Pentagon CIO Says Contractor Cybersecurity Remains Inadequate, Announces Upcoming CIO Office Changes

Department of Defense Chief Information Officer Kirsten Davie told attendees at the TechNet Cyber conference in Baltimore that the Pentagon’s cybersecurity posture reaches into the defense industrial base. “Our posture extends beyond our own digital networks into yours, our defense industrial base,” she said.

Davie warned that a compromise at a small supplier could jeopardize a warfighter making a real-time decision.

“A compromise at a small supplier can jeopardize a warfighter making a real time decision, and I don’t think that’s acceptable for any one of us in this room,” she said. “That should make us all very uncomfortable, that that small of a compromise can impact a war fighter out at the edge.

” She said the security of contractors and suppliers is directly tied to warfighter security because any network compromise affects capabilities at the edge.

Davie argued that compliance alone is insufficient. “Compliance does not equal security. It did not when I was in industry, and it does not from my seat where I am today,” she said. The department must pursue a relentless focus on operational resilience, which she described as a byproduct of a dynamic, fit-for-purpose cybersecurity posture.

Davie said the department is shifting its cybersecurity program into a unified, holistic, and risk-driven function with a bias for action. She announced that changes are coming to the office of the CIO in the coming months, driven by a singular focus on operationalizing programs to better serve warfighters. Davie did not provide specifics on those changes.

The Cybersecurity Maturity Model Certification program, unveiled in 2019, requires companies doing business with the Pentagon to meet a base level of cybersecurity. The program has undergone several changes since its announcement. Davie told reporters last week she would discuss CMMC further at a later time.

A Department of War Chief Information Officer Kirsten Davies delivered remarks at a CIO town hall at the Mark Center in Alexandria, Virginia, on Feb. 10, 2026. S.

Navy Petty Officer 1st Class Alexander Kubitza.