Health, Education & Government
›
Government & Public Sector
›
Defense Systems & Programs
Cyber Operations Systems
Multi-agency, multi-stakeholder programs where procurement, compliance, and mission alignment determine success.
Example organizations in this space:
Booz Allen Hamilton
Leidos
MITRE
Raytheon
This interactive experience is the shipped product itself — the same application code customers run in production, mounted read-only in your browser over a real sample journey. Not a video, not a mockup: because the demo and the product are one codebase, it can never drift from the real thing.
Inside this journey
-
Pre-Sales
Qualify and diagnose before investing in a full evaluation cycle.
-
Qualification
Confirm timeline, procurement vehicle, required clearance posture, decision authority, and urgency before full discovery.
Qualification Questions
Pre-Discovery Fit: clearance, procurement, timeline, decision authority, urgency
- What is the highest clearance level required for personnel and data access on this opportunity?
- What procurement vehicle will be used to award the work?
- Who holds the decision authority for awarding services like this, and who else materially influences that decision?
- What is the target start date or the operational deadline driving your timeline?
- How would you describe the urgency for staffing or capability delivery?
Operational and security constraints
- Will the solution or personnel require any specific enclave, handling caveats, or security artifacts (for example dedicated enclaves, SCIF access, or authorizing documentation)?
- Do you expect the buyer to require a pre-submission security review or other formal acceptance artifact before deployment?
Budget and funding posture
- Is there allocated funding or a budget range for this effort?
Readiness for a full discovery conversation
- Would you like to schedule a full discovery conversation now, and if so, when would you be available in the next two weeks?
- Is there one thing we should prepare or know in advance to make the discovery most productive?
-
Operational Discovery
Map mission objectives, current toolset gaps, staffing shortfalls, security-review history, and stakeholder roles.
Discovery Questions
Why this mission, now?
- Tell me briefly what prompted this mission and the fixed deadline you are under.
- What is the primary mission objective you expect this capability to enable within the first six months?
- Within your organization, who will be judged on the capability's early performance and what metric matters to them?
- How many cleared operators does your team currently keep available for surge staffing, and how many would you need within ten business days?
- List the specific enclaves or environment classifications this capability must operate in during the pilot phase.
- Which single acceptance metric would make leadership declare the pilot an unequivocal success?
Where the mission falls short today
- If a missing person, access, or artifact forced you to pause the program this week, what would that be?
- Describe the last time an operational requirement was misunderstood between operators and program leadership, what went wrong, and who absorbed the cost.
- When a configuration or integration slipped on past work, how long did recovery take and what was the impact on mission tempo?
- Name two recurring technical debt areas—tooling, data access, or staffing—that most constrain your team's speed.
- Which single risk, if realized, would make you stop the project immediately?
How your tools and data actually behave
- Walk me through the last time a tool failed security review, what failed specifically, and what broke in operations afterward.
- Do you keep a consolidated record of security-review findings and can your team share the most common failure points?
- On your primary mission systems, which telemetry or log streams are accessible to an integration partner during testing, and who owns those feeds?
- Estimate the percentage of mission data that is labeled and portable for unclassified testing.
- If mission data cannot be moved, what alternative validation path would you accept—synthetic telemetry, in-place testing, or a reviewed proxy dataset?
Who keeps this mission running
- Who must sign approval to add cleared operators within ten business days, and what barrier would prevent that sign-off?
- Describe your current cleared-operator onboarding steps and the average time each step takes before individuals gain enclave access.
- List the roles on your side that will provide day-to-day operational support during the pilot.
- How long does background investigation and cleared-personnel onboarding typically take from offer to badge for contractor staff?
- What training or classified tradecraft certifications must vendor personnel hold before they can perform operational tasks?
The other options you are weighing
- Name the alternative your team would choose if you did not change course, and explain why that option remains attractive.
- Provide the external vendors or internal teams you have evaluated so far for this capability.
- Under what conditions would your incumbent solution or an in-house effort be sufficient so you would not choose an outside partner?
- Has anyone internally proposed solving this without a vendor, and if yes, who would own the implementation and staffing risk?
- Rank the decision criteria cost, clearance posture, ramp speed, and security-review success by priority for your leadership.
Can you meet the practical gates and constraints?
- Identify the single missing approval, integration point, or resource that would prevent the engagement from starting on your required 60-day schedule.
- Do your mission APIs or endpoints provide vendor-level integration points, and if so, who owns and maintains those interfaces?
