Defense Information Systems Agency (DISA)

The Defense Information Systems Agency (DISA) is a DoD combat support agency that provides, operates, and assures command and control, information-sharing capabilities, and a globally accessible enterprise information infrastructure in direct support of joint warfighters, national-level leaders, and other mission and coalition partners.

What is DISA?

DISA manages the DoD Information Network (DoDIN), the backbone IT and telecommunications infrastructure connecting all DoD components worldwide. This includes the SIPRNet (Secret Internet Protocol Router Network), NIPRNet (Non-classified IP Router Network), the Defense Information Systems Network (DISN), and the DoD's global satellite communications systems. DISA also serves as the DoD's primary cloud broker, managing the DoD Cloud Computing Strategy and overseeing FedRAMP authorizations for DoD cloud services.

DISA's contracting is among the largest in the federal government, spanning: IT infrastructure and telecommunications services, cybersecurity tools and services, cloud computing and enterprise hosting (the milCloud 2.0 environment), software development and integration, information assurance and identity management, and enterprise IT services provided to all DoD components under a chargeback model. DISA operates several major acquisition vehicles including STOREFRONT (for enterprise software licenses), the Encore III contract for IT services, and the SETI (Systems Engineering, Technology, and Innovation) vehicle.

For contractors, DISA represents a gateway to DoD-wide IT work. An accreditation or solution approved by DISA, such as a FedRAMP High authorization for DoD use or inclusion on the DISA Approved Products List (APL), can enable sales to every military service and DoD agency. The DISA APL is particularly significant for cybersecurity and IT product vendors.

Why DISA matters for government contractors

DISA obligates approximately $3-5 billion annually in contracts and manages many more billions in indirect spending as DoD's enterprise IT broker. IT services firms, cloud providers, cybersecurity companies, and telecommunications firms view DISA relationships as strategically essential to DoD market access.

Example

A cybersecurity firm achieves DISA Security Technical Implementation Guide (STIG) compliance for its network security monitoring product and obtains listing on the DISA Approved Products List. This APL listing allows the firm's product to be purchased by any DoD program without a separate security evaluation, dramatically accelerating sales cycles across Army, Navy, Air Force, and other DoD components.

Frequently Asked Questions

What is the DISA Approved Products List (APL)?

The APL is DISA's official catalog of IT products and solutions that have been evaluated and approved for DoD use. Products must meet DISA's security technical requirements (STIGs) and in some cases undergo formal DoD security review. APL listing is a significant market access enabler for IT vendors because it reduces the procurement burden for individual DoD buyers.

What is milCloud 2.0 and how does it affect contractors?

milCloud 2.0 is DISA's managed cloud environment for DoD workloads, operated by a commercial cloud provider under DISA's management. DoD components can migrate applications to milCloud 2.0 rather than building their own data center infrastructure. Application migration and cloud-native development contractors benefit from milCloud 2.0 adoption across DoD.

What are STIGs and why do IT product vendors need to comply?

Security Technical Implementation Guides (STIGs) are configuration standards that define security requirements for DoD IT products and systems. DISA develops and publishes STIGs for operating systems, databases, network devices, and applications. DoD procurement rules generally require that all IT products used on DoD networks comply with applicable STIGs, making STIG compliance a prerequisite for DoD market entry.

What is DISA's role in cloud acquisition for DoD?

DISA serves as the DoD Cloud Executive Agent, coordinating DoD cloud strategy and maintaining the Cloud Computing Security Requirements Guide (CC SRG). FedRAMP authorizations intended for DoD use require a DISA DoD Provisional Authorization (PA) at the appropriate impact level (IL2, IL4, IL5, IL6). DISA's milCloud and enterprise cloud agreements also shape how DoD components access commercial cloud services.