FALLS CHURCH, Va. – One year after the president’s executive order on improving the nation’s cybersecurity, federal agencies are making steady progress toward their zero trust security goals, according to a new study commissioned by General Dynamics Information Technology (GDIT), a business unit of General Dynamics (NYSE:GD). But agencies also face several challenges and know there is still more work to do.

The study, Agency Guide to Zero Trust Maturity, surveyed 300 federal officials from civilian and defense agencies to understand the progress toward the cyber executive order and Office of Management and Budget’s zero trust standards and objectives. Of the 300 officials, 60% work in a federal civilian agency and 40% in a defense agency.

The executive order requires government agencies to achieve specific zero trust security goals by the end of fiscal year 2024. According to the study:

  • 63% of respondents said their agencies will meet these requirements on time or early.
  • 92% are confident in their agency’s ability to defend against cyber threats.
  • 76% have a formal zero trust strategy in place, with 52% actively implementing one.

But, with such a major undertaking against an ambitious timeline, challenges remain.

  • 58% said one of the primary challenges to implementing zero trust architecture is rebuilding or replacing existing legacy infrastructure.
  • 50% are having trouble identifying what technologies they need.
  • 48% think their agencies lack sufficient IT staff expertise.

“When some agencies still have data on mainframes or legacy systems, it’s a big challenge,” said Dr. John Sahlin, GDIT’s cyber solutions director, Defense. “Agencies know they can't bolt on zero trust, so they must decide to rebuild or replace systems. That requires additional spending on top of investing in zero trust. Agencies have to make some hard decisions.”

Digging deeper, the research examines agencies’ investment priorities. Over the next year, these priorities align with a compliance-focused approach to implementing zero trust. Nearly all respondents note their top priorities are device protection (92%) and cloud security (90%). However, investments in micro segmentation to reduce the attack surface and artificial intelligence to facilitate granular data protection are lagging at 51% and 47%, respectively.

“There are expansive sets of guidelines and standards that agencies must comply with – it’s hard not to be purely compliance-driven,” said Matt Hayden, GDIT’s vice president of cyber client engagement, who previously served as assistant secretary for cyber, infrastructure, risk, and resilience policy at the Department of Homeland Security. “While the investments agencies are making now are important to achieving their zero trust strategies, they must also focus more on the mission value of IT. The key is to focus on mission enablement and usability, ultimately going beyond meeting compliance requirements.”

“This zero trust report shows that federal agencies are making great progress to strengthen their cybersecurity defenses,” said Dr. Mathew McFadden, GDIT’s vice president, cyber. “Zero trust principles need to be implemented throughout the organization and must be embraced by business and IT stakeholders to establish a successful strategy that drives cyber resiliency and supports the organization’s mission.”

The research will be discussed in a public webinar on May 16 with experts from GDIT and Appgate. The study was commissioned by GDIT’s Cyber Center of Excellence and fielded in February with Market Connections, an independent government research firm.

General Dynamics is a global aerospace and defense company that offers a broad portfolio of products and services in business aviation; ship construction and repair; land combat vehicles, weapons systems and munitions; and technology products and services. General Dynamics employs more than 100,000 people worldwide and generated $38.5 billion in revenue in 2021. More information about General Dynamics Information Technology is available at www.gdit.com. More information about General Dynamics is available at www.gd.com.

Media Relations
Oliver Nutt
Oliver.Nutt@gdit.com

Learn More

Cyber
Zero Trust Accelerator