investment.

Educational requirements will evolve as personnel move through the system, with more emphasis on leadership as employees move into higher pay grades. At that point, the emphasis moves to broader expertise and knowledge of the agency.

“As they get a higher rank, then we can start looking at different ways of continuing to expand their knowledge as we build capacity. Because you can’t just be stove-piped into one particular area. The complex environment that we have and that we are going to be continuing driving towards is going to require people who can do more than just that particular thing that they were initially trained on,” Skinner said.

The part of the initiative that involves “connecting to the mission” revolves around communication tools. Information on DISA’s website relating to that line of effort includes accessing the DoD chief information officer library and integrating it with DISA information. The agency also plans visits and job rotations to DISA field sites and mission-relevant locations to keep staff more in touch with different parts of the organization.

“Gaining the edge” will feature modernization efforts like upgrading physical workspaces including home offices and creating a lab environment for experimenting and learning.

“We must improve our hybrid work environment to ensure personnel work in the best environment to support DISA, whether from the office, from home or a combination of both,” Skinner said.

The post DISA to pursue new talent management strategy emphasizing recruiting and education first appeared on Federal News Network.

One of the continually evolving, albeit currently unsettled, security standards is the Cybersecurity Maturity Model Certification (CMMC), a DoD certification program designed to measure a federal government contractor’s cybersecurity maturity.  The latest rulemaking for CMMC is anticipated this May. While it remains to be seen whether the latest iteration of CMMC will be released as a proposed rule versus an interim final rule, CMMC already has the attention of companies doing business with the government.  Herein we address some of the quandaries surrounding CMMC — namely the differences between CMMC and its predecessor the DFARS Safeguarding Clause, and how companies may prepare for an evolving, unsettled cyber standard such as CMMC.

The difference between the DFARS safeguarding clause and CMMC

Defense Federal Acquisition Regulation Supplement (DFARS) 252.204-7012, Safeguarding Covered Defense Information and Cyber Incident Reporting (Safeguarding Clause), is mandatory in all defense contracts and solicitations, with one exception: The clause is not required in contracts or solicitations for exclusively commercially available off-the-shelf (COTS) items. Although it appears in most DoD contracts, the clause generally applies only when the performance of the contract implicates sensitive data known as DoD controlled unclassified information (CUI) or covered defense information (CDI). The clause requires government contractors to adequately protect CDI handled in performance of a contract and includes three basic requirements: 1) adequate security; 2) cyber incident reporting; and 3) subcontractor flow downs. For purposes of comparing to CMMC, we will focus primarily on the adequate security requirements.

A contractor must implement “adequate security” to protect CDI on its information systems if the contractor processes, stores or transmits CDI on those systems. Generally, a contractor achieves “adequate security” by implementing the National Institute of Standards and Technology’s cybersecurity standard SP 800-171, including a system security plan (SSP), describing how it has implemented the NIST controls, and a plan of action and milestones (POAM) outlining how it will implement controls in the future that are not yet met.

If a contractor intends to use a third-party cloud service provider (CSP) to process, store or transmit CDI (e.g., as part of excess data storage or SaaS applications), the contractor must ensure that the CSP meets security requirements equivalent to those established for the Federal Risk and Authorization Management Program (FedRAMP) Moderate baseline. FedRAMP is a federal government program that provides a standardized approach to security assessment, authorization and continuous monitoring for commercial cloud products and services sold to the government.

While NIST SP 800-171 and DFARS 252.204-7012 were created to safeguard sensitive data, the DoD determined that the Safeguarding Clause was ineffective on its own. The DoD inspector general found that DoD contractors did not consistently implement mandatory security for safeguarding CDI. Particularly, the Safeguarding Clause does not require the DoD to verify contractors’ implementation of NIST SP 800-171 prior to contract award. These and similar findings led the DoD to explore a new cybersecurity assessment regime.

In January 2020, DoD introduced the now defunct CMMC Version 1.0, which included five levels of CMMC certification based on maturity processes and cybersecurity controls (referred to as “practices” under CMMC). To achieve certification, a contractor would have been required to demonstrate implementation of both the maturity processes and security practices identified at the requisite level. Certification would have been available at one of five levels, based on the sensitivity of the information expected to be handled under contract performance. Each CMMC level was cumulative, meaning that the higher levels included all practices and processes from the levels below. CMMC 1.0 categorized the practices into 17 domains, which were largely based off of NIST SP 800-171, NIST SP 800-172, and CMMC-specific practices. Importantly, certification to these levels would have been conducted by a CMMC third party assessment organization (C3PAO), rather than through a contractor self-assessment or the DoD.

In November 2021, DoD announced CMMC Version 2.0, incorporating findings from its internal review and feedback from industry. DoD has explained CMMC 2.0 compliance (and thus the implicating clause DFARS 252.204-7021 requirements) will not be required until DoD completes this new round of rulemaking. DoD originally expected rulemaking to conclude in November 2023 and currently is sticking by that timeline in spite of recent delays to the rulemaking process.

CMMC 2.0 generally includes three CMMC levels of certification as follows.

CMMC Level 1, Foundational – Contractors must implement the 17 controls from NIST SP 800-171 enumerated in FAR 52.204-21 and submit an annual self-assessment to the DoD through the Supplier Performance Risk System (SPRS).

CMMC Level 2, Advanced – Contractors must implement the 110 controls in NIST SP 800-171 and submit an annual self-assessment or, if required to handle as yet undefined “critical national security information,” a triennial independent assessment performed by a private entity certified by the DoD as a third-party assessor (a C3PAO).

CMMC Level 3, Expert – Contractors must implement the 110 controls in NIST SP 800-171 and a yet to be determined subset of controls from NIST SP 800-172 before undergoing a triennial government-led assessment.

Under the current Version 2.0, compliance will continue to be required prior to award through solicitation and contract terms. DoD is currently working to finalize the scope and applicable controls for these levels. Importantly, the controls applicable at each level may change when NIST finalizes its pending revisions to SP 800-171, which are expected as soon as Spring 2023.

How to prepare for CMMC

Despite the current uncertainty surrounding CMMC rulemaking there are steps companies may consider taking now to position themselves in a better compliance posture. While not exhaustive, to follow are several practical exercises a company may take at the enterprise level to prepare for CMMC.

1. Know your data and your network

In order to adequately plan and prepare for CMMC, it is vital to understand what categories of regulated data are handled and need to be protected, as this determination informs CMMC levels and compliance requirements. For example, does the company possess federal contract information in one segmented network and process, store or transmit CUI in another? If so, there may be separate CMMC requirements for each environment. Until a company understands what data is handled and the associated regulatory and cybersecurity requirements, it is unclear what CMMC implementation and preparedness looks like for each company.

2. Refine or create corporate policies

How a company manages administrative controls are integral in meeting many of the CMMC requirements. A company’s corporate policies can serve as one out of two required artifacts that is currently required to demonstrate proof that individual CMMC practices are met.  It is clear that a company would not want to create these policies in the middle of a CMMC assessment. Hence, now is the time to refine corporate policies such as CUI marking and handling and incident response plans. Then, the task is to train on and test these policies and plans, including for example through penetration tests and tabletop exercises, to help ensure their effectiveness. These activities, under the direction of counsel, can help provide evidence of a company’s diligent approach to cybersecurity and CMMC implementation in an environment of confidentiality and privilege as discussed below.

