Cyber Command’s acquisition authority still in its infancy

The U.S. Army’s ‘Cyber Center of Excellence’, Fort Gordon in Augusta, Ga., hosted a multi-service ‘NetWar’ to show, and build, cyber Warrior capabilities Tuesday, June 10. Twenty-eight Soldiers, Airmen, Navy and Marine Corps computer professionals comprised four teams representing the U.S. Army’s active, reserve and National Guard with one Joint-services team that included a U.S. Special Operations Command civilian. The scenarios tasked teams to reach three kinetic objectives given notional operation orders and varying levels of difficulty. Manipulating in miniaturized city structures the mimicry encouraged communication and knowledge sharing. “It reinforces the idea of a truly blended battlefield,” Army Chief Warrant Officer 3 Sam Blaney, (center) an information and technology manager for the Georgia National Guard’s joint force headquarters in Marietta, Georgia. “It challenges us while testing our mettle to overcome in a crunch.” Team Bravo, the multi-state U.S. Army National Guard team, completed the first mission through innovation and teamwork. “They were the first to write their own script (computer specific algorithm code) and use SQLMAP (an open source database takeover tool) to clear their objective,” Tim Medin, SANS Institute CyberCity co-creator and exercise facilitator, said. (Georgia Army National Guard photo by Staff Sgt. Tracy J. Smith)

U.S. Cyber Command is still in the beginning stages of building out an acquisition capability.

Eight years after its launch and about two years after being granted limited acquisition authority from Congress, the command is still working to demonstrate that its wares and abilities make good use of funds and that it is capable of managing contracts, its acquisition executive said.

“I will say we are in our infancy from an acquisition perspective. We are putting the foundation of the personnel and the skills,” Stephen Schanberger said Sept. 6 at the Billington Cybersecurity Summit. “We’re in the beginning stages right now.”

In the fiscal 2016 defense authorization bill, Congress gave Cyber Command limited acquisition authority capped at $75 million with a sunsetting in 2021. Congressional aides have equated this authority to that of Special Operations Command, noting that they wanted to employ a crawl, walk, run mentality to make sure Cyber Command can execute it.

Schanberger said the command is asking for more on both fronts, with a ceiling of $250 million and a sunset of 2025 — the timeline being the most important element as it makes it easier to work with vendors who know contracts might not be in doubt three years from now.

For Congress’s part, Schanberger said they want the command to show it can use the authority in the way it’s supposed to and start to stand up the backbone of a contracting organization. This includes being able to put together solicitation packages, plan contracting strategy for years ahead and be able to effectively implement and put out proposals and award them without making a mess, he said.

Schanberger said the command currently has one contracting officer and one specialist and a couple of contractors aside from himself in the contracting shop, though he expects those numbers to double in the next three months.

Cyber Command issued its first contract under this limited authority in October 2017.

Schanberger said the command awarded only one contract in fiscal 2017, due in part to the fact they lacked a contract writing system, which is now in place. In fiscal 2018, the command is on track to award roughly $40 million in contracts and in fiscal 2019 is on a path to get close to its cap, Schanberger said.

Congress has also asked what the delineation lines are between the acquisition efforts of Cyber Command and those of the services, Schanberger said.

“Right now what we really look at are what are the gaps between us and our service partners and how do we help fill those gaps,” he said.

“Typically, there are a couple of programs where we did the prototyping efforts and we transitioned that to the services. That’s where we see our most value … things that can benefit all our service cyber components.”

Some within Congress have expressed that Cyber Command has approached acquisition cautiously and are concerned the services aren’t budgeting and providing the tools and capabilities that the cyber mission force needs.

Schanberger said he thinks that command has demonstrated that it can issue contracts effectively, efficiently and quickly. However, he noted, he still does not think the command has the wherewithal internally to run something as big as the Unified Platform, one of DoD’s most critical cyber programs, from a resource perspective.