Table of contents
- At a glance
- What the Defense Cybersecurity Strategy covers
- The timeline behind the policy push
- What the numbers say about scale and coordination
- Workforce, funding, and execution
- Readiness and compliance signals
- How to read the latest defense cybersecurity statistics
At a glance
The latest defense cybersecurity statistics show a strategy that is broad in scope, tightly tied to other national security frameworks, and backed by a long-running set of programs and enforcement requirements.
Big number: the DoD DIB Cybersecurity Strategy spans FY 2024 through FY 2027 and sets out 4 primary goals (DoD DIB Cybersecurity Strategy 2024).
Why it matters: the data points point to an ecosystem problem, not a narrow IT issue. The Department says its mission depends on protecting the defense industrial base from malicious cyber activity, coordinating across the enterprise, and closing gaps in networks, supply chains, and critical resources (DoD DIB Cybersecurity Strategy 2024).
Fast facts
- The strategy is aligned with the 2022 National Defense Strategy, the 2023 National Cybersecurity Strategy, the 2023 DoD Cyber Strategy, and the 2024 National Defense Industrial Strategy (DoD DIB Cybersecurity Strategy 2024).
- The voluntary DIB Cybersecurity Program has existed since 2008 (DoD DIB Cybersecurity Strategy 2024).
- DFARS 252.204-7012 has been required since 2013 (DoD DIB Cybersecurity Strategy 2024).
- The DOD cyber workforce vacancy rate fell from 20.9% in FY 2023 to 16.2% in FY 2024 (FY2024 Annual Performance Report for the DOD Strategic Management Plan).
- GAO found DOD had about 2,900 CUI systems in its review and said none of the DOD components were fully compliant with the CUI cybersecurity requirements as of January 2022 (GAO-22-105259).
What the Defense Cybersecurity Strategy covers
The most useful way to read defense cybersecurity statistics is to treat them as a map of how the Department is trying to secure the industrial base and the mission at the same time.
The DoD DIB Cybersecurity Strategy covers FY 2024 through FY 2027 and is built around 4 primary goals (DoD DIB Cybersecurity Strategy 2024). Those goals point to four recurring themes in the data:
- strengthen governance for DIB cybersecurity,
- improve the cybersecurity posture of the DIB,
- preserve the resiliency of critical DIB capabilities in a cyber-contested environment, and
- improve cybersecurity collaboration with the DIB (DoD DIB Cybersecurity Strategy 2024).
That structure matters because it shows the strategy is not just about compliance. It is also about sustainment, coordination, and resilience. The Department says the DIB is critical to national security goals and technology advantage, and that the effort is designed to sustain a more resilient Joint Force and defense ecosystem (DoD DIB Cybersecurity Strategy 2024).
What the strategy says the Department is trying to do
A few statements in the dataset are especially important because they explain the role of cybersecurity in the broader defense mission:
- The mission depends on protecting the DIB from malicious cyber activity (DoD DIB Cybersecurity Strategy 2024).
- The Department must coordinate across the enterprise to identify and close gaps in protecting networks, supply chains, and critical resources (DoD DIB Cybersecurity Strategy 2024).
- The Department must attract and retain a cyber workforce to meet current and future battlefield challenges (DoD DIB Cybersecurity Strategy 2024).
- The Department seeks a secure and resilient DIB information environment that promotes competitiveness, innovation, and sustainable growth (DoD DIB Cybersecurity Strategy 2024).
That combination of security, industrial strength, and workforce capacity is one of the clearest takeaways in the statistics.
The timeline behind the policy push
The defense cybersecurity timeline is as important as the counts themselves. Several of the statistics show how long the current posture has been building.
