- DOW CIO Kirsten Davies has released new CSSP certification guidance
- The policy covers alignment for AI, quantum and industrial control systems
- Explore AI, cybersecurity and more at the Potomac Officers Club’s DOW summits
Kirsten Davies, chief information officer at the Department of War and a 2026 Wash100 awardee, has issued a directive-type memorandum, or DTM, outlining the minimum baseline requirements for an organization to be certified and authorized as a DOW cybersecurity service provider, or CSSP.
Join us at the Potomac Officers Club’s 2026 Air & Space Summit tomorrow, July 30, for a panel discussion on advancing multilevel security with AI and machine learning for the modern warfighter. Secure your seat now! Then mark your calendar for the 2026 Navy Summit on Aug. 27, which will feature a panel discussion on modernizing the Navy’s enterprise networks for information warfare readiness. Register today to join the conversation.
The memo, titled “Cybersecurity Service Provider Definition Clarification,” issued Tuesday and signed by Davies establishes policy, assigns responsibilities and sets procedures for CSSP certification across the department.
The DTM takes effect immediately and applies to the Office of the Secretary of War, the military departments, the Joint Staff, combatant commands, the DOW Office of Inspector General and all other DOW components. The memo is set to expire on July 28, 2028.
What Are the Minimum Requirements to Become a Certified DOW CCSP?
The memo directs CSSPs to continuously monitor DOW cyber terrain to detect, analyze and respond to anomalous, suspicious or malicious activity. CSSPs must maintain personnel and resources to triage time-sensitive events, with a maximum of 72 hours to triage an incident and 24 hours to report it to U.S. Cyber Command.
CSSPs are also required to maintain a valid certification and an authorization to operate; failing to do so results in suspension of CSSP services. Certification standards are detailed in DOD Manual 8530.01 and the CSSP Minimum Cybersecurity Activities Checklist.
What Are the Minimum Cybersecurity Activities CSSPs Must Perform?
To be certified, CSSPs must carry out a defined set of baseline activities. These include:
- Correlating asset and vulnerability data with cyberthreat intelligence to identify exploits and threat opportunities
- Malware notification, including confirming that subscribers acknowledge reported findings
- Detection processes across three network tiers — internet access points, enclave and perimeter boundaries, and internal host-level monitoring
- Orders and cyber protection condition compliance, including implementing and reporting on DOW orders
- Cyber incident handling, categorization and reporting, in coordination with USCYBERCOM and the DOW Cyber Crime Center
- Law enforcement and counterintelligence coordination for forensic investigations of compromised systems
- Incident response analysis, including forensic media analysis and intrusion assessments
- Sustainment and continuous self-assessment, including annual compliance reviews
Which Systems & Networks Must Align With a DOW CSSP?
The DTM extends CSSP alignment requirements beyond traditional IT networks. According to the memo, the requirement applies to:
- Cloud instances
- Coalition or mission partner environments
- Special access programs
- Intelligence networks
- Industrial control systems
- Internet of Things devices
- Operational technology
- Artificial intelligence systems
- Quantum computers and networks
The memo states this alignment requirement cannot be waived or risk-accepted by authorizing officials, regardless of a system’s network, connectivity or mission.
Who Authorizes & Certifies DOW Cybersecurity Service Providers?
Under the memo, the DOW CIO approves or disapproves all CSSP certification requests and forwards approvals to the commander of USCYBERCOM. The DOW CIO also serves as the authorizing official for special access program systems that do not process sensitive compartmented information and adjudicates CSSP certification appeals in coordination with USCYBERCOM.
USCYBERCOM, in turn, implements general service CSSP processes. It functions as both certifier and authorizing official for general service and special access program systems at the top-secret collateral level and below.
For intelligence community elements within the DOW, the director of national intelligence ensures each element serves as the authorizing official for its own systems processing top-secret sensitive compartmented information.
How Does the Policy Fit Into DOW’s Broader Cybersecurity Push?
The DOW Office of the CIO recently opened applications for its Cyber Apprenticeship Program, a paid initiative designed to recruit and train future civilian cybersecurity professionals supporting national security missions. In March, Davies told Senate lawmakers during a hearing that the department is undertaking a broad effort to transform the department’s technology ecosystem and cybersecurity program into a warfighting advantage.
The new CSSP memo also follows two other recent administration cybersecurity actions. The White House recently launched the Gold Eagle initiative to coordinate the identification and remediation of vulnerabilities across critical infrastructure sectors. In June, President Trump signed a memo directing the reestablishment of the Committee on National Security Systems to strengthen the cybersecurity of the nation’s national security systems.
