Sonu Shankar named Pentagon principal deputy CIO amid CMMC review
Shankar fills a role vacant since Leslie Beavers departed last September, arriving with weeks left in the CMMC Reform Task Force's 60-day review.
TL;DR
Sonu Shankar was sworn in Aug. 24 as the Pentagon's principal deputy CIO, filling a post that's been vacant since Leslie Beavers departed last September. An industry veteran whose résumé includes Phosphorus Cybersecurity and Arctic Wolf, Shankar reached the role through the Pentagon's BOND program, which embeds private-sector executives in advisory positions. He arrives with the CMMC Reform Task Force roughly two weeks from its 60-day deadline, the group's recommendations will determine whether Phase 2 requirements, suspended in July, are revived, reworked, or scrapped.
Sonu Shankar was sworn in Aug. 24 as the Pentagon's principal deputy CIO, filling the No. 2 IT post at a moment when the department's signature defense-industrial-base cybersecurity program is effectively frozen. Phase 2 of CMMC (which would have required contractors to obtain third-party assessments to remain eligible for contract awards) was suspended in July after DoD research concluded the requirements risked driving companies out of the defense industrial base. A cross-department Reform Task Force has been meeting since July 17 and is expected to deliver recommendations by mid-September.
Shankar is not a career civil servant. His résumé runs through Phosphorus Cybersecurity, Arctic Wolf, Box, and Cisco, a sharp contrast with his predecessor Leslie Beavers, who spent over 30 years in uniformed and civilian government before stepping down last September. Shankar reached the Pentagon through the BOND program, a Deputy Secretary Feinberg initiative that embeds private-sector executives in strategic advisory roles. That's an unusual path to a post of this seniority.
For the more than 1,100 companies that responded to the CMMC RFI, Shankar's arrival signals the CIO's office is staffing up for consequential decisions. Whether the task force recommends preserving the third-party assessment model or abandoning it outright isn't known. It's a question the report, due within weeks, will begin to answer.
Published ·Deep Fathom