3. Devise an SSP and conduct privileged compliance assessments

One of the most important steps of CMMC preparedness is drafting the documentation such as an SSP that a company will provide to a CMMC assessor to demonstrate its compliance. Once a company completes its documentation, it should pressure test its ability to effectively meet the applicable requirements as many CMMC practices and NIST security controls are often misinterpreted or incorrectly scoped. This validation is often most effective when conducted by an external third-party and under attorney client privilege. Using counsel with technical capabilities to conduct the assessment or to direct the assessments by third parties can benefit companies if needed to demonstrate to customers and the government that an independent assessment was conducted and also to mitigate the risk of having to disclose assessment findings in litigation or during an investigation.

Conclusion

Although there remains uncertainty regarding CMMC’s compliance requirements and what effect the upcoming rulemaking will have, there is still much work companies can do now to enhance their cybersecurity readiness. The steps outlined above are actions each company may consider performing as they move closer towards CMMC compliance.

Michael G. Gruden, a counsel at Crowell & Moring LLP’s Washington, D.C., office, is a registered practitioner under the Cybersecurity Maturity Model Certification framework, a former Pentagon information technology acquisition branch chief and a former contracting officer at the Defense Department and the Department of Homeland Security.

The post Planning for the uncertain: What to watch and how to prepare for CMMC first appeared on Federal News Network.

Their aircraft carriers don’t have catapults. Their submarines are mostly diesel. Many of their aircraft are made of Soviet-era designs. Their economic growth has ground to a halt. And their birthrate has crashed. So why does military doctrine rate China as a near-peer military offensive force? The Federal Drive with Tom Temin talked with someone who argues for a different way to think about China and consequently about the U.S. military and foreign policy. Dan Grazier is Senior Military Fellow at the Project on Government Oversight.

Interview transcript:

Tom Temin
You’ve written kind of an eye opening essay about the reality of what we constantly hear about China’s military spending and its build up. What are some of the shibboleths here that we need to maybe look at a little more closely?

Dan Grazier
I think the main thing is just questioning the general premise of all major discussions going on in Washington about national security. And the starting point for most of these discussions is that China presents an immediate existential military threat to not just the United States, but basically the entire world. And we need to spend vast fortunes to confront that threat. And so I just wanted to kind of poke holes and just raise some questions that don’t seem to be asked. And one of the main things is, what is China actually doing? And when you take a look at it for even five minutes, you realize that China is building a military that is defensive minded, that is oriented almost entirely to keeping foreign invaders out of what they consider their territory. It’s not to project military power forward, like the Chinese are not building a military to invade the West Coast of the United States. And so when you understand that, then you start to kind of question a lot of the decisions that are being made about our own military force and future.

Tom Temin
Well, let me ask you two devil’s advocate questions. And one is, that they seem to be trying to deny U.S. access to waters that were, at least at some point considered international, that are close to China. So that’s one issue. The other issue, not mentioned in your article, is the vast nuclear arsenal that they have.

Dan Grazier
Yes, the Chinese are building a military force that is capable of defending their territorial waters. So far, there hasn’t been a lot of efforts to actually exclude people from their territorial waters. And in fact, that would be pretty disastrous for the Chinese economy, because their entire economy is based on imports and exports. And so if they were to threaten to shut down waters, then that global trade would be disrupted, and the Chinese economy would take an almost immediate hit. So that’s one thing. Yes, they have the ability to do that. But that’s not what they’re actually doing. As far as keeping people out of their territory. And as far as their nuclear buildup, you could take a look at that and say that that’s actually a stabilizing effort on their part, because no one abhors the potential of a nuclear war more than me.

But it does have a stabilizing effect, because nuclear powers don’t fight each other, for good reason. Because if that war escalates, which it almost certainly would, then we would all be dead. And so their nuclear buildup, can be viewed as kind of a good thing in that sense. But we also have to take a look at the Chinese are a strategic competitor to the United States. And so we need to really take a look at, what are the reasons behind some of their moves? Because some of them might not be what it seems. Yes, they’re undertaking a big nuclear modernization. But that also prompts us to do the same thing. But when we spend money on defense, it is at a much higher level than what the Chinese do. So for every dollar that the Chinese spend on nuclear modernization, we’re spending two, three, maybe even $4. So it’s a lot more expensive for us. So that could be part of the mindset behind the Chinese moves. Like they might be trying to prompt us to do that, for us to continue investing vast amounts of money on the military, to maybe destabilize the United States.

Tom Temin
Right. Is one cause of their lower costs for seemingly the bang for the buck that they get, is the fact that maybe their contractors are similar to iPhone makers. And that they don’t get the kinds of wages that our big contracting firms get.

Dan Grazier
It’s really kind of difficult to make a direct one for one comparison between the Chinese economy and the American economy. But we also have different ways of doing business as far as defense goes. The Military Industrial Congressional Complex in the United States had some definite practices that just increased cost naturally. The idea of spreading contracts around the country just to bolster political support for programs. That adds costs in each product. And I doubt very much that there’s the same kind of motivation behind the Chinese defense industry.

Tom Temin
We’re speaking with Dan Grazier, senior military fellow with the project on government oversight. And to get back to the essay that you wrote that prompted this. You make some really interesting observations of behind the numbers we hear about Chinese. The size of their fleet on the waters, the size of their aircraft fleet and so forth, or submarine fleet. When you look at them closely, they don’t quite measure up. Kind of reminds me of the story of the ancient Israelites looking at the land they were about to occupy and coming back and reporting. Everybody there’s a giant, we’re just a grasshopper.

Dan Grazier
Right. That was a very interesting part of my research into this, when I was actually kind of evaluating the Chinese fleet. Because, again, the normal talking point or the beginning point of the discussion in Washington, is that the Chinese have a fleet that’s bigger than the United States. In raw terms, that’s very true. The last time I looked at the numbers, the Chinese hit about 355 battle force ships. And I just looked this morning, the United States has 242 battle force ships and active commission. So there’s a big discrepancy right there, and that grabs a lot of headlines. But when you really take a look at the fleet composition, then you start to see the big differences. So even though the Chinese have more ships, the United States fleet has more tonnage. Almost double the tonnage of the Chinese fleet. And that is a big impact on what the fleets can do.

The United States has bigger ships, because our fleet is oriented towards projecting military power far away from our shores. The Chinese they have a larger fleet in total numbers, but their ships are smaller, which means that they are not capable of traveling as far. They can’t carry as many missiles, they don’t have the range. Which is fine, because the Chinese fleet is a fortress fleet. It was something that Alfred Thayer Mahan, derided 100 years ago. But the Chinese have kind of upgraded the concept, because with their area denial, or anti axis area denial strategy. With all the long range missiles that are based on the shore, they create this defensive bubble over the fleet. And so that’s all meant to operate as part of a system to keep outsiders away from Chinese shores.

Tom Temin
The latter day version of the Great Wall, you might say.

