Army shifts cloud management to Cyber Command
The move puts the organization that buys Army cloud under the command that defends it, folding procurement into the zero-trust and continuous-ATO push.
TL;DR
Army Secretary Dan Driscoll signed an order Monday reassigning the Enterprise Cloud Management Activity from the CIO's office to Army Cyber Command. ECMA runs the cArmy ecosystem, managing enterprise contracts, CSP relationships, and the CAMO vehicle that procures cloud for IL5 workloads and below. The move puts the organization that buys cloud under the command that defends it, folding procurement into the Army's zero-trust and continuous-ATO push. It arrives two months after former CIO Leo Garciga, who drove the continuous-ATO framework, departed.
ECMA is not a policy shop. The organization, founded in 2019, runs the Army's actual cloud procurement pipeline. It manages the CAMO contract for IL5 workloads and below, coordinates JWCC for IL6, and maintains the cArmy ecosystem connecting soldiers to Office 365, Palantir, Salesforce, and Appian across AWS, Microsoft, and Google infrastructure. AFARS 5111.106(S-91) codifies ECMA's central role: Army requiring activities don't buy cloud independently; they go through ECMA.
Monday's order makes the organization that controls cloud spending report to the command that defends the network. The Army's announcement frames the move in zero-trust terms: ECMA under ARCYBER applies defensive cyber tools and continuous monitoring "from day one." A July 22 software acquisition policy update parallels the shift, directing that cybersecurity "enable, not impede, rapid delivery" and that commanders implement continuous ATO processes.
The timing carries extra weight. Former CIO Leo Garciga spent three years designing the Army's continuous-ATO framework (accrediting DevSecOps pipelines rather than individual apps, pushing authority to commanders) and left in June. Two months later, the cloud organization he oversaw moves to ARCYBER. The continuous-ATO effort Garciga described in April as "almost ready to push into production" now matures under a different chain of command.
For practitioners managing CAMO task orders or navigating cArmy landing zones, the org chart shifted. The contracts didn't.
Published ·Deep Fathom