Defense Cybersecurity Statistics 2026
By Axis Intelligence Research
Co-author: Marcus Chen (Cybersecurity & Privacy) | Last updated: September 6, 2026 | License: CC BY 4.0
The Department of Defense requested $14.32 billion for cyberspace activities in FY2026, a $967.6 million increase over the FY2025 enacted level and the largest cyber budget in the Department’s history. Axis Intelligence Research finds that the entire increase, and more, went to defensive cybersecurity — while cyberspace operations and cyber research both declined.
Quick Answer
DoD’s FY2026 cyberspace activities budget is $14,323.1 million, up 7.24% from $13,355.5 million enacted in FY2025. Cybersecurity absorbs 58.05% of that total at $8,314.8 million, up 15.47% year over year. Cyberspace operations fell 2.07% to $5,396.4 million. Cyber is 1.69% of the $848.3 billion DoD budget request. According to Axis Intelligence Research, the Defense Certification Assessment Ratio stands at 3.17 certified assessors per 1,000 defense contractors.
Key Findings
- According to the DoD Cost Assessment and Program Evaluation office, the FY2026 cyberspace activities budget request is $14,323.1 million, a $967.6 million increase over FY2025 enacted.
- Axis Intelligence Research finds the FY2026 cybersecurity portfolio grew 15.47% while cyberspace operations declined 2.07% and cyber research and development declined 5.03%.
- Per GAO-26-107955, published March 12, 2026, the Cyber AB had authorized 92 CMMC third-party assessment organizations as of December 2025 to serve approximately 200,000 defense industrial base companies.
- Axis Intelligence Research calculates a Defense Certification Assessment Ratio of 3.17 certified assessors per 1,000 DIB companies, and 0.46 authorized assessment organizations per 1,000.
- Per the FY2026 USCYBERCOM budget justification, contractor full-time equivalents fall 39.4% from 2,482 in FY2024 to 1,503 in FY2026, while civilian FTEs rise to 1,838.
How Much Does the US Spend on Defense Cybersecurity in 2026?
The number is $14,323.1 million, and it comes from one place: Table 5 of the DoD Cost Assessment and Program Evaluation office’s FY2026 IT and Cyberspace Activities budget overview, published August 2025. That document is the authoritative unclassified accounting of what the Department calls “cyberspace activities” — the budget line that captures cyber defense, cyber operations, and cyber research across all four resource bureaus.
Cyberspace activities sit inside a larger $66.1 billion IT and cyberspace budget, which itself is roughly 8% of the Department’s $848.3 billion request. Axis Intelligence Research calculates that cyber is 21.67% of the IT and cyberspace budget and 1.69% of the total DoD budget request. That second number is the one worth holding onto. The entire cyber enterprise — every network defense tool, every offensive capability, every dollar of cryptographic modernization — costs less than two cents of every defense dollar.
DoD Cyberspace Activities Budget, FY2022 to FY2026
| Fiscal year | Cyberspace activities | Non-cyber IT | Source |
|---|---|---|---|
| FY2022 actual | $10,202M | $37,027M | DoD CAPE, FY2026 IT/CA Budget Overview, Figure 2 |
| FY2023 actual | $9,836M | $44,106M | DoD CAPE, FY2026 IT/CA Budget Overview, Figure 2 |
| FY2024 actual | $13,341.3M | $48,554M | DoD CAPE, FY2026 IT/CA Budget Overview, Figure 2 |
| FY2025 enacted | $13,355.5M | $48,629M | DoD CAPE, FY2026 IT/CA Budget Overview, Table 5 |
| FY2026 request | $14,323.1M | $49,205M | DoD CAPE, FY2026 IT/CA Budget Overview, Table 5 |
The FY2023 dip is real and it is in the primary document — cyber spending fell before it jumped 35.6% into FY2024. Axis Intelligence Research calculates a compound annual growth rate of 8.85% for cyberspace activities from FY2022 to FY2026, against 8.75% for non-cyber IT over the same window. Cyber has grown fractionally faster than the Department’s ordinary IT bill, and no faster than that.
That finding cuts against the standard framing. Defense cyber spending is usually described as surging. Measured against its own IT baseline over four fiscal years, it has grown at almost exactly the same rate.
Marcus Chen’s read: The headline is always the total. The total is the least interesting number in the table. What matters is that cyber and general IT are growing in lockstep, which tells you cyber is being budgeted as an infrastructure cost rather than as an operational priority competing for share. A department that believed cyber was the decisive domain would show cyber pulling away from the IT baseline. It has not, in four years of published figures.
