The Navy is in the midst of a revamp of its Innovation Cell, the project it launched two years ago with the objective of speeding new technology through the acquisition process in under a year while living completely within the government’s existing acquisition policies.
As it turned out, the effort was even more ambitious than Navy IT leaders first imagined. Fewer programs made it through the innovation pipeline than they initially hoped, and those that did tended to have a rough time transitioning from a pilot phase to full-scale deployment.
“Our leadership told us they wanted us to change the way the Navy does acquisition, but they didn’t want us to boil the ocean. Well, those are the same thing, because it’s a culture that has to change,” Bradley Punch, the leader of the Innovation Cell, said in an interview for Federal News Radio’s On DoD. “We’ve gotten to the point where we’ve made a lot of recommendations for policy changes, removing red tape, things that need to change in the [authority to operate] process. We need to be able to explain to our leadership what we need to change and what the policies are preventing us from doing.”
Insight by GitLab: During this webinar executives from the State Department, U.S. Securities and Exchange Commission, U.S. Patent and Trademark Office and GitLab will discuss how institutionalizing a DevSecOps approach to software development is a journey that must bring together the technology and business sides to change an organization’s culture.
The Innovation Cell, part of the Navy’s Program Executive Office for Enterprise Information Systems (PEO-EIS), works by issuing a problem statement or “enterprise challenge” to industry, asking vendors to help refine the Navy’s requirements based on solutions that already exist in the commercial marketplace, and then buying and integrating a new capability into Navy networks as quickly as possible — usually, through a contract vehicle that already exists.
The Navy partially completed three enterprise challenges in the Innovation Cell’s first year, and only two more have been issued since then: One to help the Navy automate the process of distributing computing tasks across multiple cloud service providers; another for location-based services that could, for example, give sailors access to certain types of information on their mobile devices based on where they’re physically standing.
Eventually, officials want to be able to move at least three-to-five projects through the Innovation Cell’s “fast lane” every year, but first, they say they’ll need senior Defense officials to accede to some tweaks in existing policies that have turned out to be barriers to rapid acquisition.
Punch said one example is the Risk Management Framework (RMF), which the Defense Department adopted in 2014 to replace DIACAP, DoD’s previous approach to certifying and accrediting the cybersecurity posture of new IT systems.
As it turns out, no one within the Navy has yet figured out a way to move a system through the RMF process in a rapid fashion. Ironically, that fact has hampered the inner workings of the Innovation Cell itself, not just the systems it’s trying to procure.
A modern, cloud-hosted web portal PEO-EIS developed to exchange information with vendors about enterprise challenges has been ready and awaiting deployment since 2015. Salesforce, the company hosting the platform, meets all of DoD’s requirements for cloud security. But since the portal itself still lacks formal approval under the RMF, the Innovation Cell is still communicating with industry via paper sign-up sheets, PDF forms and email.
“With any new system, obviously the risk assessment needs to be done. We’re not questioning that,” Punch said. “But I feel like sometimes in government, we put these processes out without being able to test them in the real world. With RMF, we’re basically one of the test cases.”
In the aftermath of its own experience with RMF, the Innovation Cell is assembling a how-to guide for other elements of the Navy to follow in the future, including a recounting of the steps it had to take and which government accreditation officials it had to negotiate with in order to achieve the project’s ultimate objectives.
“We’re also saying to our leadership, ‘Here’s where things need to be adjusted to make them more efficient,’” he said. “In the business world, when they introduce a new internal process, they do that constantly. They have to. In the government world, people think, ‘This is just the process, this is how we have to do it.’ The Innovation Cell’s approach is, ‘Yes, this is the process, but we have to make it better for the next two or three or 10 folks who come down the line.’ So from day one, we’ve documented timelines, specifics, the confusion we’ve had on who you even have to go to in order to get approval for something. The reason for that is we have to be able to brief our leadership on the specific problems we had and how much delay they caused. That’s what our leadership wants — data and metrics that show why processes need to be changed.”
As part of its revised approach, PEO-EIS is also looking for ways to prioritize exactly which IT projects need the attention of the Innovation Cell’s hand-picked staff, most of whom are borrowed from the Space and Naval Warfare Systems Center-Atlantic in Charleston, South Carolina.
Dan DelGrosso, PEO-EIS’ technical director, said he believed the office did a reasonably good job of selecting its first three enterprise challenges and setting requirements that industry could fulfill. But going forward, it needs to ensure that fast-tracked IT projects are delivering capabilities that end-users actually want, and that the Navy’s resource sponsors can be convinced to devote funding to deploy them at large scales.
“The Innovation Cell candidates for this fiscal year or the next fiscal year shouldn’t come from us or from a program manager,” he said. “What we need to do is institute a process up front that reflects the fleet’s capability gaps. Right now, we still don’t have a feedback loop that justifies the next things that we’re doing. We need to get better at doing that, and I think that will speed the process, gain more commitment to get out of the gate with a project. I think we’ll have more clarity and more commitment for everyone involved.”
Also, the revised Innovation Cell process will not attempt to meet the one-year target as a hard-and-fast rule.
Punch said one of the lessons learned in the cell’s first year was that the program had been overly obsessed with launching pilot programs for new commercial technologies without a clear strategy for full-scale purchase and integration into Navy networks.
In that model, the Innovation Cell staff got the ball rolling on a new commercial IT acquisition, but then handed it off to one of PEO-EIS’ traditional program management offices that did not always have the time, resources or commitment to see the project through to completion with the same aggressive timelines.
So, going forward, each enterprise challenge will come along with a “sponsorship agreement” that, among other things, sets specific timelines for how quickly the Innovation Cell wants to integrate a given commercial technology into Navy networks.
“It puts the program manager, the resource sponsor, all the stakeholders on the same page, all at the front end,” Punch said. “How much funding are we going to put towards this? How are we going to do market assessment and the technology assessment? What’s the acquisition strategy? It goes through all of this so we can publish it to industry at the beginning.”