The “993 report” is a strategy included in the National Defense Authorization Act for Fiscal Year 2011.
It dissected implementation periods of chief plan components into three-month and six-month intervals succeeding the report delivery.
It also mandated the assembly of a senior-level oversight committee for cyber acquisition called the Cyber Investment Management Board.
Another committee called the Cyber Capability Team was created to search for larger technology developments to assist departmental policy and policy shifts crucial for full operation of the bodies.
A DoD spokesperson explained that the two committees were responsible for creating two distinct cyber acquisition processes. One is called “rapid” and the other “deliberate”.
Theoretically, the reforms should have been set in motion already but sources claim that the main components of the program have yet to reach development.
Sources told DefenseNews that the delays are derived from apprehension that the strategy’s bureaucracy would slow down the acquisition process.
A DoD spokeperson said in a statement that the agency is developing a plan to quickly roll out the new acquisition procedures.
They are also finalizing the components of an implementation plan which aims to be the foundation of all guidance and information related to the new procedure.
The DoD has already implemented rapid acquisition programs for the war in Iraq and Afghanistan. However, the equipment involved with the initial program was technically straightforward whereas the new procedure deals with quickly evolving cyber tools.
One former official recommends recalibrating the strategy since adding bureaucracy will only lengthen the procedure.
A lengthy acquisition process has been a major issue for almost three decades, he said.
Another source who has read the full report told Fryer-Biggs that although the new protocol allows evasion of standard acquisition reports he is still not convinced that it will yield a different or faster process.
He argued that if the same people are tasked to implement the new procedure it would only end up reverting to the old process.