DIU Bridge Program targets cyber ATO bottleneck
Halving cyber authorization timelines would be the most significant ATO reform in a decade; the Bridge Program has twelve months to prove it's not another memo.
TL;DR
DIU launched the Bridge Program this week, led by Sarah Pearson, with a one-year mandate to open co-use classified facilities nationwide and "slash cyber authorization timelines by half." Multiple commercially owned sites are already contracted across nine states, with DIA, DCSA, and the military services partnering on a joint funding model. West's memo pins the problem precisely (promising technology dies in the clearance-authorization-budgeting cycle) but a memo doesn't fix the ATO pipeline; only demonstrated throughput does.
DIU Director Owen West's memo launching the Bridge Program this week is unusually blunt for a Pentagon announcement: "Too much promising technology falls victim to bureaucratic delays, or dies altogether in the endless clearance, authorization, budgeting cycle before it reaches the frontlines. That ends today."
The diagnosis isn't wrong. But the Bridge Program's credibility turns on whether it can actually rewire the processes that produce those delays, not just route around them with co-use facilities and parallel testing pipelines.
The most consequential claim in the announcement, for the compliance and accreditation readership, is the commitment to "slash cyber authorization timelines by half" within one year. DoD ATO timelines routinely stretch past twelve months for complex systems, and the reciprocity problem (where an ATO from one component isn't recognized by another) compounds the friction. If DIU can build a streamlined accreditation portfolio that actually cuts those timelines, it would be the most significant ATO reform since the RMF was introduced. The memo's reference to "cybersecurity and AI capabilities" enabling the new accreditation approach is light on detail, but the implication is worth tracking: DIU appears to be betting that automated evidence collection and continuous monitoring can substitute for the manual, artifact-heavy authorization workflows that dominate today.
The joint funding model for commercial classified facilities is the other structural innovation. Rather than waiting for government-constructed SCIFs, DIU has contracted for multiple commercially owned and operated sites, including, per the Pentagon press release, four in Pennsylvania funded in part by the administration's recent $10 billion state defense investment. Sharing the capital cost with commercial operators and other DoD components could break the zero-sum dynamic where SCIF availability bottlenecks cleared testing.
Sarah Pearson, DIU's chief of strategic initiatives and a former Navy officer and tech executive, spent the last year conceptualizing the program and now leads it. The working group spans OUSD(I&S), A&S, R&E, DIA, DCSA, and the services, broad enough to signal buy-in, diffuse enough to raise the question of who actually owns the decisions.
West's one-year clock is aggressive. The facilities contracts are signed and the working group is stood up, but slashing ATO timelines requires changing the behavior of authorizing officials across components who don't report to DIU. The memo is the starting gun, not the finish line. Whether the Bridge Program delivers throughput or joins the stack of well-intentioned transition initiatives will be measurable in twelve months, by the number of systems that actually receive accelerated authorization and reach operators, not by the number of memos declaring the problem solved.
Published ·Updated ·Deep Fathom