- Provide a list of the specific compliance approvals or legal reviews that must be cleared before vendor code can touch production enclaves.
- Estimate the number of FTEs on your staff who can be dedicated to integration support during the first week of onboarding.
- Choose the fallback validation path you would accept if the required dataset cannot be moved: mock data, synthetic telemetry, or in-place testing only.
- Typically, how many business days does your security office require to complete a vendor code review from submission to final sign-off?
Decision triggers and next steps
- Assuming the pilot meets your stated acceptance criteria, what remaining factor would still prevent you from signing immediately after pilot completion?
- Outline the acceptance criteria that would let you declare pilot success, including numeric thresholds and required security gates.
- Who will sign pilot acceptance and who holds the final budget authority for follow-on work?
- Break down the remaining obstacles on your side to starting within 60 days, and for each, name the owner and an estimated resolution date.
- Give the lead time to verify cleared personnel availability and deliver named resumes if requested tomorrow.
- Point to the contractual change that would most accelerate signature, for example payment terms, staffing guarantees, or liability limits.
- Select your target decision window after pilot completion.
-
-
Technical Evaluation
Validate technical fit and workforce readiness with hands-on testing against an unclassified problem set and acceptance criteria.
- decision_readiness
- current_state
- desired_state
- success_criteria
- gaps
- stakeholders
- current_state
- decision_readiness
- success_criteria
- gaps
- stakeholders
- desired_state
- desired_state
- current_state
- gaps
- decision_readiness
- stakeholders
- success_criteria
- decision_readiness
- decision_readiness
- decision_readiness
- decision_readiness
-
Solution Scope
Define deliverables, cleared workforce levels, security artifacts, integration boundaries, and measurable acceptance criteria.
Scope Configuration
- Provision Cleared Cyber Operators
- Provide Cleared Operator Surge Coverage
- Develop Vulnerability Research Deliverables
- Engineer Custom Tooling for Offensive Missions
- Engineer Defensive Threat‑Hunting Tools
- Build Malware Analysis Sandbox and Workflows
- Integrate Mission Systems into Classified Enclaves
- Migrate and Harden Existing Tooling
- Deliver Data Analytics Platform for Telemetry
- Develop Automated Telemetry Ingestion Connectors
- Implement Mission Management Dashboard
- Package Tools for Government Security Review
- Establish Secure CI/CD and Build Pipelines
- Provide Reverse‑Engineering and Binary Analysis
Scope Questions
Provision Cleared Cyber Operators
- Specify the clearance levels required for operators (select all that apply) including program-specific caveats
- Estimate the number of operators you need onboarded to mission baseline within the first 30 days
- Identify the mission tradecraft required from operators (select all that apply)
- Provide the target onboarding evidence you will accept for operator readiness (examples: completed enclave ATO briefings, sponsor vetting, SSA access list)
- Indicate your preferred operator ramp timeline to full productivity on the target enclave
- State any mandatory onboarding documents we must collect before access provisioning (examples: SF-86, completed background investigation code, training certificates)
Provide Cleared Operator Surge Coverage
- Indicate the surge response SLA for additional cleared operators
- Describe the fractional or full-shift coverage you require during surge periods (examples: 24/7 rotations, overlapping shifts, post-incident spike)
- List any enclave access constraints for surge staff (for example: separate sponsorship process for TS/SCI enclaves, cross-domain transfer restrictions)
- Select which surge staffing guarantees you need to include in scope
- Identify training or crosswalk artifacts new surge operators must complete before mission duties (examples: enclave-specific STIG brief, POA&M review, mission playbooks)
- Specify escalation owner and contact method for urgent surge requests
Develop Vulnerability Research Deliverables
- Identify the vulnerability deliverable types you expect (select all that apply)
- Describe the acceptable formats for deliverables and evidence (examples: technical whitepaper, exploit code archive, recorded lab demo, annotated packets)
- Name the test environment or reference image you will provide for reproducibility (examples: VM image with OS and app versions, network capture)
- Estimate the allowable disclosure classification for vulnerability artifacts you will accept for transfer (examples: unclassified report, SECRET code escrow)
- Specify remediation acceptance metrics for a discovered vulnerability (examples: patch PR submitted, mitigation verified in staging, time-to-mitigate target)
- Indicate whether you require CVE assignment assistance and vulnerability coordination with external vendors
Engineer Custom Tooling for Offensive Missions
- Specify the mission capabilities the custom tool must demonstrate in an unclassified technical evaluation (examples: command-and-control chaining, lateral movement simulation, data exfil simulation)