Key milestones
| Year / period | Statistic | Source label |
|---|---|---|
| 2008 | Voluntary DIB Cybersecurity Program exists since 2008 | DoD DIB Cybersecurity Strategy 2024 |
| 2013 | DFARS 252.204-7012 required since 2013 | DoD DIB Cybersecurity Strategy 2024 |
| FY 2020 | NDAA FY 2020 Section 1648 informed the strategy | DoD DIB Cybersecurity Strategy 2024 |
| FY 2021 | NDAA FY 2021 Sections 1728 and 1737 informed the strategy | DoD DIB Cybersecurity Strategy 2024 |
| 2022 | Strategy aligned with the 2022 National Defense Strategy | DoD DIB Cybersecurity Strategy 2024 |
| 2023 | Strategy aligned with the 2023 National Cybersecurity Strategy and 2023 DoD Cyber Strategy | DoD DIB Cybersecurity Strategy 2024 |
| 2024 | Strategy aligned with the 2024 National Defense Industrial Strategy | DoD DIB Cybersecurity Strategy 2024 |
| FY 2024 to FY 2027 | Strategy horizon spans 3 years across those fiscal years | DoD DIB Cybersecurity Strategy 2024 |
The shape of this timeline tells a straightforward story. Defense cybersecurity is not a new initiative that appeared overnight. It is the result of a layered policy stack built over many years, with statutory, strategic, and programmatic pieces reinforcing each other.
Why that timeline matters
The older milestones matter because they show what the current strategy is inheriting:
- 2008 marks the start of the voluntary program that enabled information sharing (DoD DIB Cybersecurity Strategy 2024).
- 2013 marks the point at which specific contractor cybersecurity requirements became mandatory (DoD DIB Cybersecurity Strategy 2024).
- FY 2020 and FY 2021 show the strategy was informed by later legislative direction (DoD DIB Cybersecurity Strategy 2024).
- 2022 through 2024 show the current strategy is synchronized with the broader national defense and cybersecurity agenda (DoD DIB Cybersecurity Strategy 2024).
That sequence indicates the Department is moving from baseline requirements toward more integrated governance and resilience.
What the numbers say about scale and coordination
The dataset contains a lot of signals about how broad the defense cybersecurity effort is. Some of the most useful figures are the ones that show the size of the coordination network.
Participation and outreach
The NSA Cybersecurity Collaboration Center supported 154,000 tamper-indicating products in FY 2024 and served more than 1,300 DIB industry partners in the same year (NSA Cybersecurity Year in Review 2024).
It also recorded 35,000 analytical exchanges, maintained more than 800 collaboration channels, and published more than 40 actionable joint publications in FY 2024 (NSA Cybersecurity Year in Review 2024).
Those figures suggest a mature information-sharing model rather than a small pilot. They also imply that defense cybersecurity is operating through repeated interactions, not one-off advisories.
Education and talent pipeline
NSA also supported 500 NCAE-C designated higher-education institutions in FY 2024 and participated in nearly 50 in-person and virtual college and university career fairs and professional events in the same fiscal year (NSA Cybersecurity Year in Review 2024).
That cluster of numbers points to a pipeline approach:
- awareness at the university level,
- recruitment into cyber careers,
- and continued engagement through professional events.
The strategy’s own emphasis on attracting and retaining a cyber workforce fits neatly with those numbers (DoD DIB Cybersecurity Strategy 2024).
Standards and certification
NIAP operates within a 31-member Common Criteria Recognition Arrangement body and hosted CCRA representatives from 18 nations in Washington, D.C. (NSA Cybersecurity Year in Review 2024).
In FY 2024, NIAP certified 72 commercial components for protecting NSS and published 7 Protection Profiles (NSA Cybersecurity Year in Review 2024).
That matters because defense cybersecurity is not just an operations problem. It is also a standards problem. Certification, recognition arrangements, and protection profiles all help turn security expectations into something that can be implemented and measured.
Compact comparison table
| Area | FY 2024 figure | Source label |
|---|---|---|
| DIB industry partners supported | More than 1,300 | NSA Cybersecurity Year in Review 2024 |
| Analytical exchanges | 35,000 | NSA Cybersecurity Year in Review 2024 |
| Collaboration channels | More than 800 | NSA Cybersecurity Year in Review 2024 |
| Actionable joint publications | More than 40 | NSA Cybersecurity Year in Review 2024 |
| NCAE-C higher-education institutions supported | 500 | NSA Cybersecurity Year in Review 2024 |
| Commercial components certified by NIAP | 72 | NSA Cybersecurity Year in Review 2024 |
| Protection Profiles published | 7 | NSA Cybersecurity Year in Review 2024 |
This comparison shows the mix of operational scale, academic reach, and standards work that sits behind the broader defense cybersecurity posture.