Dan Grazier
Right, it’s a modern version, high tech version of the of the Great Wall. It just happens to be at sea, which is itself, that’s a pretty impressive accomplishment.

Tom Temin
Sure. So given what you have postulated about their motivation, and about their actual power. How should that devolve to how we look at what investments our military needs to make in the United States?

Dan Grazier
Well, since we’ve questioned some of the basic assumptions. I think that leads us to, like, the next logical step is to kind of reevaluate our investments in military forces. The idea of us projecting military power right up to the Chinese shores, doesn’t make a lot of sense anymore. Because that is such a formidable challenge. And we would take such great losses to do that. But even if we were able to get up to the shore. Then what? We’re not going to invade China with the United States Army, and the United States Marines. Our military force is relatively tiny. Chinese population is still really big.

Tom Temin
And a big country, geographically.

Dan Grazier
It would be a fool’s errand. So none of that actually makes any sense. So then what? If our big concern is to defend against Chinese aggression, then you don’t need to build a force to attack directly into that bubble. You just need to build a force that can deter that Chinese force from leaving its bubble. And that’s a much easier prospect than trying to build a fleet to attack directly to the mainland. So you can get away with a lot of submarines. And because this isn’t the 1940s anymore, we have a lot of allies in the region. So a better course of action would be to create a defense in depth across the Pacific. Using all of our allies in Japan, in Australia, the Oceania countries. And we can create this defense in depth, that should the Chinese ever get the notion to attack outside of that bubble, that they would then have to fight through this defense in depth.

Tom Temin
So we’re playing Dungeons and Dragons and they’re playing chess or vice versa?

Dan Grazier
Right, exactly.

The post US military planners might be viewing China in the wrong light first appeared on Federal News Network.

Most agencies already have a digital transformation strategic plan. What many of them have lacked are the resources to run with it. They’ve been limited each year by what their budget allows. But the coronavirus pandemic has acted as an accelerant for those agencies and their plans. Now federal agencies have been forced into transitioning from an industrial age model of how to manage people to an information age construct.

“The industrial model was everybody comes into buildings to do their job, and the computing environment mimicked the moat around the castle of old. So you’d come in, protect the boundaries, everybody would be on the computer system in the office, and everyone would work there,” said Bob Osborn, for ServiceNow. “COVID-19 has forced all of the government agencies at each level – federal, state and local – to understand how to manage identities or people, what their roles are, what access to information they need, how you safely and securely expand the computing environment to allow them to access what they need to do their jobs at home just like they do in the office.”

That means agencies now need a platform that can understand who is asking to access the network, what permissions they have, provide them the access they need securely, and understand what’s going on across the network. They also need the capability for smart devices to be able to access the network to expand the range of locations from which people can do their work.

“This has always been a challenge from a security perspective because many of the legacy technologies that agencies have deployed within their computing environments aren’t that mobile-ready. They’re not easily adaptable to a secure mobile environment,” Osborn said. “That’s where the born-in-the-cloud-type Software-as-a-Service platforms like ServiceNow allow for this platform of platforms application of an architecture that abstracts the legacy technology’s limitations and provides access to those core functionalities of legacy systems of record through modern mobile secure access.”

That also opens the door for artificial intelligence applications like virtual assistants and supervised machine learning. These days, most people click, swipe, and drag to conduct all of their business, from paying bills to shopping to buying an airplane ticket. Now Alexa and Siri are even doing some of that for us. These applications that allow us to make better decisions and accomplish tasks much easier can also be applied to businesses.

With legacy computer systems, the human is expected to be the data miner and aggregator. Employees must understand what systems hold the data they want and how to access and manipulate it. If it’s on multiple systems, employees have to aggregate that data, usually in a spreadsheet. And the longer it takes to do that work, the more stale the data becomes, and the less timely the decision.

“That’s the way that we’ve been conditioned to do work within government forever. Now it’s changed, now we’re utilizing the power of the platform like ServiceNow, which aggregates data information from multiple systems of record,” Osborn said. We normalize the data that’s required from those systems into a common data model and application logic within the ServiceNow application’s configuration management database.This allows AI and machine learning to run on all that data. So because of all the apps on ServiceNow, utilize the same data model. All the applications can take advantage of the artificial intelligence running through that data to assist in the workflow processes within those applications.”

That allows the artificial intelligence to assist in workflow processes. And in the case of virtual assistants, it provides an easy interface with which to interact.

The COVID-19 crisis has illustrated exactly how quickly it’s possible to roll out capabilities and applications like these. For example, it took ServiceNow only six hours to create an app that would help a major government agency re-integrate its employees into the workplace while keeping track of parameters like temperature checks and social distancing.

“And then because they already had ServiceNow, that instance of ServiceNow was already certified and accredited within their computing environment. And the application was developed on the ServiceNow platform within their computing environment; they were able to roll it into production in less than two weeks,” Osborn said.

That kind of turnaround in traditional application development is unheard of and can help federal agencies fundamentally change the way they manage human capital. That can mean increased workplace safety and employee health during the current pandemic. It can also mean supporting the readiness of warfighters while improving service delivery.

“Agencies want to move from the industrial age construct in how we manage people to the information age, and ServiceNow is perfectly positioned to do that,” Osborn said.

The post How agencies can transition workforce management from the industrial age to the information age first appeared on Federal News Network.

One of the key tools for accomplishing that two-way information flow finally came online in December after years of development. The new system, called MyNavy Assignment, replaces an older one called Career Management System-Interactive Detailing. Navy officials say it’s much more than a website redesign, and that it will “fundamentally change” the way enlisted sailors are picked for their next assignments.

“Heretofore, our assignments process has been a little static: it’s been about the needs of the Navy, and if we can make a match to the desires of the individual, that’s great,” said Rear Adm. Jeffrey Hughes, the commander of Navy Personnel Command. “But we’ve gotten better about process. We’re targeting that particular billet so that we have a better opportunity to match the talent to task at scale.”

Among the changes: via a new “resume” feature, service members can now add details about themselves that wouldn’t normally appear in their military service record, so that detailers can take those attributes into consideration when matching sailors with open jobs. And sailors can see a catalog of every position that’s expected to open up within the next 12 months, giving them a much broader view of what their opportunities might be.

Hughes said there’s good reason to believe that approach will let the Navy do a better job of staffing hard-to-fill billets, since it will also let the Navy advertise incentives to apply for those positions.

“Most people think about monetary incentives, but we have found through a lot of research that if you tell people, ‘We need you to go to a very hard warfighting job right now, but on the backside, we’d like to offer you this educational opportunity,’ we see people latch onto that,’” he said during an online event hosted by the national security professional association NatSecGirlSquad.  “It’s a non-monetary incentive that’s going to help us in our marketplace, and we think there’s great merit there.”

Under the banner of a multi-year initiative called Sailor 2025, the Navy has had some successes modifying its own processes to make sailors’ career progression more individualized. Congress has helped by updating personnel laws in some areas, such as authorizing the Career Intermission Program that let service members take 2-3 year breaks in military service. Several hundred have taken advantage of that program, mostly to pursue educational opportunities.

Hughes said the COVID-19 pandemic served as something of a forcing function to help accelerate some of the process reforms the Navy has been working on for years.

