Software Acquisition Pathway

The Software Acquisition Pathway is one of six pathways in DoD's Adaptive Acquisition Framework (AAF), designed specifically for software-intensive systems and applications, emphasizing Agile and iterative development practices, continuous software delivery, and government access to source code and development environments.

What is the Software Acquisition Pathway?

Established by Section 800 of the NDAA for FY2020 and implemented through DoDI 5000.87, the Software Acquisition Pathway enables program managers to acquire software using modern commercial software development practices rather than the traditional waterfall development model embedded in the legacy MDAP process. Key features include: software programs divided into capability increments delivered continuously rather than in large, multi-year releases; government access to software source code, development pipelines, and repositories as standard contract requirements; mandatory DevSecOps practices integrating security into the development pipeline from the start; continuous testing and deployment to operational environments; and reduced documentation burden relative to traditional programs. Programs using the Software Acquisition Pathway must appoint a software-qualified program manager and demonstrate ongoing user engagement. The pathway is applicable to programs where software is the primary value driver, enterprise IT, command and control systems, data analytics platforms, AI/ML applications, and similar software-intensive capabilities.

Why the Software Acquisition Pathway matters for government contractors

The Software Acquisition Pathway creates a fundamentally different contracting and delivery model than traditional defense programs. Companies that build their software delivery capabilities around Agile, DevSecOps, and continuous deployment are well positioned for these programs. Traditional waterfall-focused contractors may struggle to adapt to the pathway's continuous delivery expectations.

Example

A cloud software company wins a contract under the Software Acquisition Pathway for a DoD data analytics platform. The contract requires bi-weekly software releases, government access to the contractor's GitLab environment, automated CI/CD pipeline with security scanning, and quarterly government user reviews. The contractor's development team works in two-week sprints, releasing updated capabilities every sprint to a government test environment with full visibility into the code repository.

Frequently Asked Questions

What is a "continuous authority to operate" (cATO) and how does it relate to the Software Acquisition Pathway?

A continuous Authority to Operate (cATO) is a security authorization approach that replaces the traditional point-in-time ATO with ongoing security assessment integrated into the DevSecOps pipeline. The Software Acquisition Pathway strongly encourages cATO because software releases too frequently for traditional ATO reviews to keep pace. Contractors on Software Acquisition Pathway programs must implement DevSecOps practices that support cATO.

Can commercial software companies participate in Software Acquisition Pathway programs?

Yes. The Software Acquisition Pathway was designed in part to make DoD programs more accessible to commercial software companies with modern development practices. Companies that might struggle with traditional MDAP requirements, CDRLs, MIL-SPEC documentation, waterfall schedules, find Software Acquisition Pathway programs more compatible with commercial development culture.

What is the DoD Enterprise DevSecOps Reference Design?

The DoD Enterprise DevSecOps Reference Design is the official DoD technical architecture for DevSecOps implementation on Software Acquisition Pathway programs. It specifies how development pipelines, testing environments, and deployment infrastructure should be structured and what security controls must be integrated into each stage of the pipeline.

How does intellectual property work on Software Acquisition Pathway programs?

IP rights on Software Acquisition Pathway programs are critical and often contentious. The government's requirement for source code access and development environment visibility can conflict with contractors' IP protection interests. The pathway's guidance encourages flexible IP arrangements, including government purpose rights rather than unlimited rights, to balance contractor innovation incentives with government access needs.