The Department of Defense memorandum names a Software Fast-Track (SWFT) initiative to expedite cybersecurity authorizations for rapid software adoption. The later combined summary uses Department of War, and the name Software Fast Track, for the same effort.
Still evolving, not final policy.
As of October 2026. The combined summary says it does not endorse the responses and does not dictate what a SWFT implementation plan will encompass. The external-assessment request for information says it does not commit the government to a solicitation or an award. None of the sources on this page is a final artifact list.
Not legal advice. This is a plain-language reading aid for contractors and the providers who support them. It is not a CMMC assessment, not a FedRAMP determination, and not a substitute for 32 CFR Part 170, the contract, or advice from counsel. Templates and worksheet results are starters. Replace every example with your own facts.
What it is
Why the memorandum created it.
The combined summary foreword says that on April 24, 2025, Katherine Arrington signed a memorandum titled “Accelerating Secure Software,” and that the memorandum establishes the Software Fast Track (SWFT) initiative for the Department of War. Slides hosted by NIST, in a file dated July 16, 2025, cite an April 24, 2025 memorandum with the same title and the same PDF.
The memorandum PDF is on Department of Defense letterhead. It is signed by Katherine Arrington, performing the duties of the Chief Information Officer of the Department of Defense. It names the effort Software Fast-Track (SWFT).
The memorandum gives two reasons. Lengthy, outdated cybersecurity authorization processes frustrate agile, continuous delivery. Widespread open-source software, with contributions from developers worldwide, leaves the Department without visibility into the origins and security of software code.
The foreword says SWFT is aligned with Secretary Hegseth’s guidance, “Directing Modern Software Acquisition to Maximize Lethality,” March 6, 2025. It says current procurement systems have not kept pace with the threat, rely on processes that are outdated and slow, and have little to no supply chain visibility.
The memorandum says the initiative will define clear, specific cybersecurity and supply chain risk management requirements, rigorous software security verification processes, secure information sharing mechanisms, and federal government-led risk determinations, to expedite cybersecurity authorizations for rapid software adoption. It orders the Chief Information Officer, in coordination with the Under Secretaries of Defense for Acquisition and Sustainment, Intelligence and Security, and Research and Engineering, to develop and submit the SWFT Framework and Implementation Plan within 90 days. The July 16, 2025 slides list that 90-day deadline and the three requests for information.
Proposed path
How it is described, not yet how it is required.
The external-assessment request for information says the Department has developed a voluntary procedure in which a company can provide a third-party-produced software bill of materials and an independent third-party assessment for the Department to evaluate. Its objective is external assessment methodologies that support rigorous software security verification and enable Department-led risk determinations. The same text says the notice is market research under FAR Part 10. It is not a request for proposals, an invitation for bids, or a request for quote, and it does not commit the government to issue a solicitation or award a contract.
Federal News Network reported remarks in which Arrington described base risk scores on 12 Department characteristics of risk, ranging from financial risk to foreign ownership, control, or influence, to cyber, and including the Cybersecurity Maturity Model Certification. That article does not print a list of all 12. It also reports that she described an SBOM in both sandbox and production, along with a third-party SBOM. DefenseScoop reported remarks describing a third-party assessment of companies’ cybersecurity postures based on 12 risk characteristics, and an SBOM from production and sandbox certified by a third party. Those are reported descriptions. They are not the text of the memorandum.
The July 16, 2025 slides show a concept with these labels: SWFT requirements, with the line “Suppliers will know how DoD will assess for authorization”; suppliers provide a SWFT body of evidence; SWFT 3PAO; DoD approval; and continuous monitoring, with the line “Leverage technology to automate continuous monitoring.”
The combined summary quotes a tools-request question: SWFT may assess how a company implements secure software development as identified in NIST SP 800-218, the Secure Software Development Framework. The summary says industry responses overwhelmingly reference NIST SP 800-218, NIST SP 800-53, and NIST SP 800-161, and that a SWFT solution using those three appears to align with existing industry frameworks. It also says the document does not endorse the responses and does not dictate the implementation plan.
Timeline
Dates that appear in these sources.
When
What the record shows
March 6, 2025
The summary foreword names Secretary Hegseth’s guidance, “Directing Modern Software Acquisition to Maximize Lethality,” and says SWFT is aligned with it.
SAM.gov published three notices, with responses due May 20, 2025, at 12:00 pm EDT: SWFT Tools (Sources Sought, RFISWFTTools001), SWFT External Assessment (Special Notice, RFISWFTExAssessment001), and SWFT AI (Sources Sought, RFISWFTAI001). The summary treats them as the tools, external assessment methodologies, and automation and artificial intelligence requests. Federal News Network described the same three topics on May 5, 2025.
