Cyber Command’s acquisition growing pains

U.S. Cyber Command is still getting its footing when it comes to steering acquisitions, but more resources are needed especially as the command gains more autonomy over its buying and budget power. 

A Government Accountability Office report released March 30 found that while the command responsible for DOD’s cyberspace operations has matured its Joint Cyber Warfighting Architecture, it doesn’t yet have the metrics needed to justify acquisitions of new capabilities. 

The report states that while Cyber Command has taken necessary steps to assess the value of JCWA acquisitions, it still needs to develop outcome-based metrics, per DOD policy, to track whether a capability is delivering what a mission requires. 

“The command has been slow to determine metrics, in part because of inexperience conducting Value Assessments and the challenge of accounting for other factors—like new cyber operations tactics—on mission outcomes,” the report states. “If Cyber Command does not develop outcome-based metrics to inform future Value Assessments, it risks not being able to understand whether and how new capabilities benefit the cyber warfighting mission.”

JCWA acquisitions are largely software based and include the data management-centric Unified Platform, Persistent Cyber Training Environment, Joint Common Access Platform, and Joint Cyber Command and Control for situational awareness. Value assessments are evaluations used to determine whether a capability is worth the investment. 

The watchdog body recommended Cyber Command “develop outcome-based metrics” that would be used for future acquisition value assessments. 

DOD concurred with the recommendation but in its response noted that Cyber Command had asked for additional resources to [enhance] the command’s ability to develop in this area.” A decision on that is pending with the Office of Management and Budget, according to the report. identified steps it is taking to develop metrics for future Value Assessments.

Workforce challenges

But there are also resource challenges, particularly with the workforce, according to the report.

Cyber Command officials described understaffing in its acquisitions offices as “creating an all-hands-on-deck atmosphere, with individuals attempting to address emergent issues regardless of their office’s role, rather than a more coordinated approach.”

Additionally, officials told the GAO that staff in its JCWA Integration Office would need to expand from seven staff to 55 personnel to meet responsibilities. 

“It will take time to fill additional positions, in part, because Cyber Command officials said they must first justify and validate the command has a need before beginning to bolster the workforce in fiscal year 2025,” the report states. “Cyber Command has a workforce study underway that officials anticipate will be complete later in fiscal year 2022.”

Cyber Command has long been looking to increase its acquisition capacity, which has been bolstered by recent legislation, lawmakers’ support, and budget requests. 

The Biden administration's 2023 budget requests for nearly $11.2 billion to be spent on cyber operations, would help create five new cyber teams, while also investing in improvements to cyber ranges used for training and exercises. Some of those funds would go to enhancing the command’s role in acquisition of cyberspace programs and capabilities, according to the request. 

Starting in fiscal 2024, CyberCom is expected to take control of specific budgetary resources for the Cyber Mission Force.