Where Does the Defense Cyber Budget Actually Go?
The Department divides cyberspace activities into three portfolios. The FY2026 request redistributes money among them in a way that has not been widely reported.
FY2026 Cyberspace Activities by Portfolio
| Portfolio | FY2025 enacted | FY2026 request | Change | Share of total | Source |
|---|---|---|---|---|---|
| Cybersecurity | $7,201.0M | $8,314.8M | +15.47% | 58.05% | DoD CAPE, Table 5 |
| Cyberspace operations | $5,510.3M | $5,396.4M | -2.07% | 37.68% | DoD CAPE, Table 5 |
| Cyber research and development | $644.3M | $611.9M | -5.03% | 4.27% | DoD CAPE, Table 5 |
| Total | $13,355.5M | $14,323.1M | +7.24% | 100% | DoD CAPE, Table 5 |
The three portfolios sum exactly to the total. The Cyber Mission Force line of $2,481.2 million reported in the same table is nested inside cyberspace operations, not additive to it — a detail that trips up secondary coverage of this budget every year.
Axis Intelligence Research finds that the cybersecurity portfolio’s $1,113.8 million increase exceeds the total budget increase of $967.6 million. Defensive cybersecurity did not merely grow. It grew by more than the whole cyber budget grew, funded by cutting operations and research.
The cybersecurity portfolio covers information assurance, weapons-system operational technology, defense critical infrastructure, supply chain risk management, defense industrial base security, and cryptographic modernization. Cyberspace operations covers offensive and defensive operations, hunt forward missions, cyber training and readiness, and capability development.
Marcus Chen’s read: Research took the sharpest percentage cut of the three. In a domain where the entry point changes every eighteen months, a 5.03% cut to R&D while defensive tooling grows 15.47% is a decision to buy what exists rather than build what does not. That is a defensible choice under budget pressure. It is not a neutral one, and it will show up in three years as a capability gap somebody else gets blamed for.
Which Military Service Spends the Most on Cyber?
| Service | FY2025 enacted | FY2026 request | Change | Share FY2026 | Source |
|---|---|---|---|---|---|
| Defense-Wide | $6,891.2M | $7,251.3M | +5.23% | 50.63% | DoD CAPE, Table 5 |
| Department of the Air Force | $2,757.5M | $3,161.5M | +14.65% | 22.07% | DoD CAPE, Table 5 |
| Department of the Navy | $1,798.4M | $2,049.1M | +13.94% | 14.31% | DoD CAPE, Table 5 |
| Department of the Army | $1,908.5M | $1,861.2M | -2.48% | 12.99% | DoD CAPE, Table 5 |
Axis Intelligence Research finds the Army is the only service whose cyber budget declines in FY2026, falling 2.48% while the Air Force and Navy each grow roughly 14%. The Army entered FY2025 as the largest service cyber spender after Defense-Wide. It exits FY2026 as the smallest.
Defense-Wide — which includes DISA, NSA, DIA, DTRA and USCYBERCOM — controls 50.63% of the entire cyber budget. Half of defense cybersecurity is not run by any military service.
How Big Is US Cyber Command and What Does It Cost?
The FY2026 USCYBERCOM budget justification, published June 2025, requests $1,614.668 million in discretionary operation and maintenance funding plus $259.955 million in mandatory reconciliation funds. That is a $14.85 million reduction from the FY2025 enacted level.
The command’s operational arm is the Cyber Mission Force, comprising 147 teams organized into cyber protection teams, combat mission teams, combat support teams, national mission teams and national support teams. Axis Intelligence Research calculates $10.99 million in discretionary O&M per Cyber Mission Force team for FY2026.
The workforce inversion nobody flagged
The personnel tables in the same document show something more interesting than the dollars.
| Workforce measure | FY2024 actual | FY2026 request | Change | Source |
|---|---|---|---|---|
| Civilian FTEs | 1,805 | 1,838 | +33 | USCYBERCOM OP-5, Personnel Summary |
| Contractor FTEs | 2,482 | 1,503 | -979 | USCYBERCOM OP-5, Personnel Summary |
Axis Intelligence Research finds that USCYBERCOM contractor FTEs fall 39.4% between FY2024 and FY2026 while civilian FTEs rise slightly. Contractors drop from 57.9% of the command’s measured workforce to 45.0%. The budget document attributes the reduction to Executive Order 14222 on contract efficiency.
