The DoD CIO is the Department of Defense’s Chief Information Officer, a Senate-confirmed civilian who reports directly to the Secretary of Defense. The office sets policy for defense IT, networks and cybersecurity and exercises authority over the Defense Information Systems Agency.
What the DoD CIO is
The role is set out in 10 U.S.C. § 142. The statute says there is a Chief Information Officer of the Department of Defense, appointed by the President with the advice and consent of the Senate from among qualified civilians, and that the officeholder reports directly to the Secretary of Defense. A 2017 amendment added the Senate confirmation requirement.
The statute also places the CIO in the department’s order of precedence alongside certain other senior officials, and adds a catch-all: the CIO performs “such additional duties” as the Secretary of Defense prescribes. Beyond that, it gives the office a defined list of duties, summarized below.
Statutory responsibilities
| Area | What the statute assigns to the CIO |
|---|---|
| Defense Information Systems Agency | Authority, direction and control over DISA |
| NSA cybersecurity | Authority, direction and control over the activities of NSA’s Cybersecurity Directorate funded through the Information Systems Security Program |
| Architecture and policy | Policy, oversight and guidance for information technology, networking, information assurance, cybersecurity and cyber capability architectures |
| Spectrum | Policy, oversight, guidance and coordination for electromagnetic spectrum matters |
| Positioning and timing | Policy, oversight and guidance for precision navigation and timing |
Source: 10 U.S.C. § 142(b)(1), via Cornell Law School’s Legal Information Institute.
The CIO is also the department’s Chief Information Officer for the purposes of federal law on information policy and security. The authority over NSA’s cybersecurity activities was rewritten in 2021. Before that amendment, the text referred to the Information Assurance Directorate of the National Security Agency, per the statute’s amendment notes.
Budget review and standards
Two statutory tools give the office reach beyond policy. First, the military departments and defense agencies must send proposed budgets for the activities above to the CIO before they go to the Comptroller. The CIO reviews them, certifies whether each is adequate, and reports to the Secretary of Defense by January 31 of the year before the fiscal year in question. Each year by March 31 the Secretary must then tell Congress which proposed budgets the CIO did not certify as adequate, with proposed actions to address the gaps. That turns the CIO’s certification into a signal Congress sees.
Second, a military department or defense agency may not develop or procure information technology that does not fully comply with standards the CIO establishes. The CIO must run a process for publishing those standards and for certifying that capabilities being developed or procured meet them, and must identify gaps in standards along with mitigation plans for operating where no acceptable standard exists. For vendors and program offices, this means IT bought or built for a military department or defense agency has to meet the CIO’s published standards before it runs on defense networks.
Cybersecurity policy in practice
Several defense cyber efforts trace back to the office. The department’s directive describing the role, DoDD 5144.02, is quoted in the Zero Trust Strategy: the CIO “is responsible for all matters relating to the DoD information enterprise,” including communications, network policy and standards, information systems and cybersecurity.
The Zero Trust Strategy adds that the CIO’s responsibilities for the DoD information enterprise cover component network infrastructure, enterprise IT services, national security systems, industrial control systems and embedded computing. Two examples show how that plays out.
- Zero trust. The DoD Zero Trust Strategy says the department established a Zero Trust Portfolio Management Office within the DoD CIO in January 2022. The strategy is dated October 21, 2022, was cleared for open publication on November 7, 2022, and requires components to reach target-level outcomes by the end of fiscal year 2027. The strategy calls itself the first of its kind for the department, and says it is a strategy rather than a solution architecture. Component execution plans were due to the DoD CIO and Joint Force Headquarters – Defense Information Networks by September 23, 2023. The model behind it is covered in the guide to zero trust for defense networks.
- CMMC. The Cybersecurity Maturity Model Certification program rule in 32 CFR part 170, published in the Federal Register on October 15, 2024, lists the Office of the Department of Defense Chief Information Officer as its issuing agency. The three levels and rollout dates are in the CMMC explainer.
The cloud side connects too: DISA, which the CIO oversees by statute, issues DoD provisional authorizations that build on FedRAMP, as described in the FedRAMP guide.
Where to follow DoD cyber policy in person
For the Department of the Air Force’s annual IT and cyberpower event in Montgomery, Alabama, the AFITC conference guide covers who attends and where the official details are published. The defense cybersecurity guide maps how the DoD CIO connects to Cyber Command, the services and contractor rules. This site is an independent resource and is not affiliated with the Department of Defense, the Air Force or any event organiser.
Frequently asked questions
Who appoints the DoD CIO?
The President, with the advice and consent of the Senate, from among qualified civilians, per 10 U.S.C. § 142.
Who does the DoD CIO report to?
The statute says the CIO reports directly to the Secretary of Defense in performing these duties.
Does the DoD CIO run the Defense Information Systems Agency?
The CIO exercises authority, direction and control over DISA, or any successor organization, under the same statute.
Is the DoD CIO the same as an Air Force or service CIO?
No. This role is the department-wide position set in 10 U.S.C. § 142. The statute directs the military departments and defense agencies to send their IT-related budgets to it for review.
Photo credits: Air Force Staff Sgt. John Wright, DoD (Public domain (US government work, per Wikimedia Commons file page)); panumas nikhomkhai (Pexels License).
