Pentagon Wants to Move Some Cyber Defense Operations to the Cloud

The Defense Department wants to move some of its defensive cyber operations to the cloud, according to a contracting document posted Monday.

The proposed contract would create a cloud-based expansion of the Pentagon’s Acropolis program, which collects terabytes of cybersecurity data from the Defense Department’s own computers and external systems, processes and analyzes that data and delivers the result to subscribers inside and outside the Pentagon.

The system also uses specialized tools to transmit unclassified data into a classified computer environment where it can be analyzed with classified tools.

The document describes Acropolis as “‘Where We Fight’ cyber adversaries.”

The contractor must rely on a specialized Defense Department system for transporting data in and out of its cloud and must encrypt that data with a Pentagon-owned encryption device, according to the notice.

The contracting document is a sources sought notice, which means the Pentagon is gathering information from possible vendors but hasn’t committed to buying anything and isn’t seeking formal bids yet.

The Pentagon expects to award the contract during the 2018 or 2019 fiscal year, which ends in September 2019, according to the notice

The winning cloud provider must already be authorized to store data that’s classified as “secret,” the notice states, meaning the company would have to be authorized at the highest of six “impact levels” that the Defense Information Systems Agency assigns to cloud providers.

The Pentagon has historically been anxious about allowing private companies to store classified data, but authorized Amazon to store some secret data in 2017. So far, Amazon is the only company with that certification, but rival Microsoft expects to achieve the authorization soon, which may allow it to compete for the Acropolis contract.

Northrop Grumman won a contract to manage the Pentagon-based version of Acropolis in 2015. That contract was worth up to $73 million over the course of four years.