NATIONAL HARBOR, Md.—The White House has made it clear that it wants to uncomplicate the Pentagon’s labyrinthian acquisition system. But the antiquated process that treats buying quadcopter drones the same as fighter jets is not the only thing that keeps commercial companies from national security work.
While the Defense Department must ensure the software it puts on “government systems is secure in the event of various and even more sophisticated attacks,” the potentially yearslong process of getting an authority to operate is “a tremendous barrier in terms of the amount of time and cost it takes,” Liz Young McNally, the Defense Innovation Unit’s deputy director for commercial operations, said Wednesday at the Apex Defense forum.
The authority-to-operate, or ATO, process is required to verify that software is safe to use.
“It’s one of those areas like, the intent behind it is good…we’ve made some progress, but there is a lot more that really needs to happen,” she said.
The Trump administration has been very focused on acquisition reform to make it easier for companies to do business with the Pentagon. The efforts, including a software memo from Defense Secretary Pete Hegseth directing contracting officers to use rapid buying tools, have been well received, while also zooming in on how larger cultural issues can slow down tech adoption.
“Most people choose not to tailor,” said Melissa Johnson, who leads acquisition executive for U.S. Special Operations Command, during a keynote conversation at the forum.
And that’s a training issue.
“Everybody needs to understand, in the acquisition community, all the tools that are available to them,” she said. “Because if you’re only using one tool that you learned 20 years ago, and you think that’s the only thing you’re missing out on an opportunity to…be more flexible, go faster, and maybe solve problems that you couldn’t solve before.”
Young McNally said she’s “hopeful” that defense acquisition reform is on a glide path, but the ATO and other issues persist. The upside is that once a company lands an ATO within the Defense Department, there’s reciprocity with other defense organizations. The downside is system owners might not trust an ATO they didn’t have a hand in “to ensure the reciprocity actually happens and people trust each other on that,” Young McNally said.
And that’s ultimately a culture concern around risk.
“I know that you gave the ATO to them, but I don’t fully trust, trust your ATO, because if something happens, I’m the one who’s ultimately going to be blamed for it,” she said of the mentality that leads to systems owners pushing for companies to go through the ATO process even if they’ve already gotten one somewhere else.
“The concern and fear of that happening and what that would do is bigger…than having that company hang out for another year, waiting to get the ATO. And that’s a risk-based decision that we have, more collectively, gotten comfortable with.”
The Defense Innovation Unit has been testing out rapid ATOs with some of its portfolio companies and is looking to see how that process can be scaled elsewhere.
Budgets are another issue, including “how flexible the budget is and how much money we’re going to be able to devote to commercial technology,” she said.
“We’re working on those in collaboration with other innovation organizations, the [Defense Department], Congress, etc. So there is work being done on each of those, but I think that’s the next wave of barriers that we’re going to have to solve in order to really ensure that technology gets in the hands of the warfighter at the speed we need.”