- Identify target runtime environments for the tool (select all that apply)
- Describe integration boundaries the tool must respect (examples: no persistent kernel modules, no outbound Internet, logs to designated collector only)
- Specify operator skill prerequisites for using the tool in mission context (examples: languages, frameworks, required playbook familiarity)
- List the security hardening artifacts you require with delivery (examples: build reproducibility instructions, SBOM, signing keys, developer access controls)
- Indicate your preferred acceptance demonstration for the tool in the unclassified test (examples: scripted scenario run, KPP checklist, live demo captured and replayable)
Engineer Defensive Threat‑Hunting Tools
- Identify the detection use cases the threat‑hunting tool must cover (select all that apply)
- Select the telemetry sources the tool must ingest out of the box
- Provide the minimum true-positive detection rate you require for initial acceptance during evaluation
- Specify the normalization or schema the tool must output (examples: CEF, Elastic ECS, custom JSON schema)
- Describe required analyst workflows or playbooks that must be delivered with the tool (examples: triage steps, enrichment sources, response scripts)
- Identify whether the tool must operate within an enclave air-gap and any cross-domain transfer constraints
Build Malware Analysis Sandbox and Workflows
- Specify the classification level and enclave where the sandbox will operate
- List required sandbox capabilities (select all that apply)
- Provide the expected artifacts from analysis runs you will accept as deliverables (examples: IOC lists, YARA rules, behavior reports, memory dumps)
- Identify containment and handling requirements for malware artifacts (examples: signed transfer via accredited SFTP, storage in FIPS 140-2 validated module)
- State the retention and destruction policy the sandbox must enforce for captured artifacts and intermediate images
- Indicate whether integration with your SIEM or case management system is required for automated alerting from the sandbox
Integrate Mission Systems into Classified Enclaves
- Name the target enclave accreditation boundary and any existing ATO/Authorization to Operate artifacts we must align to
- Specify required accreditation artifacts to be produced or updated (select all that apply)
- Provide the approved integration interfaces and protocols for the enclave (examples: syslog over TLS to a collector, SFTP via approved gateway, cross-domain solution specs)
- Indicate the measure that will define successful integration for your accreditation board (acceptance criteria)
- List any enclave-specific hardening baselines we must meet (examples: DISA STIGs, custom baseline checklist, NIST SP 800-53 controls)
- State data flow restrictions between enclaves we must enforce during integration (examples: one-way transfer, removal of metadata, packaging via approved CDS)
Migrate and Harden Existing Tooling
- Identify the legacy tools to migrate by name and current runtime versions
- Specify the target hardening standards you require post-migration (examples: CIS benchmark level, STIG compliance, FIPS-validated crypto)
- Describe migration success thresholds we should meet (examples: feature parity, <5% performance regression, automated test pass rate)
- Provide any existing automated test suites or acceptance tests we should reuse during migration
- Indicate whether we are allowed direct access to the current tool's source code and build artifacts
- List external dependencies that must be preserved or replaced during migration (examples: third-party libs, proprietary drivers, licensing constraints)
Deliver Data Analytics Platform for Telemetry
- Specify the telemetry types the platform must ingest and retain (select all that apply)
- Provide required retention periods and classification rules for stored telemetry
- Identify the performance SLAs the platform must meet for query response and data ingest
- List the dashboards or analytics outputs you require at delivery (examples: daily IOC summary, lateral movement heatmap, top anomalous endpoints)
- Specify acceptable export interfaces for telemetry (examples: syslog/TLS, Kafka topic, SFTP bundles) and any cross-domain constraints
- Provide the acceptance criteria that will confirm the platform meets ingestion and query requirements (examples: ingest X GB/day with Y% completeness, run canonical queries returning expected results)
Develop Automated Telemetry Ingestion Connectors
- List the source systems for which connectors must be developed (examples: specific EDR, proxy, firewall syslog endpoints)
- Specify the transport protocols and formats the connectors must support (examples: syslog over TLS, JSON over HTTPS, CEF, SFTP batch)
- Identify error-handling and retry semantics you require for connector failures
- Provide the minimum field mapping or schema the connector must produce (examples: normalized fields: source_ip, dest_ip, timestamp, event_id)
- Indicate whether connectors must run inside the enclave or via an approved gateway outside the enclave
- Describe the delivery artifacts you expect for each connector (examples: connector code repo, test harness, deployment manifest)
-
Mutual Commit
Finalize commercial and security terms, staffing guarantees, access requirements, and mutual responsibilities.
