U.S. Cyber Command is establishing a new program executive office to oversee its Joint Cyber Warfighting Architecture—and aims to exercise more “service-like” authorities as it develops a cyber system of systems to support operations and training, its top acquisition official said June 5.
CYBERCOM launched its joint architecture five years ago to draw disparate capabilities, platforms, and weapons systems from across the services onto a single platform all cyber operators can share. As explained in the Director of Operational Test & Evaluation’s 2023 report, its goal is to “collect, fuse, and process data and intelligence in order to provide situational awareness and battle management at the strategic, operational, and tactical levels while also enabling access to a suite of cyber capabilities needed to rehearse and then act in cyberspace.”
The Air Force played a large role in the JCWA, contributing the “Unified Platform” that acts as the central data hub and integrates cyber weapons systems, and “Joint Cyber Command and Control,” a system that provides situational awareness and battle management for cyber forces. The Army contributed programs as well.
Now those elements are transitioning under the authority of CYBERCOM, Command Acquisition Executive Khoi T. Nguyen told industry insiders at the 2024 C4ISRNET Conference on June 5.
The fiscal 2022 National Defense Authorization Act gave CYBERCOM authority over planning, programming, budgeting, and execution for resources related to its Cyber Mission Forces.
CYBERCOM is working with OSD acquisition and sustainment to stand up this PEO, Nguyen said. “A&S has been a great partner for us. One of the things that they did this last year in 2023 was to give us system engineering and integration authority over all of JCWA. So what that means is we now have the authority to define the interoperability between the different components to help better drive better integration and better interoperability between the different systems.”
Budget authority transferred over to CYBERCOM for this fiscal year, but Nguyen said there’s more to do to harness service-level activities. “The next thing that we’re working on … is to try to get more acquisition authority over those shops that belong to the services,” he said. “So the next step for us is to work toward getting milestone decision authority or decision authority over those external PM shops.”
CYBERCOM is requesting some $106 million in fiscal 2025 for research and development on its Unified Platform, plus nearly $97 million for cyber command and control. It’s seeking tens of millions more for operations and maintenance. Budget documents state that in both cases, the command “changed the project structure to more clearly align projects.”
Nguyen said CYBERCOM wants to reduce redundancies between service components and ensure everyone is working on the same technology “stack.”
But as CYBERCOM pushes to use more “service-like” authorities, others are thinking even bigger: A growing chorus of lawmakers, experts, and former commanders see potential for yet another military service branch, this one built to recruit, train, and equip forces for cyber missions.
The House Armed Services Committee’s version of the 2025 National Defense Authorization bill directs the Pentagon to conduct a study on the efficacy of forming a “U.S. Cyber Force. The measure, which must still pass the full House and be reconciled with a Senate version of the bill, may not survive. But last year, the Senate backed a similar provision, suggesting that interest may be reaching a level that both chambers could approve such a study this year.
Some prominent cyber professionals aren’t buying into the idea yet, however. “I think what people have seen that cyber is changing so rapidly that we have to think about how we’re going to organize ourselves,” former CYBERCOM commander Gen. Paul N. Nakasone said in a recent podcast appearance. “I do not think organizing a service is the best way to do that right now.”
Nakasone continued: “Here’s what I do know. The department’s goal should be able to design, deliver, and deploy the most capable cyber forces that address the threats today and into the future. We need to do it in the shortest amount of time possible and we have to do it at the lowest resource cost. And so Cyber Command and the Department of Defense have already started to look at this idea of being able to model [the command] after Special Operations Command.”
U.S. Special Operations Command is unique in that it draws forces from multiple services, but has its own acquisition authorities, enabling its small, specialized programs to escape competitive pressures within the Army, Navy, Air Force, and Marine Corps, By following this so-called “SOCOM model,” CYBERCOM leaders believe they can continue to leverage the trained forces from across the different service branches, while acquiring tools and technologies for those forces to use in particular, specialized ways across the cyber domain.
But retired retired Rear Adm. Mark Montgomery, whose report earlier this year for the Foundation for Defense of Democracies called for forming a 10,000-strong Cyber Force, argues that this approach cannot prioritize cyber readiness the way a dedicated Cyber Force could.
“The biggest problem we have is in the recruitment,” Montgomery said recently. “The people that you are recruiting to get 25,000 Airmen or 30,000 Sailors or 55,000 Soldiers, whatever the numbers are, is an inherently different person than we need for about 1,000 cyber professionals a year.”