“To be honest, I was concerned that not being able to bring large teams of people together in front of a whiteboard,” he said. “But we’re doing it via a virtual means, and we’re not only keeping up, I think we’re actually moving at a faster clip.”

But harnessing data to help guide personnel decisions remains a challenge, Hughes said. The Navy collects vast amounts of information about individual service members, but it’s not stored in one place.

“It’s not harmonized, it’s not an authoritative environment, it’s kind of all over the place,” he said. “We have gaps and seams in our ability to pull it all together to allow us to run these that are designed to do a lot of things, promotion boards and assignments at scale – hundreds of thousands of people. So we really need to harmonize both the process and IT and culture situation. We’re seeing some improvement, but the real world has gone to agile, and we’re trying to follow suit.”

The post Navy opens ‘marketplace’ to help move itself into modern age of talent management first appeared on Federal News Network.

The Army is making a push to improve the way it places soldiers in jobs and, in turn, may be increasing their quality of life along the way.

This past fall the service finished up its first trial with the talent marketplace, placing nearly 15,000 officers in positions they were interested in based on their individual talents and the needs of the commands taking in new soldiers.

“Naturally people would like to have a hand or a part in the decision-making process for where they choose to move,” Army Talent Management Task Force Deputy Director Mike Arnold told Federal News Network. “The data suggests that people are pleased with the transparency and their ability to show their knowledge, skills and behaviors; write a resume. In that respect people have a hand in their own destiny.”

Those officers were supposed to move to their new orders starting this summer, but the Army had to postpone them because of the coronavirus. However, the Army still learned lessons along the way.

The way the talent marketplace works is it asks officers to upload the attributes Arnold mentioned. Then they can choose their preferences for the command they want to work under. Those commands look at the resumes and skills and choose who they think would fit best.

This differs from the previous system, where assignment officers decided where to place soldiers. The result of this new approach was a 67% match for soldiers pairing up with commands in their top three preferences.

“Everybody wants to have some degree of control and this process allowed them to have that,” Arnold said. “When you expand that to an individual officer and their communication with their spouse and families, they’re preferences are based on a whole host of reasons. We had stories of officers sitting at their screens with their spouses right next to them and they were able to talk to their mentors, weigh the pros and cons of different decisions as they preference each assignment location.”

The Army gained some insight into its soldiers as well. Not only did it learn about the skills and knowledge of its soldiers outside their careers in the service, it also showed the Army where people are interested in spending their time and what career paths are in higher demand.

“We’re using that to structure our incentives such as brevet promotions,” said Col. Michael Kuzara, team chief for the employ team at the Army Talent Task Force. “What changed is this went from simply a numbers game of filling people at certain locations to certain fill percentage level.”

Right now, the Talent Management Task Force is working with the Army Research Institute of restructuring the data points of skills and behaviors the officers added to make them easier to use and to expand what can be done with them.

The next round of selections is not set until this fall and an official date hasn’t been hammered down, however, the Army plans on expanding the talent marketplace.

The Army Career Tracker, a portal for soldiers to use for job support, currently runs the marketplace. However, it eventually will evolve to be part of the Integrated Personnel and Pay System – Army, which will consolidate human resources capabilities into one system.

The Army is now tweaking with the talent marketplace by adding new features, such as hover functions over buttons, better filtering and sorting and an improved interface.

The post Army’s talent management marketplace can improve family life too first appeared on Federal News Network.

Within the Army, the job falls to Dr. Charles “Chuck” Brandon, director for continuous process improvement (CPI) in the Army’s Office of Business Transformation (OBT). In a broad sense, it can sound like a simple mission. “We’re asked to look at the process and look for opportunities to improve the process,” said Brandon, who recently was named Business Transformation Leader of the Year by the Process Excellence (PEX) Network.

But in practice, it can be an extremely complex undertaking, which has benefitted from a concerted use of data, analytics and collaboration, he said.

Continuous process improvement tends to involve back-office operations that don’t draw a lot of fanfare but nevertheless play a crucial role in underpinning operations within the military. Historically, it hasn’t involved a lot of data and analytics, but that changed about four years ago when CPI began outing advanced processes such as data mining, data discovery and process discovery into the mix. When taking on a case, Brandon said, he now typically has one or more data scientists, enterprise architects and other specialists on his team.

The PEX award resulted from Brandon’s work with the CPI office overall, although two projects in particular drew the most discussion. The projects were the Army Review Boards Agency (ARBA) Backlog Reduction and the Reductions to Army Procurement Acquisition Lead Time (PALT).

ARBA, which reviews personnel actions taken by lower levels of the Army, had come under congressional criticism in 2018 for a significant backlog of medical advisory cases for the Army Board for Correction of Military Records (ABCMR), one of 15 boards ARBA oversees.

The backlog of about 14,000 cases, some of which dated to 2016, could have a real impact on service members. For example, a soldier who had been given a dishonorable discharge was later diagnosed with a traumatic brain injury that would explain his behavior. But until his case was adjudicated, he was not eligible for Veterans Affairs benefits or able to get the help he needed.

DoD tasked the CPI office with eliminating the backlog and ensuring that ARBA’s process improvements were sustainable. After an exhaustive review of the medical team’s mounting caseloads and the factors contributing to it, CPI recommended workforce and structural changes designed to improve turnaround time for adjudicating cases, reducing the workload stresses on the team’s limited medical staff, and improving the visibility of cases in progress. Brandon said CPI changed the environment from a craftsman culture—in which individuals handled a case start to finish, regardless of progress, leading to a backlog—to a production environment where cases are worked on more quickly in an assembly line-like process. CPI’s recommendations also resulted in the creation of specialized teams and a surge force focused strictly on reducing the backlog.

“That backlog is now gone,” Brandon said, “and it hasn’t come back.”

While improving ARBA’s processes had a lot to do with volume, the Army’s plans for PALT was mostly about time—specifically, reducing the time it takes to acquire new weapons systems.

Procurement is a notoriously slow moving process; the Army takes an average of 300 days to execute a contract for aircraft or wheeled vehicle parts and maintenance, according to the CPI office. PALT—the time between a formal request and a contract award—takes up a lot of that. Army leadership, describing PALT as a measure of getting vital weapons systems quickly into the hands of warfighters, set a goal to cut the PALT cycle time by as much as half between fiscal 2019 and 2021.

CPI, which was handed the job in October 2018, used its analysis to change program targets by cost category and identify unnecessary process steps, focusing particularly on explaining why those steps added delays. It was a data-heavy project, Brandon said, with a large complement of mathematicians performing extensive collection and analysis.

Recognizing the complexities that contribute to PALT’s cycle time, CPI developed a robust improvement strategy that included leverage data-driven hypothesis combined with contracting expertise to find opportunities for enhancements, rather than just using data to support predetermined solutions. Brandon said the PALT cycle time has been reduced by about 40%, with further improvements planned.

Along with making use of data, collaboration with the stakeholders involved in a process has been essential to the success of CPI’s work.

“The key change has been the cooperative environment,” CPI established, he said, pointing out that process changes would take hold if the people involved understand why changes are being made and how they would benefit the mission. Going forward, CPI plans to build on that approach.