July 16, 2025
Date in the file name of the NIST-hosted slides on the DoD CIO Software Fast Track initiative.
December 18, 2025
ExecutiveGov reported that Arrington had published the combined summary. The summary says it analyzes 420 private-sector responses. Its foreword says the Department received more than 400. The document says it was partially assisted by generative artificial intelligence, with human-in-the-loop analysis.
January 2, 2026
GovCIO reported that SWFT was shifting from the 90-day sprint into a permanent, enterprise-wide ecosystem.
October 2026
This page. The tools, external-assessment, and AI notices on SAM.gov are inactive. The external-assessment request says it does not commit the government to a solicitation or an award. These sources do not include a solicitation, an award, or a final list of artifacts.
Adjacent programs
Continuous ATO, FedRAMP, the cloud guide, and CMMC.
Continuous authorization
Federal News Network describes a 2022 Department of Defense CIO memorandum on continuous authority to operate. The article says that concept focused on system owners showing they can defend systems in real time and that they have a secure software supply chain, and it frames SWFT as the attempt to move software the Department buys toward that approach.
The summary conclusion says the responses indicate readiness to streamline authorization, especially through approaches like continuous ATO. GovCIO also describes the plan as including continuous authority to operate.
The combined summary records FedRAMP as one compliance regime respondents associated with audits they already run. It also records a respondent recommendation that assessors understand the Department of War Cloud Computing Security Requirements Guide. The summary says those passages are not an endorsement and do not dictate the implementation plan.
CMMC is a separate program
The April 24 memorandum does not mention the Cybersecurity Maturity Model Certification. Its subject is cybersecurity authorization for software the Department adopts.
Federal News Network includes CMMC in the reported remarks about 12 risk characteristics. The combined summary lists Department of War CMMC among compliance regimes respondents said their existing audit functions already support. Neither passage defines SWFT as that program, or as a change to it.
What the responses weighed
The summary conclusion says companies showed readiness to streamline authorization, especially through continuous ATO, and it points to software bills of materials and automated analysis. In the tools section, ninety percent of companies responded that they would provide an SBOM.
The same summary records concerns it does not resolve: legacy environments and technical debt that make a NIST SP 800-218 toolchain harder to adopt; a need for qualified personnel and a high degree of independence in external assessment, including the idea that outside assessors could scale reviews while government personnel stay limited; and, for automation and artificial intelligence, explainability, data quality, model performance and reliability, and data security.
What to watch
Open questions in the record.
These are gaps in the sources above. They are not a list of artifacts to prepare.
The framework and implementation plan
The memorandum orders that plan within 90 days. The July 2025 slides list the 90-day deadline. The plan is not one of the documents linked here.
A solicitation or an award
The May 2, 2025 notices for tools, external assessment, and AI are inactive market-research notices. The external-assessment text says the government is not committed to a solicitation or a contract award.
A final artifact list
The request for information describes a voluntary third-party SBOM and third-party assessment. The slides show a concept. The summary says it does not dictate the implementation plan. None of them is a final list of required artifacts.
FedRAMP, the cloud guide, and CMMC
No official source here defines a SWFT relationship to FedRAMP or the Cloud Computing Security Requirements Guide. CMMC remains a separate program in this record: the memorandum does not mention it, and the places that do are reported remarks and descriptions of audits companies already run.
Reported remarks are not the memorandum
Federal News Network and DefenseScoop report Arrington describing a move away from static authorities to operate and the Risk Management Framework. The summary still discusses Risk Management Framework artifacts, and its conclusion says the responses endorse NIST SP 800-53 and the current framework’s emphasis on protecting information. A later policy document would have to choose. This page does not.
Sources
Accelerating Secure Software memorandum
Department of Defense memorandum. Katherine Arrington, performing the duties of the Chief Information Officer, directs a Software Fast-Track (SWFT) initiative and a framework and implementation plan within 90 days.
War.gov release address for the Software Fast Track initiative. Sentences on this page cite the memorandum, the SAM.gov notices, the slides, and the combined summary.
Request for information text. Describes a voluntary third-party SBOM and an independent third-party assessment for the Department to evaluate. Market research. Responses were due May 20, 2025.
File dated July 16, 2025. DoD CIO Software Fast Track concept: requirements, supplier body of evidence, SWFT 3PAO, DoD approval, and continuous monitoring.
Department of War CIO summary of the three RFIs. Foreword dates the memorandum April 24, 2025. The analysis covers 420 responses and says it does not dictate an implementation plan.