The Department of Defense (DoD) agencies and the military service branches have used Other Transaction Authority (OTA) contracts to acquire and develop various information technology (IT) capabilities, including those to meet cybersecurity requirements. Over the last several weeks, I have looked at the Air Force’s use of OTA for cybersecurity-related efforts as well as the Navy’s OTA use and the Army’s use of OTA for cybersecurity. This week, I will continue the series by looking at the Defense Agencies.

Defense Agency Cybersecurity-Related OTA Spending, FY 2020-2022

The OTA spending data for the most recent three completed fiscal years (FY) – FY 2020 through FY 2022 – presents a very wide degree of OTA usage among the four major DoD components. Compared to the military departments (MILDEPs), the Defense-wide agencies taken together fall behind the Army and the Air Force in their use of OTA for cyber-related efforts, spending an aggregate $239M from FY 2020 through FY 2022. (See chart below.)

Delving into Defense Agency OTA use for each year over the 3-year period reveals some accelerated growth. After $12M in growth from FY 2020 to FY 2021, Defense Agencies spending on OTAs for cybersecurity efforts grew by $41.5M (+59%) from FY 2021 to FY 2022, to come in at $111M. (See chart below.)

Cybersecurity-Related OTA Spending by Defense Organization, FY 2020-2022

The FY 2020-2022 spending data shows that cyber-related work using OTA among the Defense Agencies is highly concentrated within two organizations that have as part of their mission to develop new, innovative capabilities and technologies to support various defense-wide capacities and functions. Nonetheless, more than a handful of Defense Agencies and offices use OTA for at least some of their cyber capability development, underscoring the attraction and accessibility of using OTA contacts.

Ninety-one percent of recent Defense Agency spending on OTA for cyber comes from two organizations – the Defense Information Systems Agency (DISA, 63%) and the Defense Advanced Research Projects Agency (DARPA, 28%).

The remaining 9% of OTA contracts for cyber-related efforts from FY 2020-2022 were spread among various other DoD organizations: Office of The Secretary of Defense (OSD, 2.3%); US Special Operations Command (SOCOM, 2.0%); Undersecretary For Research & Engineering (USD(R&E), 1.9%); Washington Headquarters Service (WHS, 1.4%); National Security Agency (NSA, 1.0%); Defense Intelligence Agency (DIA, 0.2%); Missile Defense Agency (MDA, 0.1%).  (See chart below.)

Defense Agency Cybersecurity-Related Efforts Using OTA, FY 2020-2022

Below is a list of the Defense Agency efforts using OTA that had cyber-elements for the past three fiscal years and had spending reported for FY 2022, indicating the most recent activity. The amounts below are aggregate OTA spending from FY 2020 through FY 2022, with FY 2022-specific spending also noted.

• Production Implementation of Full-Scale Cloud Based Internet Isolation (DISA), $65M total, $34M (52%) in FY 2022
• ABIL - AISS By Industry Leaders, Automatic Implementation of Secure Silicon (AISS) (DARPA), $35M total, $13M (37%) in FY 2022
• Identity, Credentialing and Access Management (ICAM) Production (DISA), $26M total, 100% in FY 2022
• Thunderdome (DISA), $17M total, 100% in FY 2022
• Trebuchet In Response to The Data Protection in Virtual Environments (DPRIVE) BAA (DARPA), $ 9M total, $4.7M) (51%) in FY 2022
• Mobile Endpoint Protection Production (DISA), $7.6M total, $2.6M (35%) in FY 2022
• Quantum Technologies For Threat Applications (USD(R&E)), $4.5M total, $13M (28%) in FY 2022
• TARDYS3 Production OTA For Sustainment of the Spectrum Scheduling System (S3) and the Interference Prevention, Detection, Resolution (IPDR) Capability (DISA), $4.2M total, 100% in FY 2022
• Prototyping of the Authentication, Verification and Integration Requirements of the GIG Eagle Platform (OSD), $3M total, 100% in FY 2022
• Spectrum and Wireless Monitoring System Prototype Project (NSA), $2.3M total, $135K (6%) in FY 2022
• Detect and Counteract Cyber-Social Operations in Supply Chain Ecosystems (DARPA), $1.8M total, $1.3M (74%) in FY 2022
• Base Production OTA for Mayhem [SW] with ForAllSecure (OSD & MDA), $1.6M total, $256K (16%) in FY 2022
• Defense Logistics Agency (DLA) Task Order 0001 Cyber Asset Inventory Management (CAIM) Production (DISA), $1.4M total, 100% in FY 2022
• Guaranteeing AI Robustness Against Deception (GARD) (DARPA), $1.3M total, $345K (26%) in FY 2022
• Social Analysis of Code to Counter Human Engineering Threats (DARPA), $1M total, $500K (50%) in FY 2022
• Software Introspection for Signaling Emergent Cybersocial Operations (SIGNAL) (DARPA), $1M total, $500K (50%) in FY 2022
• Joint Cyber Warfare Experimentation Framework (JCWEF) (DARPA), $961K total, 100% in FY 2022
• Secure Cloud Management Production (WHS), $424K total, 100% in FY 2022

Final Thoughts

While the Defense Agencies’ use of OTA contracts for cybersecurity-related efforts is more modest than the Army and Air Force, their yearly spending has been growing significantly, especially in FY 2022. Further, the strong use of OTA contracts in FY 2022 along with the wide variety of capabilities and applications for which the agencies are using these contracts indicate both the scope of innovation and the urgency they place on developing these capabilities.

The instances of cyber-related work in the context of cloud-based systems and environments indicates the ongoing priority of both securing cloud instances and leveraging cloud deployments to bolster security. Both fit within the DoD’s ongoing adoption of cloud computing. The OSD’s and MDA’s shared OTA contract for Mayhem software is a requirement that they have in common with the Air Force, Army and Navy, indicating shared priorities and common requirements that align with a joint warfighting environment.

Given the breadth of initiatives and the magnitude and complexity of the innovations being pursued, it seems likely that we will see growing use of OTAs at the Defense Agencies in the coming years.