“We want to continue to improve our ability to integrate with other areas,” he said.

In a general sense, continuous process improvement comes down to solving problems.

“I’m a puzzler,” Brandon said. “I have to figure out the puzzle, where the pieces fit.” Those problems, however, aren’t easy. But a data-driven, collaborative approach is making all the difference.

Kevin McCaney is a freelance writer.

The post Data, collaboration get Army’s continuous process improvement up to speed first appeared on Federal News Network.

The Army embarked several years ago on a modernized talent management program that would take the service out of what was, by its own account, an “industrial age” personnel system. Instead it would develop a 21^st century approach that makes the most of the capabilities of personnel by matching them with the Army’s needs.

There are a lot of moving parts to the service’s talent management initiative, but a consistent thread is its use of data in assessing the talent the Army needs and in how soldiers and civilians should be deployed.

Considering the fast pace of technology development, the ever-changing, amorphous threat landscape as well as the competition with other sectors for the best available talent, the Army sees an innovative approach to talent management as essential to its effectiveness.

“Doing talent management well is essential to us being able to perform our mission,” said John Willison, deputy to the commanding general of the Army Combat Capabilities Development Command (CCDC), which leads the service’s technology research and development.

Like other Department of Defense components, CCDC is employing talent management techniques with its workforce, and has seen positive results.

The foundation for the approach to talent management is broken down into five basic steps:

• Define the talent that they need;
• Assess the talent they have versus what they need;
• Acquire talent;
• Develop the talent they have;
• Deploy the talent.

The most crucial step—and one that is sometimes overlooked—is at the top of the list, Willison said. The Army needs to have a grasp of the skills it will require for new capabilities, especially when looking two, three or five years down the road. Accurately identifying those needs can take a lot of work, but it is essential to preparing for the future.

“We have to spend time to define in detail not only the talent we have, but the talent we need,” Willison said.

Data collection and analytics tools play a significant role in attracting, retaining and deploying talent. And in addition to assessing the credentials of candidates and personnel, it also considers input from them.

For example, the Army’s initial forays under the talent management initiative, which it launched in 2016, focused on soldiers, Willison said, upgrading a system that previously worked according to two criteria: Rank and Military Occupational Specialty (MOS).

“We went from two variables to 25 variables,” he said, “and one of those is preference.”

The CCDC took the same approach with its own workforce of about 14,000 personnel, of which more than 10,000 are scientists and engineers. The command, which focuses on 37 principal areas of research, has seven primary and regional research centers around the country, plus its headquarters in Maryland, along with partnerships with industry, academia and affiliated posts around the world. It conducts studies in 37 primary research areas. Location also can play a part in making the best use of talent, as well as assigning employees to projects where they’re best suited.

The command has seen benefits from a data-driven approach to talent management, not just in determining the right people and teams for the right jobs, but also in shortening the time it takes to find them.

“The Amy historically hasn’t been very good bringing in new talent,” Willison said, adding that the process could take about six months. “I think we can get that six-month timeframe down to less than two months,” under the new process.

The approach to talent management benefits from support at the top of the DoD’s command, as well as from Congress. The 2019 National Defense Authorization Act granted the Army nine new authorities to help in developing a talent-based system, among them educational opportunities and new merit-based promotions.

Meanwhile, the flexible approach to finding and deploying talent can also help adjust to new wrinkles as they come up.

“I think COVID-19 is a pretty good test case,” Willison said, referring to the adjustments made in wake of the pandemic.

It has challenged CCDC on how to work remotely while maintaining productivity, but in the process also got them questioning whether every project needs everyone on site all the time. Certainly, some work has to be done at a physical location, but the expanded use of telework has raised the possibilities of where it could be used more—which could be another tool in its efforts to attract and retain the best available researchers.

“We should be able to broaden our talent pool,” he said.

Regardless of circumstances, the CCDC is banking on its talent management approach to further its research efforts in areas that are critical to the Army’s future capabilities.

“We build teams to solve hard problems,” Willison said. And that involves a data-driven approach to finding the best available talent, putting it to the most beneficial use and in the process retaining more of that talent for the long-term.

Kevin McCaney is a freelance writer.

The post Data is the Army’s secret weapon to winning the battle for talent first appeared on Federal News Network.

But that’s beginning to change. The Navy has started to build virtual replicas of the systems that comprise the IT networks aboard its warships, starting with the ships in the U.S.S. Theodore Roosevelt strike group. The basic idea is to let developers build and test new ideas on those “digital twins,” letting them get new technology out to the fleet more quickly, and without the risk of breaking mission-critical systems.

“We can catch all the problems before they ever hit a piece of hardware,” said Robert Parker, the technical director in the Navy’s program executive office for command, control, communications, computers and intelligence. “We’re trying to push testing and development as far to the left as possible. We want to build a model from day one that encapsulates all the interfaces, all the data exchanges, all the messages. So before you write a single line of code, you can check to see if you have the applications laid out correctly.”

But the potential benefits go well beyond developing software more efficiently.

The Navy wants its digital twins to operate in a commercial cloud environment. Under those circumstances, the universe of people who can write software that works on afloat systems could expand dramatically, including to deckplate-level sailors who are looking to solve a particular problem they’ve encountered – assuming they have some coding skills.

“One of the benefits of cloud is the ease of access – it’s ubiquitous,” said Delores Washburn, the chief engineer at Naval Information Warfare Center Pacific. “We’ve been able to architect it in a secure way where we can let our contractors, the performers, and even the government workforce, all have access to the same development environment. We have folks all across the United States accessing it to do development now.”

But getting to a point where that’s possible is harder than it sounds. Most of the modern world is accustomed to operating in an environment where computing hardware is swapped out every couple of years, and software updates happen with the tap of a button. That’s not how the Navy’s applications have historically been architected.

They’ve tended to be highly-siloed, with each monolithic system bringing its own data stores along for the ride on a naval vessel. To make them more agile, the Navy’s digital modernization project has also had to think through ways to make its systems more containerized.

To make it easier to solve mission-or-ship-specific problems, that’s mostly meant moving toward a platform-as-a-service model, where developers working on the Roosevelt Strike Group’s digital twin are dealing with the same IT environment that’s operating aboard the strike group’s vessels.

“When we go have a big ship maintenance availability and we do our software installs, we’re not done,” Washburn said. “If there’s some new game-changing technology, we can now push that update out there to the ships in the strike group just as seamlessly as you would on your smartphone, because those building blocks are all there.”

One of those key building blocks is the Consolidated Afloat Networks and Enterprise Services (CANES) program the Navy started a decade ago, which aimed to move all of its ships toward a common IT baseline. But even with CANES, every ship is different – mostly because of local software settings that have been changed over time.

With digital twins, Parker said shore-side developers can now start to work on an accurate model of a particular ship’s real-world network at a particular point in time.

“We have a model of what the as-built configuration for the ship should be – PC settings, router settings, switch settings – and as we pull the real-world settings down, we can immediately compare the two and determine where they went out of compliance,” he said. “I don’t need a perfect model, I just need to figure out where the pain points are – what are the things that are going to prevent applications from being able to talk to one another.”

