The challenge
I inherited a legacy product that no longer met the Marines' needs. The Marine Corps explosive safety team ran inspections at bases around the world on a 20-year-old, unsupported system that was only available back at the hotel.
Inspections lasted 1 to 2 weeks per base. Inspectors spent every night entering the day's findings, then the entire last day building and revising the report for the base captain.
The new system also had to earn an ATO at DoD Impact Level 4 (IL4) in Azure Gov Cloud, which no Navy or Marine Corps system had done before. A typical ATO took 2 years.
My role
I owned the MAKE program in the cybersecurity division at NSWC Corona: the requirements and product vision for the Marine Corps ammunition and explosive safety teams, the business case, and delivery.
As principal program manager, I led the ATO under NIST RMF / 800-53 and the IL4 certification and deployment on Azure Gov Cloud.
How I solved it
- 1
Learn how Marines actually work
I walked inspections on site with the safety inspectors, interviewed subject matter experts, mapped the process in flow diagrams, and studied the legacy system. I met the experts every 2 weeks and walked through the work with power users in the field and in the office.
- 2
Turn skeptics into partners
I flew out to meet Marine Corps leadership, summarized what they needed in an executive 6-pager, explained what Agile delivery would look like, and set up open channels to clear roadblocks quickly. I presented progress to senior leadership every 6 months.
- 3
Rebuild it for the field, in the cloud
We built new enterprise software from the ground up on a lean budget, using open source tools wherever possible. Inspectors could now update findings in real time on base, and the system generated the inspection report on the fly.
- 4
Certify it in record time
I built a security-first team culture: engineers owned the application and server STIGs, and a junior team member took on the security documentation. I learned every step of the approval process, prepared documents ahead of each step, and met the Navy program executive office every 2 weeks to clear roadblocks.
- 5
Ship every 2 weeks
I ran Agile and DevSecOps delivery with a release every 2 weeks. When subject matter experts were unavailable, I made the call and revisited it with them in a later sprint.
Results
- The first system across the Navy and Marine Corps to earn an approved ATO at IL4 in Azure Gov Cloud.
- Named Best in Breed by the DoD Explosives Safety Board (July 2019) and recognized by the Office of the Secretary of Defense as a best practice for the other services.
- Auditors needed only one round of review at each approval step, where 2 to 4 rounds over 2 to 8 weeks were typical; each step closed in under a week.
- On a $1M to $3M yearly budget, MAKE met needs that competing systems costing other military branches $18M to $25M a year were built for.
- Automated ammunition request approvals on $200M+ a year in transactions, 30x faster.
- Led a white paper on Navy cloud deployment into IL4, shared with the other DoD branches.
- Later adopted by all five service branches; the program has since grown to $30M+ a year.
Source: NAVSEA, Jan 3, 2020: MAKE application becomes one-stop shop for Marine Corps ammo
Tools and stack
- Azure Gov Cloud (IL4)
- NIST RMF / 800-53
- DISA STIGs
- ReactJS
- GitHub
- TeamCity
- Splunk
- JIRA
- Confluence
- Azure DevOps
- Open source tooling