DoD finds itself at an important juncture with an opportunity to make a revolutionary improvement to meet warfighter needs. By leveraging broader acquisition process and oversight changes within the functional capabilities construct, DoD is positioned to increase the efficiency, speed, and effectiveness of technology insertion from all defense industry participants into programs.
With an updated industrial base strategy, DoD can address the Gap between technology innovation and product acquisition in a new and effective way by leveraging top-level, capabilities-based perspective of leaders to affect broad, high-impact insertions of technology to benefit the warfighter.
Weapons Systems programs are never static so it is important to continually assure that all programs enabling given functional capabilities are linked to these capability goals—and able to adapt to functional capability changes.
An integrated, capabilities-based approach to program acquisition and associated oversight processes will not only improve DoD decision making, but also offers an enterprise-level view of a much broader expanse of the programs that collectively enable the desired warfighting capabilities.
By making decisions across functional and operational capability areas, program tradeoffs will be linked and prioritized with an increased understanding of relationships among programs by the broader acquisition structure.
Changes in acquisition oversight processes are at least as important as assuring that program managers’ acquisition strategies and management techniques provide context to the functional capabilities of individual programs.
Many examples exist of technology products enabling capabilities needed by the warfighter, many with potential value across the military services. What is lacking is a senior leadership mechanism to rapidly identify, adapt, and acquire innovative, near production-ready technologies for programs of record.
An updated industrial base plan will provide this capability—and improve the responsiveness of the acquisition system to operational needs. Using a warfighting capabilities-based assessment, the updated strategy identifies technologies which enable the functional concept and provides an assessment of the industrial base for a prioritized subset of those technologies.
To help create the plan, the Pentagon will release a questionnaire to the defense industry to try and gather information about potential weak spots. The questionnaire will go out with help from trade associations and major industry players. “We’re finalizing a very targeted request, and it’s a request where we give industry an opportunity to provide some information to help us do this analysis.”
Weapons systems program shortfalls are sometimes masked because deficits in industrial base performance can often be dealt with by DoD actions such as making additional funding available, altering requirements to avoid acknowledging shortfalls, or stretching out programs until technical problems have been resolved.
Moreover, program terminations — the most glaring manifestation of acquisition difficulties — can also be chosen by DoD to release funds for other uses or because products are no longer needed.
The dominant criticism of the weapons and systems produced by the defense industry is that programs either cost too much to start with, or their costs increase during development and production.
Many assessments of industrial base performance have identified a number of causes, including overly optimistic bidding in proposals, errors in engineering and management, DoD changes in requirements, and complexity of advanced military capabilities that “stretch the boundaries” of proven technology.
Many cost increases in systems don't come from technology challenges, but from the management challenges. For example, within a single large program the complexity of managing suppliers includes more than simple contracts specifying products and delivery dates.
It now involves assigning to suppliers major portions of development and production, which entails concern about the suppliers’ long term fiscal condition, their ties to other firms, international linkages, and whether the suppliers’ engineers, design processes, manufacturing facilities, workforce, and sub-component providers are capable of performing according to the requirements set forth in the contract.
Dated business and procurement practices create challenges working with DoD, including contracting regulations, policies, barriers to entry, qualification challenges, programmatic changes, and other problems, leading to adverse effects on supplier ability to retain workforce with capability to innovate, manufacture, and sustain the Defense Industrial Base..
DoD lack of long-term perspective has hurt us in key areas by causing talented people to quit the field and take jobs they know will last. Private industry has to live “quarter to quarter” on its price/earnings ratio and return on investment figures but government can take a longer perspective. But government often doesn’t, “It’s very non-linear, very hard to trace” an initial investment in research to a new working product many political cycles later and that makes R&D a hard sell to Congress.
Especially concerning are the single points of failure, the chokepoints in the supplier base where a single small firm, often struggling to get by, is the only maker of some critical spare part. There’s little profit to be made on such components because they’re only needed in small numbers – at least until something goes badly wrong, like an accident or a war. By contrast, our adversaries are willing to subsidize production of such key components, not to mention long-shot research that might one day yield some future weapon.
Once you have identified your list of targeted industrial base resources to be profiled, you are ready to begin creating a risk profile for each one. The idea is for the resource owner to rate the resource importance to the organisation from an information-security perspective and relative to all other assets in the organisation.
The profile tracks information at a business and function level and is not necessarily specific to implementation decisions. For example, if you are designing a new system, you should know what types of data will be processed and what the basic functions being performed will be before you decide on technologies or placement in DoD field network.
When you are designing your profile questionnaire, it is important to note that not every question needs to be used in the calculation of the risk sensitivity. Some questions are meant to capture other pertinent information about the resource for reporting purposes and do not directly contribute to the risk-sensitivity score.
