- DOW CIO Kirsten Davies establishes department-wide policy for software modernization and management
- The instruction calls for changes to DOW software acquisition and contracting practices
- DOW components must strengthen software security, asset management and AI use
Kirsten Davies, chief information officer at the Department of War and a 2026 Wash100 awardee, has issued a new instruction establishing department-wide policy, responsibilities and procedures for modernizing and managing software to accelerate the delivery of warfighting capabilities.
The DOW instruction, effective Tuesday, applies broadly across DOW components and covers software throughout its lifecycle, including acquisition and non-acquisition programs, national security systems and defense business systems regardless of dollar value.
The instruction establishes the DOW Enterprise Digital Arsenal as an enterprise approach for providing software development and delivery capabilities.
How Will DOW Modernize Software Development and Security?
The instruction establishes seven foundational software tenets, including continuous feedback, optimizing for flow rather than traditional development phases, building security and quality into software, maximizing automation, designing for evolvability and scale, defaulting to enterprise reuse, and aligning governance with delivery speed.
DOW components are directed to operate secure, automated continuous integration and continuous delivery pipelines and treat those pipelines as critical infrastructure requiring authorization, monitoring and protection commensurate with mission impact.
The policy also calls for a greater integration of testing into software delivery. Operational evaluations will be connected with CI/CD pipelines, with testing planned early in development.
The instruction also establishes software supply-chain requirements including generating and maintaining software bills of materials—or SBOMs—for custom software and capturing SBOMs for commercial software.
The policy also requires third-party and open-source software components to undergo risk assessments covering factors such as sustainment, source trustworthiness, dependencies, security posture, integrity protections and potential foreign influence risks. All third-party components and transitive dependencies must be included in software bills of materials.
How Will DOW Approach Software Acquisition and Contracting?
The instruction directs the Under Secretary of War for Acquisition and Sustainment to evolve software acquisition policies and procedures to support accelerated, secure and safe delivery. It specifically calls for using the Software Acquisition Pathway and directs programs to use commercial solutions openings and other transaction authorities as the default solicitation approaches.
The policy also requires contracts to provide sufficient intellectual property and data rights to support the long-term operation, maintenance, modification and cybersecurity of software capabilities.
What Role Will AI Play in Software Development?
The instruction identifies AI-assisted software development as a force multiplier for improving software delivery speed and quality.
DOW components are directed to leverage AI to modernize software, automate development processes, improve system integration and enhance resilience and security.
At the same time, AI-generated code must undergo security testing and review, while DOW components may only use AI applications and services that receive formal cybersecurity authorization.