The same pattern, sharper, appears at DISA. The FY2026 DISA Cyber budget justification shows contractor FTEs falling from 1,990 in FY2024 to 938 in FY2026 — a 52.9% reduction — while the agency’s cyber budget grows 13.86% to $559.4 million. DISA’s own personnel narrative states plainly that a 10 percent reduction in end strength will impair incident response speed, widen the window of attack vulnerability, and risk delays in system recovery.
Marcus Chen’s read: Two commands are buying more cyber capability with substantially fewer people to operate it. The theory is that the tooling absorbs the headcount. The DBIR data says every year what it says: the median organization takes days to notice an intrusion, and the reason is almost never the tool. It is that nobody was watching the alert the tool generated. DISA wrote the risk into its own budget justification. That is unusual candor, and it should be read as a warning rather than boilerplate.
What Is DoD’s Zero Trust Deadline and How Far Along Is It?
The Department set a target: all components implement target-level zero trust on unclassified and secret networks by the end of fiscal year 2027. The framework, published in the DoD Zero Trust Strategy, defines 91 target-level capability outcomes for IT systems, plus 61 advanced-level outcomes due by FY2032. Together they form the 152 activities that DoD components are measured against.
The clearest published implementation datapoint remains the Navy’s. Per the DoD CIO Zero Trust Portfolio Management Office newsletter, the Navy’s Flank Speed cloud service achieved 151 of 152 zero trust activities, including 60 of the 61 advanced activities, serving more than 560,000 users worldwide. Over 40 DoD components had submitted zero trust implementation plans, and the PfMO had funded 20 proof-of-concept efforts across ICAM, DevSecOps, data tagging, DDIL and operational technology. [Older data — this remains the most recent PfMO figure published in a primary DoD document; the office has moved to internal Advana dashboards for progress reporting.]
Axis Intelligence Research declined to publish a department-wide zero trust completion percentage. No 2026 primary DoD document states a current figure against the 91 target activities. Percentages circulating in trade coverage trace to a briefing that predates FY2026, and carrying a stale completion rate forward as if it were current is exactly the error that makes a statistics page unciteable eighteen months later. The refusal is recorded in the dataset as a retracted row.
What the FY2026 budget actually buys for zero trust
Where progress percentages are unavailable, the money is not. DISA’s FY2026 program increases name the components directly:
| Zero trust component | FY2026 increase | Source |
|---|---|---|
| Break-and-inspect / web application firewall | $23.0M | DISA Cyber OP-5, Program Increases |
| High-impact ICAM capability and federation hubs | $13.86M | DISA Cyber OP-5, Program Increases |
| Data protection and tagging | $7.0M | DISA Cyber OP-5, Program Increases |
| Thunderdome migrations planned FY2026 | 80 migrations | DISA Cyber OP-5, Performance Criteria |
ICAM and data tagging are precisely the two pillars the Zero Trust PfMO has publicly identified as the department’s weakest. The FY2026 request funds both. DISA’s perimeter defenses currently protect over five million DoDIN users, and Thunderdome migrations rise from 51 completed in FY2024 to 80 planned in FY2026.
The Defense Certification Assessment Ratio: Can the DIB Actually Get Certified?
This is the section where the defense cybersecurity story stops being about the Pentagon’s budget and starts being about 200,000 companies.
DCAR — Defense Certification Assessment Ratio
Proprietary metric | First published by Axis Intelligence Research, September 2026
The Defense Certification Assessment Ratio (DCAR™) measures certified CMMC assessment capacity against the population of companies required to be assessed. Neither DoD, the GAO, nor The Cyber AB publishes a capacity ratio of this form, though every input is a published federal figure.
Formula:
DCAR = (certified assessment resources ÷ defense industrial base company population) × 1,000
Inputs, all from GAO-26-107955, Defense Contractor Cybersecurity, published March 12, 2026:
- DIB company population: approximately 200,000
- CMMC Certified Assessors: 633 (as of December 2025)
- Lead CMMC Certified Assessors: 290 (as of December 2025)
- Authorized C3PAOs: 92 (as of December 2025)
DCAR readings, as of December 2025
| Assessment resource | Count | DCAR (per 1,000 DIB companies) | DIB companies per resource |
|---|---|---|---|
| CMMC Certified Assessors | 633 | 3.17 | 316 |
| Lead CMMC Certified Assessors | 290 | 1.45 | 690 |
| Authorized C3PAOs | 92 | 0.46 | 2,174 |
Source for all inputs: GAO-26-107955, March 12, 2026. DCAR calculated by Axis Intelligence Research.