For example, you may ask a question about where in the industrial complex systems are hosted. The answer to this question doesn't affect the sensitivity of the asset, but you may want to prioritise assessments of third-party hosted systems because of increased risk exposure, and the answer to this item will give you the desired information about which systems are hosted internally versus externally.
You may also want to ask a couple of high-level questions about whether basic security controls are in place for example, roles-based access, and asset tracking. The answers to these questions will help you to focus your efforts on resources that don't meet the most basic security control requirements.
Similarly, you may want to ask if the system uses a common or central infrastructure for authentication and authorisation or logging to eliminate the need for assessing those areas any further. Systems using one-off solutions for these core security services may have more potential for risk exposure.
Factors do not change the sensitivity of the resource, but they can help with prioritisation. For example, whether or not a vulnerability test has been performed on the resource does not affect its sensitivity, but this knowledge is important for identifying resources that may have undiscovered vulnerabilities that are readily exploitable.
You will often find yourself trying to choose between several high-sensitivity resources to assess, and these other factors can help you decide which ones to focus on first.
The industrial base risk profile questionnaire should include several questions about the resource to help determine the sensitivity and criticality of the application in comparison to others. It is essential to evaluate a resource's sensitivity on a relative scale.
Start by identifying the resource that is most crucial to the organisation, and use this as a reference point. This is important because the tendency is to rate resources too high. If you end up with all resources being rated as high sensitivity and none as moderate or low, then the scale becomes worthless.
You may not have defined the specifics of how the functions will be performed, but having business and functional requirements defined is enough to complete the security risk profile.
As part of the challenge of attracting new innovative suppliers to the defense industrial base, DoD has also begun developing a concept for an Industrial Base Technology Solutions Watch List to address the imperfections of the on-ramps available to companies that have leading-edge, producible technologies relevant to programs of record.
Program managers are intently focused on cost, schedule, and performance, so they may resist inserting innovative products that could impact program execution. As a result, innovative technologies often remain underutilized. There are other reasons technologies remain on the sidelines.
1. Do not meet programs managers’ funding priorities and not in the program’s scope as originally envisioned
2. Are “cutting room floor” technologies from losing bids difficult to assimilate in programs
3. Are not completely aligned with current producibility requirements
4. Lack capability to compete effectively with potential adversaries
5. Not always clear if systems are completely resident in a common technology generation
6. Systems don’t always lead by a technology generation or order of magnitude better performance in key attributes
7. Slow response when an immediate/projected industrial base deficiency is identified
8. Don’t identify warfighting capability leadership goals and stakeholder support/validation
9. Slow to determine and prioritize associated technology maturity
10. Not enough assessment of industrial base competition associated with innovative technologies
With an updated industrial base strategy, DoD can address the Gap between technology innovation and product acquisition in a new and effective way by leveraging top-level, capabilities-based perspective of leaders to affect broad, high-impact insertions of technology to benefit the warfighter.
Weapons Systems programs are never static so it is important to continually assure that all programs enabling given functional capabilities are linked to these capability goals—and able to adapt to functional capability changes.
An integrated, capabilities-based approach to program acquisition and associated oversight processes will not only improve DoD decision making, but also offers an enterprise-level view of a much broader expanse of the programs that collectively enable the desired warfighting capabilities.
By making decisions across functional and operational capability areas, program tradeoffs will be linked and prioritized with an increased understanding of relationships among programs by the broader acquisition structure.
Changes in acquisition oversight processes are at least as important as assuring that program managers’ acquisition strategies and management techniques provide context to the functional capabilities of individual programs.
Many examples exist of technology products enabling capabilities needed by the warfighter, many with potential value across the military services. What is lacking is a senior leadership mechanism to rapidly identify, adapt, and acquire innovative, near production-ready technologies for programs of record.
An updated industrial base plan will provide this capability—and improve the responsiveness of the acquisition system to operational needs. Using a warfighting capabilities-based assessment, the updated strategy identifies technologies which enable the functional concept and provides an assessment of the industrial base for a prioritized subset of those technologies.
To help create the plan, the Pentagon will release a questionnaire to the defense industry to try and gather information about potential weak spots. The questionnaire will go out with help from trade associations and major industry players. “We’re finalizing a very targeted request, and it’s a request where we give industry an opportunity to provide some information to help us do this analysis.”
Weapons systems program shortfalls are sometimes masked because deficits in industrial base performance can often be dealt with by DoD actions such as making additional funding available, altering requirements to avoid acknowledging shortfalls, or stretching out programs until technical problems have been resolved.
Moreover, program terminations — the most glaring manifestation of acquisition difficulties — can also be chosen by DoD to release funds for other uses or because products are no longer needed.
The dominant criticism of the weapons and systems produced by the defense industry is that programs either cost too much to start with, or their costs increase during development and production.
Many assessments of industrial base performance have identified a number of causes, including overly optimistic bidding in proposals, errors in engineering and management, DoD changes in requirements, and complexity of advanced military capabilities that “stretch the boundaries” of proven technology.
