This week, the Department of War (DoW) announced its new Cybersecurity Risk Management Construct (CSRMC)—a decisive shift from static, “snapshot in time” compliance toward continuous, automated defense. It’s a bold move to ensure cyber resilience operates at the speed of relevance. This latest announcement is further evidence that the Pentagon is fully committed to a robust, risk-informed ecosystem for its suppliers, manufacturers, and commercial enablers. The Department’s leaders are taking steps to implement and execute what had, until now, been more rhetoric than substance. 2F applauds the Department’s actions vigorously.
At 2F, we don’t just believe in the Department’s actions, we’ve been putting them into practice since day one, delivering solutions that already meet this standard.
Alignment in action: How 2F embodies the CSRMC
The CSRMC lays out a five‑phase lifecycle and ten foundational tenets. These aren’t mandates to react to—they’re the core principles driving the 2F Suite and our flagship DevSecOps platform, Game Warden® (Read about Game Warden’s DISA PA). Our customers can be confident they are already aligned with the DoW’s vision for a continuously hardened, verifiable, and actively defended enterprise.
1. Always‑on compliance and continuous authority-to-operate (ATO)
CSRMC call: Move to continuous monitoring and a constant ATO posture.
Our answer: Game Warden eliminates the “accreditation limbo” government programs face by embedding continuous compliance into the platform itself. Customers inherit our robust security controls and near‑real‑time monitoring, enabling faster authorizations and ongoing visibility without stop‑and‑go cycles.
2. DevSecOps and automation at scale
Two of the DoW’s foundational tenets are DevSecOps and automation—driving efficiency, scale, and secure, agile development.
CSRMC call: Institutionalize DevSecOps and automation to deliver secure, agile development at scale.
Our answer: The 2F Suite was purpose‑built for the “Develop. Deploy. Defend.” lifecycle:
- 2F Workshop provides the toolkit for building compliant software from the start, embedding security into the Design and Build phases of the CSRMC lifecycle.
- 2F Game Warden then acts as the Software Factory and hosting environment, automating and streamlining compliance processes, allowing software providers to achieve DoD accreditation in as little as 90 days. This speed and efficiency are the direct result of the automation the CSRMC requires.
- 2F Frontier delivers the Game Warden experience at the edge, providing secure and automated deployments downrange and in austere or disconnected environments.
3. Embracing reciprocity and inheritance
CSRMC call: Reduce compliance burdens and duplicative assessments through reciprocity and inheritance.
Our answer: Inheritance is the foundation of the 2F Suite. With FedRAMP High authorization and DISA Provisional Authorization at IL2/4/5, our customers don’t start from scratch. By deploying on our authorized platform, they inherit the controls required for DoD and IC networks—saving millions in compliance costs and accelerating ATO timelines. This operational inheritance is a game-changer that delivers an ATO for mission owners faster than traditional methods.
Powering cybersecurity at the speed of war
The CSRMC is a critical evolution in federal cybersecurity. It demands that the commercial technology base providing solutions to the federal government meet a new, higher standard of continuous security and operational speed.
The 2F Suite is more than software; it is a commitment to the foundational principles of the new CSRMC. We empower leading software providers to securely deliver critical capabilities to warfighters, ensuring that the DoW can maintain technological superiority against evolving cyber threats and meet the goal of delivering cybersecurity at the speed of war.
To learn more about how Second Front can accelerate your software’s accreditation and deployment onto unclassified and classified government networks, contact our team of experts.
About the authors
Josh Bosquez is the CTO of Second Front. Josh has spent over two decades in technical roles, including being the CTO of Eventus, Armor Cloud Security, and ICON Meals, which he also co-founded.
Matt Conner is the CISO of Second Front. Matt’s career in government and industry cybersecurity spans nearly 25 years. It includes previous roles as the CISO of Westinghouse Electric Corporation, the National Geospatial-Intelligence Agency, and the United States Intelligence Community.
Your success is our mission.
