Daniel Elice

Having worked on RMF packages as a DoD Civilian and Contractor for the DoD, I’ve seen firsthand how long and frustrating the ATO process can be – sometimes dragging on for months even when a system was ready to deploy. The Department of Defense has officially recognized what many in tech and security have known for years: the U.S. military’s software procurement and security processes are too slow, too rigid, and not built for today’s threats.

On April 24, 2025, Katie Arrington, the DoD CIO issued a memo launching the Software Fast Track (SWFT) Initiative, a new effort designed to overhaul how the department acquires, tests, and authorizes software. The goal is clear: get secure, reliable software into the hands of operators faster – without compromising on cybersecurity or supply chain integrity.

Why This Matters

Currently, long procurement cycles, stacks of documentation, and risk assessments take months to complete. In practice, this creates bottlenecks and delays that are incompatible with modern threat environments – especially as adversaries move faster and exploit vulnerabilities at speed.

The SWFT Initiative aims to change that by promoting continuous authorization, streamlining cyber assessments, and involving private industry in rethinking the process from the ground up.

What’s New in the Approach?

The initiative breaks from past models in several important ways:

• Risk-Based, Not Compliance-Based: Rather than using checklist-driven compliance (like traditional RMF), the DoD is shifting toward federated risk determinations – essentially, faster, context-aware, decisions based on real-time risk.
• Built-In Software Security: There’s a strong emphasis on baking in secure development practices (like SBOMs and SCRM controls) from the start, rather than bolting them on at the end.
• Private Sector Collaboration: The DoD is engaging industry early via RFIs, hoping to pull in best practices from tech companies that already deploy secure software at scale.
• Automation and AI: Emerging technologies, including AI-based risk assessment tools, may help DoD teams validate software security postures more quickly and reduce human bottlenecks.

Challenges Ahead

While the initiative is a welcome change, execution will be the real test. Modernizing deeply entrenched acquisition systems isn’t easy. And while cATO models are gaining traction across federal agencies, they still require cultural shifts – especially in an environment where risk aversion often trumps agility.

Conclusion

As someone in cybersecurity, I see the SWFT initiative as more than just a bureaucratic shift – it’s a signal that secure DevOps is finally making its way into the federal space. If executed well, it could serve as a model for other government agencies and even large enterprises. It signals that the DoD is ready to move away from compliance theater and toward a software strategy that prioritizes speed, security, and mission impact. For vendors and developers in the defense ecosystem, it’s a chance to help reshape the future of military software – and that future looks a lot faster than before.

Check out the full memo here: https://dodcio.defense.gov/Portals/0/Documents/Library/Memo-AcceleratingSecureSoftware.pdf