Three certified assessors exist for every thousand companies that may need assessing. One authorized assessment organization exists for every 2,174 companies. An additional 14 organizations have passed their DIBCAC assessment but await authorization, and 14 more are waiting for a DIBCAC assessment — bringing the potential near-term pool to 120, or one per 1,667 companies.
Coverage horizon: how long does the queue take to clear?
Assessment throughput per assessor is not published by any federal source. Rather than invent one, Axis Intelligence Research publishes the horizon as a disclosed parameter sweep. The scenario assumes 20,000 companies — 10% of the DIB — require third-party Level 2 certification, and varies only the throughput assumption.
| Assessments per lead assessor per year | Annual capacity | Years to clear 20,000 companies |
|---|---|---|
| 6 | 1,740 | 11.5 |
| 12 | 3,480 | 5.7 |
| 24 | 6,960 | 2.9 |
Calculated by Axis Intelligence Research. Throughput is a stated scenario parameter, not a sourced figure; the assessor counts are from GAO-26-107955.
Even the most aggressive assumption — a lead assessor completing a full Level 2 certification every fortnight, year-round — puts the coverage horizon at 2.9 years against a 36-month phased rollout that began November 10, 2025. The mid case runs past FY2030.
GAO reached the qualitative version of this conclusion independently. The report found that DoD’s CMMC planning addressed six of seven elements of a comprehensive strategy, and that the missing element was identification of key external factors — with ecosystem capacity named first among the factors DoD had not assessed and documented. GAO noted that DoD relies on industry to develop the capacity of assessment organizations and assessors needed to meet the department’s own projections, and that DoD officials pointed to waivers as the mitigation. DoD concurred with the recommendation.
Axis Intelligence Research declined to calculate the share of DIB companies currently holding CMMC certification. GAO-26-107955 publishes ecosystem headcounts and the DIB population, but no federal document publishes a count of certified companies. Any percentage would require inventing the numerator. The refusal is recorded in the dataset as a retracted row.
Marcus Chen’s read: The waiver is the tell. When a program’s contingency plan for insufficient assessment capacity is to waive the assessment, the compliance regime has a release valve wired into it from day one. GAO said the quiet part: depending on frequency and number, waivers could undermine the long-term viability of the program and its intent to verify that companies implement federal cybersecurity requirements. DCAR at 0.46 authorized organizations per thousand companies is the arithmetic behind that sentence.
What Does CMMC Cost a Defense Contractor?
DoD’s own estimated assessment costs, per GAO-26-107955, range from $4,042 to $117,768 depending on assessment type. Axis Intelligence Research calculates a spread ratio of 29.1× between the low and high estimate. Roughly three-quarters of the DIB are small businesses.
CMMC requirement counts by level
| Level | Information type | Security requirements | Validation | Source |
|---|---|---|---|---|
| Level 1 | Federal Contract Information | 15 (FAR 52.204-21) | Annual self-assessment | GAO-26-107955 |
| Level 2 | Controlled Unclassified Information | 110 (NIST SP 800-171) | Self-assessment or C3PAO every 3 years | GAO-26-107955 |
| Level 3 | Critical CUI | 110 + 24 of 35 (NIST SP 800-172) | DIBCAC assessment every 3 years | GAO-26-107955 |
Companies handling defense-related CUI cannot self-assess at Level 2. They must use an accredited C3PAO — which is where DCAR stops being an abstraction.
The acquisition workforce is not ready either
The certification bottleneck has a mirror image inside the government. GAO found that as of September 2025, 267 acquisition workforce members had completed the Defense Acquisition University’s Cybersecurity 1010 course, and 18 had completed the senior-level Cybersecurity 1030 course. The CMMC Program Management Office told GAO it would be beneficial for 70% of targeted acquisition workforce members to complete the training within one year of the program’s start — a goal that would require about 113,000 members to take Cybersecurity 1010.
Axis Intelligence Research calculates that completions stood at 0.24% of that goal as of September 2025. The courses remain voluntary; decisions on whether to make them mandatory were expected in 2026.
Who Actually Defends the Defense Industrial Base?