Even as the Navy continues to refine the concept for the Roosevelt strike group, the eventual ambition is to create a digital twin for each of the nearly 300 vessels in its deployable battle force.

“That’s the power of the cloud,” Washburn said. “It’s so easy to spin up a copy of a ship, and we should be able to replicate any ship out there in the fleet. We’d already done a digital twin of the U.S.S. Abraham Lincoln, and now we’re just expanding that idea by doing all of the ships in the Theodore Roosevelt Strike Group. This will be our new way of doing business, but it’s been a journey, and it’s exciting to see how we’re able to make such an impactful change and deliver agility for the fleet.”

The post Navy using ‘digital twins’ to speed innovation to the fleet. first appeared on Federal News Network.

The Air Force has been working with a 1980s talent management and personnel model for the past several years and its vestiges have left the service with some issues recruiting and retaining the airmen in an all-volunteer force for 21^st century jobs.

Part of the answer to correcting that issue is collecting and utilizing data to better the lives of airmen, giving them the tools they need to succeed and putting them in positions to accomplish their mission.

The Air Force is currently working on major projects that it thinks will give airmen those opportunities.

“We’re using dashboards to empower our personnel at the lowest levels up through the highest levels to really understand the landscape and to be better able to inform and advise commanders who are making decisions,” said Gwen DeFilippi, Air Force assistant deputy chief of staff for manpower, personnel and services. “We’re also using data to be predictive. We are at a place where technologies from the commercial sector are putting us in a place where we’re going to be positioned to understand what’s likely to change based on the actions we take.”

DeFilippi said the biggest issue facing the Air Force right now is the war for talent in attracting and retaining the best service members and civilians.

The Air Force is using the talent marketplace to better place airmen in jobs that will fit their skills and preferences.

“Right now it’s rolled out to officers, and we’re starting to bring it into the enlisted workforce,” DeFilippi said. “It allows an officer to go in and describe their competencies and capabilities and bid on jobs. It also allows people that own jobs, for the first time, to see the available talent and express preferences about who they’d like to hire.”

DeFilippi said tools like that let airmen flourish in their careers all by using data.

Collecting and harnessing data needs proper IT systems to ensure the airmen and leaders are using the data properly.

That is why the Air Force human resource community is modernizing its data system.

“We’re working to move from about 120 different individual systems that support the way we do business to five or six broad kinds of platforms,” DeFilippi said. “They rely on best industry practices, platform as a service and software as a service kinds of technologies.”

One of those services involves creating a large data lake of talent management information.

“We’re almost finished creating that,” she said. “That had to go first because in order for us to implement other parts of the system we have to have the master personnel file for military members in the Air Force. We’ll be changing how we do customer relations management and we’re in the final stages of getting approval and making contracting actions to implement that software as a service solution.”

DeFilippi said that data lake lets the Air Force develop more dashboards, applications and data visualization tools to support squadrons.

Those technologies allow the Air Force to hire its civilians faster, place airmen better, communicate talent needs between squadrons and even ensure pay is accurate and on time.

“We ended conscription in the 1970s, but out system still really relies on that same sort of concept that we can tell people what we want them to do and they’ll just do it because they have to,” DeFilippi said. “We really have to do things differently. We’ve been working on moving away from a one-size-fits-all approach to development.”

The Air Force is doing that for the first time by using its most recent promotion board to implement custom developmental career pathways for different Air Force specialties.

Informed by data, the new pathways create career roadmaps that are specialized to different jobs.

“This change is about ensure we maintain a winning team,” Air Force Chief of Staff Gen. David Goldfein said last fall. “The existing line of the Air Force category served our Air Force well and molded the excellent leaders we have today. As we look to the future of warfighting, we must have an agile system that allows for a wider range of development paths to ensure officers have the needed skills and expertise to fight and win. This sets up that path.”

The post Big data helps the Air Force gain an advantage on the talent war first appeared on Federal News Network.

Best listening experience is on Chrome, Firefox or Safari. Subscribe to Federal Drive’s daily audio interviews on Apple Podcasts or PodcastOne.

In the real world of military preparedness, even the United States operates with the help and cooperation of other nations’ forces. Much of the relationship building and training comes under the auspices of the Defense Security Cooperation Agency. Now that agency has launched a certification program for people in the security cooperation workforce. For its aims and how the certification will work, president of Defense Security Cooperation University Cara Abercrombie spoke with the Federal Drive with Tom Temin.

Interview transcript:

Tom Temin: Ms. Abercrombie, good to have you on.

Cara Abercrombie: Thanks for having me.

Tom Temin: So tell us about this program of certification. Describe maybe the security cooperation workforce and who can participate in the certification program.

Cara Abercrombie: As you mentioned in your introduction, security cooperation is a term of art we use in the department, [to] describe all the programs and activities at DoD undertakes with our allied and partner foreign security forces and their institutions to help build, improve partner operational and institutional capacity. And we do this because it’s in our mutual interest. And so the workforce that supports this is pretty large and pretty diverse. We are looking at a population of more than 20,000 civilian and military officials or positions across the department.

Tom Temin: Wow!

Cara Abercrombie: : Yes, and they fall, I would say largely working for the service is the Army, the Navy and the Air Force. About three-quarters of the workforce works for the services, but these include positions at our combatant commands, working out of our U. S. Embassies worldwide in the Office of the Secretary of Defense, the joint staff and numerous field activities and agencies.

Tom Temin: And so this purpose of certification, then, is to do what? Since they’re already working in the field, somebody must have thought, yeah, you belong here?

Cara Abercrombie: That’s right. So in 2017, and the National Defense Authorization Act passed in 2016, Congress directed the secretary of Defense and more specifically, the Defense Security Cooperation Agency to develop this security cooperation workforce development program. And the intent was they wanted us to develop and manage a professional workforce to support the security cooperation enterprise because there was a sense that we needed to improve the quality and professionalism of the workforce. This is not to say that they’re not professional. These are some of the most professional civil servants and military officers I’ve ever had the pleasure to work with. But we weren’t a professional work-force, and we wanted to ensure that these individuals have the skills required to perform the mission to ensure that when they entered positions in the workforce, they did so with the appropriate level of expertise and experience, and beyond that, to ensure that these experienced and certified individuals were getting assigned two key decision-making positions in the workforce. You know, before the certification program, some folks got training, some didn’t. But because we weren’t a standalone recognized work force in the sense that maybe our acquisition or financial management counterparts are, these individuals were not getting trained to a common standard. There wasn’t any expectation that we would do so. And so we have people coming into positions, some of them significant decision making positions without really a holistic understanding of what security cooperation is, let alone the complex web of policies, regulations, practices that govern the way we conduct security cooperation.

Tom Temin: All right, and just a quick question on the Defense Security Cooperation University itself. Where does it lie in the hierarchy of the very large defense education complex?

