Key Takeaways
- • Second Front (2F) has won a new contract from the Department of War Innovation Unit (DIU) to build an AI-native, web-based tool that automates the first three steps of the Risk Management Framework (RMF): Prepare, Categorize, and Select.
- • The work falls under DIU's Bridge Program, which targets bottlenecks in security clearances, classified-space access, commercial technology accreditation, and testing for non-traditional defense companies.
- • The platform is designed to function like guided tax-preparation software, letting program teams describe their mission, system requirements, deployment environment, and data types rather than requiring deep regulatory expertise.
- • DIU's stated goal is to cut cyber authorization timelines in half, and the project is scoped as a 90-day sprint.
- • The award extends a multi-year relationship between 2F and DIU, which previously awarded 2F a contract for the Proving Grounds special operations testbed.
Summary
Second Front (2F), a public-benefit software company, announced a new contract with the Department of War Innovation Unit (DIU), according to a Business Wire release. Under DIU's Bridge Program, 2F will build an automated tool to simplify and accelerate the initial stages of the Risk Management Framework (RMF), the standard the Department of War uses to verify that a software system is secure enough to operate on its networks. The Bridge Program is a strategic initiative to eliminate critical bottlenecks around security clearances, access to classified spaces, compliance requirements for commercial technology adoption, and testing that help non-traditional companies sell and scale solutions within the military.
The new tool is a web-based, guided application that the release describes as functioning much like online tax-preparation software. Rather than requiring deep regulatory expertise, the AI-native platform prompts users with basic questions to categorize their systems. Program teams describe their mission, system requirements, deployment environment, and data types, and the platform guides them through the Prepare, Categorize, and Select steps. The release states that these steps are notoriously difficult for program teams and that automating them allows users to generate artifacts typically expected of an experienced cybersecurity professional.
The effort is part of the Bridge Program's broader push under the 2026 National Defense Strategy, and it addresses three friction points: Classified Infrastructure-as-a-Service (CIaaS), Commercial Technology Accreditation, and Integrated Test Teams. DIU's Sarah Pearson, Chief of Strategic Initiatives and lead for the Bridge Program, said that shifting RMF left requires teams to have the right tools without building deep expertise themselves. Lowell Usrey, Authorizing Official at DIU, said the approach should produce a more consistent starting point and faster process for every authorization the Bridge Program touches, representing a concrete step toward the program's mandate to cut cyber authorization timelines in half.
Tyler Sweatt, CEO of Second Front, said the RMF process has become a risk in itself and that the solution places the company's experience with commercial software authorization in the hands of program managers and system owners. The award expands a multi-year working relationship between 2F and DIU, which previously awarded 2F a contract for its Proving Grounds project, a special operations testbed for rapidly accrediting and testing emerging capabilities against real defense networks. The release did not disclose the contract value.
The new tool is a web-based, guided application that the release describes as functioning much like online tax-preparation software. Rather than requiring deep regulatory expertise, the AI-native platform prompts users with basic questions to categorize their systems. Program teams describe their mission, system requirements, deployment environment, and data types, and the platform guides them through the Prepare, Categorize, and Select steps. The release states that these steps are notoriously difficult for program teams and that automating them allows users to generate artifacts typically expected of an experienced cybersecurity professional.
The effort is part of the Bridge Program's broader push under the 2026 National Defense Strategy, and it addresses three friction points: Classified Infrastructure-as-a-Service (CIaaS), Commercial Technology Accreditation, and Integrated Test Teams. DIU's Sarah Pearson, Chief of Strategic Initiatives and lead for the Bridge Program, said that shifting RMF left requires teams to have the right tools without building deep expertise themselves. Lowell Usrey, Authorizing Official at DIU, said the approach should produce a more consistent starting point and faster process for every authorization the Bridge Program touches, representing a concrete step toward the program's mandate to cut cyber authorization timelines in half.
Tyler Sweatt, CEO of Second Front, said the RMF process has become a risk in itself and that the solution places the company's experience with commercial software authorization in the hands of program managers and system owners. The award expands a multi-year working relationship between 2F and DIU, which previously awarded 2F a contract for its Proving Grounds project, a special operations testbed for rapidly accrediting and testing emerging capabilities against real defense networks. The release did not disclose the contract value.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.