Support for contractor networks is distributed across NSA, DC3 and the DoD Office of Small Business Programs. The participation counts are small relative to a 200,000-company base.
| Program | Provider | Participants | As of | Source |
|---|---|---|---|---|
| Project Spectrum | DoD Office of Small Business Programs | 21,535 | July 2025 | GAO-26-107955 |
| Threat Intelligence Collaboration | NSA Cybersecurity Collaboration Center | 1,600+ | August 2025 | GAO-26-107955 |
| Attack Surface Management | NSA Cybersecurity Collaboration Center | 1,300+ | August 2025 | GAO-26-107955 |
| DIB Collaborative Information Sharing Environment | DC3 | 1,210 | August 2025 | GAO-26-107955 |
| Protective DNS+ | NSA Cybersecurity Collaboration Center | 1,000+ | August 2025 | GAO-26-107955 |
| Continuous Autonomous Penetration Testing | NSA Cybersecurity Collaboration Center | 500+ | August 2025 | GAO-26-107955 |
| Mentor-Protégé Program | DoD Office of Small Business Programs | 65 mentors, 65 protégés | July 2025 | GAO-26-107955 |
Project Spectrum, the largest by an order of magnitude, reaches about one in ten DIB companies. The NSA services that do actual technical defense — attack surface management, autonomous penetration testing, protective DNS — reach roughly 1% or less each.
DISA exits DIB defense entirely
The FY2026 DISA budget contains a line that has gone almost unnoticed. The Defense Industrial Base cyberspace operations subactivity drops from $5.36 million in FY2024 to $718 thousand in FY2025 to zero in FY2026. The justification states that DISA will no longer secure DoD data on DIB networks nor provide information assurance and computer network defense support to the DIB, and that the function transitions to the DoD Cyber Crime Center. DISA’s DIB user-account performance metric is likewise set to zero for FY2026.
DC3’s capacity is real. Per the DC3 Annual Report 2025, published April 28, 2026, the center produced 1,296 cyber threat reporting products in CY2025, yielding 170,503 actionable indicators of compromise, and delivered 248,540 hours of cyber training. Its Vulnerability Disclosure Program has identified 58,436 vulnerabilities since launch, including 4,456 new vulnerabilities in 2025, drawing on 5,479 researchers.
Marcus Chen’s read: A consolidation is not automatically a cut. Moving DIB defense from DISA to DC3 puts it with the organization that already runs DCISE and already receives the mandatory DFARS incident reports. That is coherent. What is worth watching is that the transition lands in the same fiscal year that CMMC third-party assessments begin phasing in and DISA sheds half its cyber contractor workforce. Three transitions converging on the same twelve months is how gaps open — not through any single decision, but through the seam between them.
Where the Sources Disagree
Congressional Research Service coverage of the FY2026 request states $9.1 billion for cybersecurity and $5.4 billion for cyberspace operations. The DoD CAPE budget overview, Table 5, states $8,314.8 million and $5,396.4 million.
Axis Intelligence Research uses the CAPE figures throughout this analysis. CAPE’s document is the Department’s own line-item accounting of the cyberspace activities budget, its three portfolio figures reconcile exactly to the published total, and it carries the FY2022 to FY2026 series needed for trend analysis. The operations figures agree to within rounding. The cybersecurity figures do not, and the difference of roughly $785 million is large enough that any page citing “$9.1 billion” alongside a portfolio breakdown that sums to $14.3 billion is publishing an internal contradiction.
A second inconsistency sits inside a single primary document. The USCYBERCOM budget justification reports FY2026 discretionary funding as $1,614,668 thousand in its financial summary tables and $1,614,866 thousand in its narrative paragraph — a $198 thousand discrepancy in the source itself. This analysis uses the table figure.
Methodology
Collection. Every figure in this analysis was retrieved from a primary federal document fetched and read on September 6, 2026. Sources are limited to: the DoD Cost Assessment and Program Evaluation office, the Office of the Under Secretary of Defense (Comptroller) budget justification exhibits, the DoD Chief Information Officer, the DoD Cyber Crime Center, and the US Government Accountability Office. No aggregator, vendor report, or trade publication supplied a number.
Calculations. Growth rates use the formula (current ÷ prior − 1) × 100. The compound annual growth rate uses ((endpoint ÷ base)^(1/n) − 1) × 100 over four fiscal years. Portfolio and service shares divide the component by $14,323.1 million. DCAR is defined in its own section with inputs and formula stated inline. All arithmetic was computed programmatically and re-run during verification.
Nesting. The Cyber Mission Force line is a component of cyberspace operations, not a fourth portfolio. Cybersecurity plus cyberspace operations plus cyber R&D sum exactly to the published total.
Budget basis. All FY2026 figures are President’s Budget request levels unless labeled enacted or actual. Requests are not appropriations. Classified cyber programs are excluded from public reporting by design, so every figure here understates total defense cyber activity by an unpublished margin.