Cara Abercrombie: That’s a great question. So we are the newest DoD university. We were created to support this program specifically. So we officially opened our doors on Sept. 25, 2019. And part of the legislation when DoD was directed to create this workforce development program, they also directed us to create a school to train, educate and certify the workforce. And so that’s what DSCU is. We are complementary to other DoD educational institutions. We are not meant to supplant any of the well known joint professional military educational schoolhouses. Our primary goal really is to educate this workforce. Secondarily, we also serve as the center of excellence for security  cooperation education and training. And by that I mean we’re developing curriculum that we’re looking to share with other joint professional military educational institutions so that we can reach a broader population, not just those currently in our positions. These are up-and-coming military leaders who may find themselves in a security cooperation position someday that we want to make sure they’re aware of this line of effort.

Tom Temin: We’re speaking with Cara Abercrombie, she’s president of Defense Security Cooperation University. And so do you have a physical schoolhouse? You mentioned opening the doors, are there actual physical doors?

Cara Abercrombie: Yes, there are. We do have a small campus in Arlington, just down the road from the Pentagon in Crystal City, and we also maintain a small schoolhouse building at Wright Patterson Air Force Base in Dayton, Ohio, that we’re calling DSCU West. They previously were known as the Defense Institute of Security Cooperation Studies, and they to-date have done the bulk of tradecraft training for some members of the workforce, but not all.

Tom Temin: And tell us about some of the jobs that people in the workforce do and what some of the corresponding courses that you will offer will train them in.

Cara Abercrombie: Sure, so again, very diverse, and I think members of the federal workforce will appreciate — to give you a sense of the scope and breadth and depth of this workforce among the civilians, while we represent more than 150 jobs series and the tasks that we engage in are as varied as designing security cooperation programs, perhaps that the geographic combatant commands or out of our embassies overseas. We include professionals who are doing the acquisition work to provide defense articles on behalf of our partners, overseeing the logistics of getting defense articles to partners, the financial management of programs and sales — grant programs, overseeing training and education programs for partners. So it’s really a diverse workforce. So when we looked at designing curriculum to support them, we sort of had two objectives. One is, again, to give a common understanding of key competencies that everyone in the workforce should know, and we do that in our basic level curriculum. But we do have a four-tiered certification program, so individuals whose positions require a higher level of certification will get more job-specific training. So, really, the how to build a foreign military sales case or the how-to do the acquisition of, on behalf of a foreign partner. And those courses we are actually doing it in concert with the Defense Acquisition University.

Tom Temin: And you mentioned there 20,000 people in this line of work. How many do you expect to certify, say, in the first year of operation?

Cara Abercrombie: I’m really proud of how we approach the certification program. We said this first year is a transition year. So we started the certification program launched officially on Jan. 2, so members of the workforce may become certified. But we’re not making it mandatory until next January, 2021. So in this first year, we’re giving the community an opportunity to get familiar with the program, get familiar with the course where and how to register online, etc. So our goal for this first year, I would say, is a few hundred to a few thousand. But really, my primary goal is to ensure that we’re reaching individuals across the enterprise so that it’s representative of the workforce as a whole. But we believe we can successfully have everyone in the workforce at least basic certified by the end of 2022.

Tom Temin: Wow! And does this include, or could it include potentially, at some point, people in the allied agencies? Because I imagine you work with, say, the State Department from time to time.

Cara Abercrombie: We work extremely closely with the Department of State. Yes, and I have to say, our State Department colleagues, both State Department headquarters in the Foreign Service Institute, have been extremely helpful to us in curriculum development. We do invite them to participate in courses, but the certification program is designed by Congress, was intended to certify only Department of Defense personnel. But we’re certainly making sure that our partner agencies have access to training. Coast Guard is a good example is well. We do have Coast Guard, civilian and active duty Coast Guard officers who engage in security cooperation activities and we absolutely want to make this training available to them as well.

Tom Temin: And for the people that get certified, will they get a nice sheepskin certificate? to frame?

Cara Abercrombie: They will get a nice certificate to frame.

Tom Temin: It may not be sheepskin but it’ll be a nice certificate.

Cara Abercrombie: May not be sheepskin. They will get a certificate, yep.

Tom Temin: And a final question in this kind of shakedown cruise that you describe for the first year — will you be taking feedback from the people participating and maybe fine tuning things for that 2021 big launch?

Cara Abercrombie: Absolutely. And that was the intent. Look, we are smart enough to know that there’s a chance we didn’t get everything right. And so during the transition year, we are creating many opportunities to engage with members of the community to solicit feedback to fine tune everything from the process by which you register for courses online to the frequency and number of courses we are offering, course content and even we are open to feedback on certification program design overall. We want to have community buy-in. Yes, this is mandated by law, but we think this is something that members of the security cooperation workforce have long wanted, and they want to participate, and they want it to provide value to them. And the way we do that is by inviting them to offer feedback. And I will note, you know, we didn’t just develop this in isolation. We convened more than 11 working groups with representatives from across the entire department over the course of two years to design the program. So that we wanted to ensure buy-in and bottom-up input from the start. And I think we’ve succeeded.

Tom Temin: Cara Abercrombie is president of Defense Security Cooperation University.
Hey, thanks so much for joining me.

Cara Abercrombie: Thanks. I really appreciate having the opportunity to talk about the program.

Tom Temin: We’ll post this interview and a link to more information at www.federalnewsnetwork.com/FederalDrive. Hear the Federal Drive on your schedule. Subscribe at Apple Podcasts or Podcastone

The post New certification program for Defense Security Cooperation Agency employees first appeared on Federal News Network.

The cyber realm is demanding an increasing number of civilian and military experts for defensive, offensive and maintenance jobs.

In fact, Essye Miller, the Defense Department’s acting principal deputy chief information officer, told a joint panel between the Senate Armed Services Subcommittees on Cybersecurity and Personnel Wednesday that DoD lost 4,000 civilian cyber-related employees over the past year.

The Army is dealing with a similar challenge and the solution may be to, in a way, expect a little less from cyber soldiers.

One of the direst needs comes in the form of cyber tool developers and interactive on-net operators (IONs). Those are the soldiers who develop exploitation opportunities and maintain situational awareness of ongoing network operations, according to the Army Intelligence and Security Command. It’s important job that is responsible for cyber red teaming and network security. Tool developers make the actual programs that attack enemy cyber targets.

Those soldiers are important for U.S. Cyber Command and the 133 cyber mission force teams the command employs to do its bidding.

The Army needs about 150 of them, but only has about half of that.

“Part of the problem is that the Army has only about 15 spots in the RIOT training, which is remote interactive operating training, which is provided by the National Security Agency,” said Sen. Mike Rounds, the chairman of cybersecurity subcommittee . “About half of these personnel will fail the training, meaning that the Army might only see seven graduate to the Cyber Mission Force. This could leave the Army below the replacement level, given promotions and retirements, and yields a major capability gap.”

The Army’s answer? Don’t require everyone to do the RIOT training.

The service is thinking about keeping its cyber soldiers operating under the military legal rules, Title 10, and observing them in that capacity before sending them off to the NSA’s legal framework, Title 50, to tackle RIOT.

“As we conduct more and more operations off of Title 10 infrastructure, what we recognize is not every ION has to be RIOT qualified,” said Lt. Gen. Stephen Fogarty, the commander of Army Cyber Command. “We have a Title 10 operators course that allows our IONs to actually operate off the Title 10 infrastructure. That gives us the opportunity to observe them as they start to act, conduct reps. Then we can identify better those star athletes that we need to send to RIOT.”

