DOW IG Finds Components Missed Comply-to-Connect Security Requirements

A Department of War Office of Inspector General audit found that none of the six reviewed components had completed all 37 required Comply-to-Connect (C2C) tasks by the September 30, 2025 deadline. The shortfall leaves gaps in device security and zero-trust implementation, according to the audit findings. Because the deadline has passed, the report raises an implementation and oversight issue rather than announcing a new procurement. It identifies no solicitation, contract vehicle, or specific opportunity for vendors.

C2C is tied to the department’s effort to strengthen security controls for devices connecting to its networks and to advance baseline zero-trust capabilities. The department requested $3.3 billion across FY2021–FY2025 for C2C and baseline zero-trust capabilities. That figure indicates the scale of planned investment over the five fiscal years, but it should not be read as an award amount or as funding available for a particular contract. The audit’s findings instead point to a gap between the required tasks and component-level completion.

For procurement teams and industry, the audit can serve as a planning signal. Potential areas to assess include interim device controls, C2C deployment support, compliance validation, and cybersecurity integration. These are possible capability needs inferred from the reported gaps—not confirmed procurements. Contractors should present relevant, demonstrable C2C and zero-trust experience accurately and avoid describing the audit as evidence of an imminent solicitation. Component-level implementation status and the nature of any follow-on requirements would need to be established through official agency communications and acquisition notices.

The Inspector General called for interim safeguards and independent verification of component progress. Those recommendations make verification and sustained remediation important oversight considerations alongside technical deployment. Assistant Inspector General for Audit, Cyberspace Operations Karla Roark said, “We will track them until management agrees to take actions that we determine to be sufficient to meet the intent of the recommendations.” The IG’s commitment to track recommendations means the audit may remain relevant to future oversight and management decisions, but it does not establish a procurement schedule or guarantee that new contracts will follow.

• None of the six reviewed components completed all 37 required C2C tasks by the September 30, 2025 deadline.
• The missed deadline leaves reported gaps in device security and zero-trust implementation.
• The Department requested $3.3 billion for C2C and baseline zero-trust capabilities across FY2021–FY2025; this is a request figure, not a specific contract award.
• The IG called for interim safeguards while components address outstanding implementation requirements.
• The audit also calls for independent verification of component progress, making compliance validation a potential area for agency assessment.
• Potential capability needs include device controls, C2C deployment support, compliance validation, and cybersecurity integration; no related procurement is confirmed in the audit summary.
• Contractors should use the findings to evaluate component-level needs and clearly substantiate relevant C2C and zero-trust experience, without representing the report as a pending opportunity.
• The IG will track recommendations until management actions are determined sufficient to meet their intent, as stated by Karla Roark, Assistant Inspector General for Audit, Cyberspace Operations.
• Agencies identified in connection with the audit include the Department of War, its Office of Inspector General, the Defense Health Agency, U.S. Northern Command, and U.S. Transportation Command.