Information Systems Security Program

The Information Systems Security Program (ISSP) under the Office of the Secretary of Defense is dedicated to enhancing cybersecurity and information assurance across defense systems. It aligns with various legislative and strategic directives, such as the Federal Information Security Modernization Act of 2014, Executive Order 14028 on improving national cybersecurity, and the Department of Defense's Zero Trust (ZT) Strategy. The ISSP focuses on developing governance processes, integrating information sharing across mission areas, and protecting national security systems by adopting ZT cybersecurity principles.

A primary objective of the ISSP is to achieve a target level of Zero Trust by the end of FY 2027. This involves providing strategic guidance, oversight, and comprehensive training while assessing proposed ZT solutions. The program also emphasizes preventing and defending against supply-chain attacks on critical systems and networks. It manages cybersecurity risk throughout the lifecycle and integrates cybersecurity standards across the Department of Defense to ensure a robust security posture.

In FY 2024, significant efforts are directed towards ZT private cloud pilots and operational environments. Additional resources are dedicated to enhancing ZT capabilities across secure internet protocol router networks. The program collaborates with industry partners to develop technologies that upgrade legacy network cybersecurity, aiming to evolve these into new architectures for command and control capabilities.

Looking ahead to FY 2025, the ISSP plans to continue its base initiatives while working with cloud service providers on ZT use cases. This includes conducting pilot activities and proof-of-concept evaluations to accelerate ZT adoption. Enhancements to SIPR network ZT capabilities are also planned, reflecting a continued commitment to strengthening defense cybersecurity infrastructure in alignment with strategic goals.