Fogarty said the Army hopes to pick someone with a higher aptitude and a better likelihood of graduating RIOT.

“That would eventually double our numbers if we can get that straight,” he said. “By getting them in the Title 10 operators course we get them on mission much sooner than if we send them through RIOT training.”

The Air Force is already doing something similar to this by keeping its airmen in a course longer before sending them to RIOT so they are better prepared.

Fogarty said the Army gave up some of its RIOT spots so the Air Force could fill its ranks.

The Army also talked to CYBERCOM leader Gen. Paul Nakasone about expanding the pipeline of the RIOT course so more soldiers can go through the course.

“We think success for us is a number of RIOT trained operators and then a larger number of Title 10 trained operators,” Fogarty said. ““We’ve got to get off the NSA platform and become more independent. The Title 10 infrastructure, with Title 10 IONs, actually allows us to achieve that goal.”

The post Army wants to change its cyber training to beef up ranks first appeared on Federal News Network.

It’s now been nine months since the deputy secretary of Defense ordered department components to prioritize moving their IT systems to commercial cloud services, including via a new contracting vehicle known as JEDI.

But the Air Force isn’t waiting for JEDI to get up and running before it starts to comply with the spirit of Patrick Shanahan’s mandate. At Hanscom Air Force Base in Massachusetts, the service designated a new “front door” to help the service’s components move their systems not just to off-premises cloud environments, but also to the latest iteration of the Defense Information Systems Agency’s milCloud.

In its role as cloud broker for the Air Force, the service’s Managed Services Office — part of the Air Force Lifecycle Management Center — is finding that milCloud 2.0 is the right fit for more applications than it initially expected, said Mark Bacon, the acquisition program manager leading the effort.

“Frankly, at first we were wondering why the DoD would try to match what the private sector has already invested in cloud technology and data centers around the world,” he said. “But then we started to see, as we talked to the contractors that are setting up milCloud, and also Onsite Managed Services, that they might prove to be a good environment.”

Making the transition

The cloud transition office is also using existing contract vehicles to help migrate some Air Force applications to off-site commercial cloud services, including Amazon Web Services and Microsoft’s Azure.

But as the transition office worked through the process of advising Air Force commands on the best cloud environments for their existing systems, it determined that milCloud is a better solution for some applications. The application is physically hosted inside DISA’s data centers, but owned and operated by General Dynamics Information Technology.

“Take our enterprise resource planning programs, which are huge software suites that do a lot of different business processes,” Bacon said. “Since we have the DoD offering this commercial cloud pricing model now, which should save us some money, there are some large software suites that might be good to host in milCloud indefinitely, and maybe never put them in a commercial cloud.”

That’s especially true with applications that were never designed to operate in “cloud native” environments, or that rely heavily on constant data connections to other DoD systems that continue to operate within the perimeter of military networks.

In some cases, the need to continuously move information between an off-site commercial cloud environment and systems inside the DoD network boundary can make them even more costly to operate than if they were left in legacy data centers.

Since it is operated by a commercial provider, DISA decided to subject milCloud 2.0 to the same security approval process that’s required of off-site cloud providers that do business with DoD: a set of procedures sometimes referred to as “FedRAMP Plus,” which are detailed in DISA’s Cloud Security Requirements Guide.

As of now, GDIT has earned DISA approval to operate up to “impact level 5,” the department’s highest classification below the level of Secret. It expects milCloud 2.0 to gain an impact level 6 authorization for secret data by next year.

Caroline Bean, DISA’s program manager for milCloud, said the fact that milCloud also operates inside DoD’s existing network boundary should offer some comfort for IT program managers throughout the department who are considering a cloud hosting solution for the first time.

“We’ve made our pricing very competitive with other off-prem commercial service providers, but we also provide the added security advantage of the data being behind the DoD perimeter,” she said. “So I believe it comes down to the comfort level of each application’s authorizing official. Not all authorizing officials will be comfortable with jumping right away into an off-prem solution for its impact level  4 and 5 data. So our on-prem solution essentially it allows them a way to test the commercial cloud waters first.”

The post Air Force getting jump on mandate to accelerate cloud adoption, including milCloud 2.0 first appeared on Federal News Network.

The Defense Information Systems Agency’s (DISA) Defense Collaboration Services (DCS) is serving as a guinea pig for the Defense Department in moving to the newest iteration of MilCloud.

DCS aims to fully move to MilCloud 2.0 by this October, making it one of the first agencies to transition. The service is currently the largest user of Milcloud 1.0.

“We have a strategic plan and a tactical plan of how we are going to be able to deploy DCS into MilCloud 2.0. We have weekly meetings, we have subteams that are meeting to deal with deployment issues, cybersecurity issues, infrastructure issues and all those other things we need to do to deploy DCS into MilCloud 2.0,” DCS program manager Yong Shin told Federal News Radio.

DCS is most excited about the elastic, pay-as-you-go model that comes with MilCloud 2.0, Shin said. The model allows DCS to save money on hosting by only paying for what it uses instead of paying for cloud services at a flat rate.

“Right now hosting cost is a significant portion of our annual bill. Whenever we are able to reduce the cloud hosting bill we are going to be able to leverage those funds to other programs and other features and enhancements that our customers are looking for,” Shin said. “We are going to be able to go in there and create our own virtual private cloud and leverage all the efficient cloud processes they have.”

For example, Shin said if DCS customers are not using the cloud as much on the weekend, the bill will be lower.

MilCloud 1.0 has a more cumbersome billing model and does not provide all the features people have come to expect from cloud, the DCS program manager said.

“It’s exciting times here at DISA. In terms of challenges, whenever you try to do something like moving a service into a new environment there are going to be some challenges, but we have a team in place to look into those challenges,” Shin said. “This is not anything new because we moved DCS into MilClould 1.0 just a few years ago. This is not something we are inventing.”

Shin said DCS is also looking forward to taking advantage of the “containerization” MilCloud 2.0 offers.

“You can stand up the equipment that you need and turn down equipment that you don’t need, so you can save money that way,” Shin said. “The customers are going to certainly benefit from it because they are going to see more reliable service, more available service and with the additional funds we can use it to deliver other features.”

DCS 2.0

Along with the rollout of MilCloud 2.0, DCS is introducing a second variation of its own.

DCS provides free web conferencing and instant messaging to DoD employees. The service hosts more than 18,000 people a day.

DCS 2.0 will use a new software called Big Blue Button, an open source web conferencing center that is based on Linux.

“We are going to deliver a new version of Big Blue Button software to deliver [DCS 2.0],” Shin said. “This will have more enhanced audio. This new software is going to have multiuser whiteboarding and closed caption breakout rooms.”

DCS 2.0 will integrate voice so DoD employees can dial into web conferences.

DCS is also upgrading the different components to improve the security of the application.

“The big thing with this new software is DCS used to be based on [transmission control protocol], we are going to go to [user datagram protocol]. The performance should be much better,” Shin said.

DCS 2.0 will be introduced in the new MilCloud 2.0.

The post Defense Collaboration Services serving as guinea pig for MilCloud 2.0 first appeared on Federal News Network.