Agreement Modules
- Master Services Agreement (MSA)
- Statement of Work (SOW)
- Staffing Guarantee Addendum
- Security & Clearance Addendum
- Access and Onboarding Agreement
- Pricing and Order Form
- Acceptance & Go/No-Go Checklist
- Change Order Agreement
- Transition and Termination Agreement
-
Deployment
Lock readiness facts and configuration values before execution begins.
-
Pre-Deployment Readiness
Confirm target enclaves, data handling constraints, named owners, access approvals, and scheduling constraints before configuration begins.
Pre-Deployment Questions
Environment and access
- Which target enclave(s) will receive configuration and deployment? (list each enclave name so we can scope clearance and packaging)
- For each target enclave, are the required accreditations/security authorizations (ATO/AAI or equivalent) already in place, partially in place, or not started? (this determines gating for configuration)
- Select the categories of buyer systems the deployment will integrate with (we'll use this to coordinate adapters and handoffs)
- Are cleared, credentialed accounts and access roles already provisioned for the seller's deployment personnel in each target enclave? (if partial or pending, provide target completion date in the timing section)
Data and configuration
- Will the deployment require ingestion, migration, or persistent storage of buyer data inside the target enclave(s)? (this defines data handling controls)
- If data will be stored or migrated, is there an approved data classification and handling policy and an identified policy owner? (we need the owner to approve handling decisions)
- Who is the buyer's authoritative owner for data handling and classification decisions? (name and role — used to route approvals)
- Are there mandated data-at-rest, transit, or cross-enclave constraints that will affect configuration? Select all that apply.
People and ownership
- Who is the primary buyer-side deployment owner who will approve access, schedule, and acceptance? (name and role — this person will receive change requests and go/no-go notices)
- Are the seller's cleared personnel to be assigned to this deployment already identified and approved to operate in the target enclave(s)? (this determines onboarding lead time)
- Who will be the buyer technical point of contact for configuration handoff and technical acceptance? (name and role)
- Are there required onsite escorts, facility-access briefings, or cleared-only indoctrinations the deployment team must complete prior to any onsite work?
Timing and constraints
- What is the earliest date the deployment team may begin configuration activities in the target enclave(s)? (we will not schedule work before this date)
- List any blackout windows, maintenance freezes, or recurring mission-critical periods when deployments are prohibited or limited (include date ranges or recurrence rules so we can avoid conflicts)
- Which contractual or compliance gates must be closed before configuration begins? Select all that apply.
- Who is authorized to give the final go/no-go approval to start configuration? Please provide the primary approver and an alternate (name and role).
-
Configuration Details
Capture exact configuration values and integration parameters the deployment team will use, including endpoints, handoff methods, and credential plans.
Configuration Details
Environments & Endpoints
- Enter the exact production environment name as it appears in your environment inventory (Default: production). Example format: prod-tn-01
- Enter your production management endpoint URL (format: https://hostname[:port]/path). This value is consumed by the deployment build.
- Enter the staging/pre-deployment environment name used for initial configuration and validation (Default: staging).
Authentication & Credential Handoff (non-secret identifiers only)
- Select your identity provider (IdP) type for administrative access to deployed systems (your identity provider (IdP)).
- Enter the non-secret integration identifier we should reference (service account user name or client_id). Do NOT paste any password or secret—this is an identifier only.
- Select the channel your organization will use to deliver secrets/credentials at kickoff (Default: Your secrets manager). The deployment build records the chosen channel; secrets themselves are exchanged via that channel at kickoff.
Integration & Handoffs
- Select the primary integration method the deployment will use to exchange data or receive callbacks.
- Enter the inbound hostname or subdomain the seller will connect to (format: https://hostname or hostname). If no inbound endpoint, enter N/A.
Operational Limits & Go‑Live
- Maximum number of concurrent cleared operators to provision at go‑live (integer). Default is 10 — confirm or specify another value.
- Minimum number of cleared personnel required on-site or named for the go/no‑go decision (integer). Default is 3 — confirm or specify another value.
-
Deployment Execution
Onboard cleared personnel, integrate tools into mission environments, and execute the phased rollout with named owners and milestones.
-
Go-Live Validation
Verify security-review sign-offs, staffing baseline, and acceptance criteria in a named go/no-go checklist before declaring operational status.