Many cost increases in systems don't come from technology challenges, but from the management challenges. For example, within a single large program the complexity of managing suppliers includes more than simple contracts specifying products and delivery dates.
It now involves assigning to suppliers major portions of development and production, which entails concern about the suppliers’ long term fiscal condition, their ties to other firms, international linkages, and whether the suppliers’ engineers, design processes, manufacturing facilities, workforce, and sub-component providers are capable of performing according to the requirements set forth in the contract.
Dated business and procurement practices create challenges working with DoD, including contracting regulations, policies, barriers to entry, qualification challenges, programmatic changes, and other problems, leading to adverse effects on supplier ability to retain workforce with capability to innovate, manufacture, and sustain the Defense Industrial Base..
DoD lack of long-term perspective has hurt us in key areas by causing talented people to quit the field and take jobs they know will last. Private industry has to live “quarter to quarter” on its price/earnings ratio and return on investment figures but government can take a longer perspective. But government often doesn’t, “It’s very non-linear, very hard to trace” an initial investment in research to a new working product many political cycles later and that makes R&D a hard sell to Congress.
Especially concerning are the single points of failure, the chokepoints in the supplier base where a single small firm, often struggling to get by, is the only maker of some critical spare part. There’s little profit to be made on such components because they’re only needed in small numbers – at least until something goes badly wrong, like an accident or a war. By contrast, our adversaries are willing to subsidize production of such key components, not to mention long-shot research that might one day yield some future weapon.
Once you have identified your list of targeted industrial base resources to be profiled, you are ready to begin creating a risk profile for each one. The idea is for the resource owner to rate the resource importance to the organisation from an information-security perspective and relative to all other assets in the organisation.
The profile tracks information at a business and function level and is not necessarily specific to implementation decisions. For example, if you are designing a new system, you should know what types of data will be processed and what the basic functions being performed will be before you decide on technologies or placement in DoD field network.
When you are designing your profile questionnaire, it is important to note that not every question needs to be used in the calculation of the risk sensitivity. Some questions are meant to capture other pertinent information about the resource for reporting purposes and do not directly contribute to the risk-sensitivity score.
For example, you may ask a question about where in the industrial complex systems are hosted. The answer to this question doesn't affect the sensitivity of the asset, but you may want to prioritise assessments of third-party hosted systems because of increased risk exposure, and the answer to this item will give you the desired information about which systems are hosted internally versus externally.
You may also want to ask a couple of high-level questions about whether basic security controls are in place for example, roles-based access, and asset tracking. The answers to these questions will help you to focus your efforts on resources that don't meet the most basic security control requirements.
Similarly, you may want to ask if the system uses a common or central infrastructure for authentication and authorisation or logging to eliminate the need for assessing those areas any further. Systems using one-off solutions for these core security services may have more potential for risk exposure.
Factors do not change the sensitivity of the resource, but they can help with prioritisation. For example, whether or not a vulnerability test has been performed on the resource does not affect its sensitivity, but this knowledge is important for identifying resources that may have undiscovered vulnerabilities that are readily exploitable.
You will often find yourself trying to choose between several high-sensitivity resources to assess, and these other factors can help you decide which ones to focus on first.
The industrial base risk profile questionnaire should include several questions about the resource to help determine the sensitivity and criticality of the application in comparison to others. It is essential to evaluate a resource's sensitivity on a relative scale.
Start by identifying the resource that is most crucial to the organisation, and use this as a reference point. This is important because the tendency is to rate resources too high. If you end up with all resources being rated as high sensitivity and none as moderate or low, then the scale becomes worthless.
You may not have defined the specifics of how the functions will be performed, but having business and functional requirements defined is enough to complete the security risk profile.
As part of the challenge of attracting new innovative suppliers to the defense industrial base, DoD has also begun developing a concept for an Industrial Base Technology Solutions Watch List to address the imperfections of the on-ramps available to companies that have leading-edge, producible technologies relevant to programs of record.
Program managers are intently focused on cost, schedule, and performance, so they may resist inserting innovative products that could impact program execution. As a result, innovative technologies often remain underutilized. There are other reasons technologies remain on the sidelines.
1. Do not meet programs managers’ funding priorities and not in the program’s scope as originally envisioned
2. Are “cutting room floor” technologies from losing bids difficult to assimilate in programs
3. Are not completely aligned with current producibility requirements
4. Lack capability to compete effectively with potential adversaries
5. Not always clear if systems are completely resident in a common technology generation
6. Systems don’t always lead by a technology generation or order of magnitude better performance in key attributes
7. Slow response when an immediate/projected industrial base deficiency is identified
8. Don’t identify warfighting capability leadership goals and stakeholder support/validation
9. Slow to determine and prioritize associated technology maturity
10. Not enough assessment of industrial base competition associated with innovative technologies
RSS Feed