Government Acquisition of Cyber Technologies

Effective and efficient cyber acquisition has proven to be a challenge for government organizations, including the Cybersecurity and Infrastructure Security Agency (CISA), part of the U.S. Department of Homeland Security (DHS). For cybersecurity, CISA has two roles: national coordinator for critical infrastructure security and resilience and the country's cyber defense agency. In these roles, CISA acquires equipment and services to support numerous capabilities and must be able to plan, develop, execute, and deploy these capabilities expeditiously.

Like most organizations, CISA approaches acquisition by seeking to understand an organization's needs and managing risks. However, the current DHS acquisition approach has not provided CISA the ability to acquire technology rapidly enough while balancing risk tolerance. This is partly because of the complexity of the acquisition process itself and partly because of a lack of a shared understanding of how to tailor the process for different types of acquisitions.

Analysts examined how different elements of the acquisition process support speed and flexibility in acquisition while maintaining an appropriate level of rigor based on acquisition complexity. They explored approaches used in other departments and agencies to create a more flexible acquisition process and identified opportunities to gain efficacies and reduce timelines in the execution of acquisition programs of record. They also identified contributions and research insights on improving and streamlining cyber acquisition and considered portfolio-based approaches to managing programs of record. This report captures the researchers' recommendations to make them available to a wider audience.