Checklist items
- Obtain written Authorization to Operate (or equivalent) from the security authorizing official
- Receive signed security risk acceptance and open-findings log
- Confirm security artifacts accepted by the security review board
- Validate cleared staffing baseline approval
- Verify personnel vetting and required training completed
- Confirm all required access approvals and enclave access provisioning are completed
- Validate acceptance test results and formal UAT sign-off
- Verify deployed configuration matches the approved configuration document
- Confirm monitoring, logging, and incident-response integrations are operational and tested
- Validate rollback and recovery plan is documented and rehearsed
- Obtain signed Go/No-Go decision from the designated program decision authority (and security authorizing official where required)
-
-
Success
Run recurring outcome reviews, track operational tickets and enhancement requests, and measure capability sustainment against success signals.
Success Reviews
- Go-live Health Check (Weeks 1-4)
- First Measurement Review (Weeks 4-10)
- Operational Ticket and Enhancement Triage (Monthly)
- Quarterly Outcomes Review
- Annual Sustainment and Capability Signal Review
Issues & Enhancements
- Deliver a quarter-end performance brief with trend lines and assigned remediation owners for any off-target metrics.
- Maintain staffed mission-shift coverage at or above the committed percentage and document recovery steps if below target.
- Publish the prioritized enhancement backlog for the next delivery window with target delivery dates.
- Open remediation tickets for outstanding security artifacts with completion deadlines tied to operational use.
- Update the staffing recovery plan to address any shortfalls and circulate to stakeholders.
- Quarterly performance versus Solution Scope targets
- Confirm whether MTTR and enhancement delivery rates meet quarterly targets in Solution Scope or require remediation.
- Agree actions to address any staffing risks that threaten mission coverage.
- Validate that incident fixes are permanent and reduce recurrence risk.
- Re-confirm success criteria and named owners
- Execute the staffing mitigation plan for any mission-shift coverage shortfalls and report progress next month.
- Schedule targeted technical work to eliminate the highest recurrence incident causes.
- Yearly metrics and trend analysis
- Confirm the capability meets annual sustainment signals and that security-review pass rates and operator proficiency are at or moving toward Solution Scope targets.
- Agree a specific mitigation plan for the top sustainment risks with target dates.
- Ensure operational runbooks and security artifacts are current and accessible for mission continuity.
- Publish the annual sustainment report summarizing metrics, risks, and agreed mitigation actions.
- Update runbooks and security documentation and confirm archive locations and access methods.
- Produce a prioritized technical debt backlog with target remediation windows for the coming year.
- All deployment-critical integrations validated and any critical defects have a named owner and resolution date.
- Incumbent system decommission plan confirmed or documented as retained-read-only with migration and archive dates.
- Immediate remediation plan published and the timeline to the first measurement meeting confirmed.
- Publish a deployment validation checklist with action owners and target dates.
- Document the incumbent wind-down steps and finalize archive/migration status.
- Open priority remediation tickets and schedule the follow-up status check before the first measurement.
- Present first-data against Solution Scope targets
- Determine whether time to baseline operator productivity and security-review first-pass success rate are trending to Solution Scope targets or require escalation.
- Agree a prioritized remediation plan with specific actions and dates to address the top metric gaps.
- Update the ticket/enhancement backlog and confirm next status checkpoint cadence.
- Create remediation task list for each off-target metric with acceptance criteria and target resolution dates.
- Assign a standing weekly triage for high-priority operational tickets until backlog is below the agreed threshold.
- Deliver an updated staffing forecast showing expected dates to reach the committed cleared-operator coverage.
- Ticket burn-down and MTTR review
- Reduce critical-ticket backlog and lower MTTR to the agreed cadence documented in Solution Scope.
- Confirm prioritized enhancement items to be delivered in the next operational window.
- Deployment and integration validation
- High-impact incident and root-cause review
- Sustainment risks and mitigation plan
- Enhancement request triage and prioritization
- Root-cause diagnosis for metric gaps
- Staffing sustainment and attrition analysis
- Staffing posture and cleared bench health
- Enhancement and technical debt summary
- Operational tickets and enhancement backlog review
- Early adoption signals and usage patterns
- Incumbent decommission status update
- Enhancement delivery versus roadmap
- Archive runbooks, lessons learned, and operational handoffs
- Open security artifacts and compliance items
- Blockers and open issues with owners
- Incumbent system wind-down checkpoint
- Agree corrective actions and timelines
- Agree immediate remediation actions