What this analysis does not measure. Assessment throughput per assessor is unpublished and is handled as a disclosed scenario parameter. Department-wide zero trust completion and the certified share of the DIB are unpublished and are recorded as retracted rows rather than estimated.
Verification. Every numeric token in this article was extracted and matched against the accompanying dataset in both directions. Every external link was fetched and confirmed to contain the cited claim.
About This Dataset
Title: Defense Cybersecurity Statistics 2026 — Budget, Operations, Zero Trust and DIB Certification Capacity
Creator and publisher: Axis Intelligence Research
Contents: 196 observations covering DoD cyberspace activities budget by portfolio and service FY2022–FY2026, USCYBERCOM and DISA funding and workforce, zero trust activity counts and funded components, CMMC ecosystem capacity, DIB support program participation, and DC3 operational output.
Temporal coverage: FY2022 through FY2026
Spatial coverage: United States Format: CSV, UTF-8, one header row, one observation per row
License: CC BY 4.0
Cite as: Axis Intelligence Research, Defense Cybersecurity Statistics 2026, 2026.
Citation
APA: Axis Intelligence Research. (2026). Defense cybersecurity statistics 2026: Budget, cyber operations, zero trust and the DIB certification gap. Axis Intelligence. https://axis-intelligence.com/defense-cybersecurity-statistics/
MLA: Axis Intelligence Research. “Defense Cybersecurity Statistics 2026: Budget, Cyber Operations, Zero Trust and the DIB Certification Gap.” Axis Intelligence, 5 Sept. 2026, axis-intelligence.com/defense-cybersecurity-statistics/.
Chicago: Axis Intelligence Research. “Defense Cybersecurity Statistics 2026: Budget, Cyber Operations, Zero Trust and the DIB Certification Gap.” Axis Intelligence, September 6, 2026. https://axis-intelligence.com/defense-cybersecurity-statistics/
Frequently Asked Questions
Is the $14.3 billion cyber figure the total US military cybersecurity budget, or only part of it?
It is the unclassified cyberspace activities budget request. DoD reports classified cyber separately and does not publish it on the OMB IT Dashboard, so the true total is higher by an undisclosed amount. When a source cites a defense cyber number without stating whether it covers classified programs, budget authority or obligations, and request or enacted levels, the number is not comparable to anything.
If a contractor already meets NIST SP 800-171, is CMMC certification just paperwork?
Not for defense-related CUI. Level 2 self-assessment is permitted for some CUI, but companies handling CUI within the Defense Organizational Index Grouping must be assessed by an authorized C3PAO every three years. The 110 requirements are the same; what changes is who verifies them and whether a certificate exists at time of award.
What happens to a contract award if no assessor is available before the deadline?
DoD issued a January 2025 memo empowering senior acquisition officials to approve waivers of CMMC assessment requirements. GAO found the waiver process does not address the underlying capacity constraint and cannot be applied where requirements must be performed by cleared defense contractors — meaning subcontractors to cleared primes still face the requirement regardless of assessor availability.
Which zero trust pillars is DoD furthest behind on?
Identity, credential and access management, and data tagging. Both have been named repeatedly by the Zero Trust Portfolio Management Office as the department’s weakest areas, and both are directly funded in DISA’s FY2026 increases — $13.86 million for ICAM federation hubs and $7 million for data protection and tagging.
Does hitting target-level zero trust by FY2027 mean DoD networks are secure?
Target level is the minimum bar for IT systems on unclassified and secret networks. Advanced level adds 61 further outcomes and is not due until FY2032. Operational technology, weapons systems and defense critical infrastructure sit largely outside the original 91 activities, which is why the department has been developing separate frameworks for them.
Why did DISA zero out its defense industrial base cyber line?
The function transitioned to the DoD Cyber Crime Center. DISA’s justification states it will no longer secure DoD data on DIB networks or provide information assurance and network defense support to the DIB. The budget line runs $5.36 million in FY2024, $718 thousand in FY2025, and zero in FY2026.
Is the Cyber Mission Force growing?
The team count stands at 147 and the FY2026 discretionary request is slightly below the FY2025 enacted level. Civilian FTEs rise modestly while contractor FTEs fall 39.4% from FY2024. Force structure is stable; the workforce composition supporting it is not.
Which single primary document should a journalist start with?
For budget, the DoD CAPE FY2026 IT and Cyberspace Activities overview — Table 5 is the authoritative portfolio breakdown. For the contractor compliance picture, GAO-26-107955, published March 12, 2026. Both are linked in this analysis and both are free to access.