Workforce, funding, and execution
The statistics also make it clear that cybersecurity capacity is being managed as a staffing and budget issue, not only as a technical one.
Workforce pressure is easing, but not gone
The DOD cyber workforce vacancy rate was 20.9% in FY 2023 and 16.2% in FY 2024, a reduction of 4.8% during FY 2024 (FY2024 Annual Performance Report for the DOD Strategic Management Plan).
That is a meaningful improvement, but the remaining vacancy rate still suggests persistent staffing pressure. The strategy’s workforce language makes sense in that context: DoD says it must attract and retain cyber talent to meet battlefield challenges (DoD DIB Cybersecurity Strategy 2024).
Classification targets show how the Department is formalizing roles
The workforce framework includes several 100% classification targets in the DoD strategic planning materials:
- 100% classification of civilian personnel-system positions in FY 2022, FY 2023, and FY 2024 (DOD Strategic Management Plan FY 2022-2026).
- 100% classification of civilian manpower-system positions in FY 2023 and FY 2024, following an 80% target in FY 2022 (DOD Strategic Management Plan FY 2022-2026).
- 40% classification of military personnel-system positions in FY 2022, 80% in FY 2023, and 100% in FY 2024 (DOD Strategic Management Plan FY 2022-2026).
- 50% classification of military manpower-system positions in FY 2022, 90% in FY 2023, and 100% in FY 2024 (DOD Strategic Management Plan FY 2022-2026).
Those are not just bureaucratic milestones. They show the Department trying to define and stabilize cyber roles across different personnel systems.
Funding tells a more complicated story
The budget figures in the dataset do not all move in the same direction.
- DIB Cybersecurity Activities budget authority in DISA Cyber was $6,149 thousand in FY 2023, $5,879 thousand in FY 2024, and $5,886 thousand requested for FY 2025 (DISA Cyber FY 2025 Budget Estimates).
- DISA’s ISSP / IA Cyberspace Operations funding was $517,549 thousand in FY 2023, $508,777 thousand in FY 2024, and $499,010 thousand requested for FY 2025 (DISA Cyber FY 2025 Budget Estimates).
- DISA’s total cyber funding was $658,933 thousand in FY 2023, $526,893 thousand in FY 2024, and $504,896 thousand requested for FY 2025 (DISA Cyber FY 2025 Budget Estimates).
The main pattern here is not growth. It is pressure to do more with less, or at least to sustain capability while requests trend downward in several lines.
Program targets and throughput
The OSD Cyber and DOD cyber activity metrics add more detail:
- New voluntary DIB Cybersecurity Program participants were 90 in FY 2023, with a target of 150 in FY 2024 and FY 2025 (OSD Cyber FY 2025 Budget Estimates).
- The DIB CS Pilot Program had 22 companies participating in FY 2023 and a 30-company ceiling in FY 2024 and FY 2025 (OSD Cyber FY 2025 Budget Estimates).
- The DIB CS Pilot Program shared 8 cybersecurity threat-indicator products in FY 2023, 25 in FY 2024, and targeted 52 in FY 2025 (OSD Cyber FY 2025 Budget Estimates).
- DoD recorded 35 DFARS-support engagements in FY 2023, with targets of 40 in FY 2024 and 45 in FY 2025 (OSD Cyber FY 2025 Budget Estimates).
- DoD Cyber Crime Center produced 1,750 cyber threat information products in FY 2023 and targeted 2,500 in FY 2024 and FY 2025 (OSD Cyber FY 2025 Budget Estimates).
Together, those figures show an ecosystem that depends on both recurring engagement and measurable throughput. The strategy is not only about setting policy. It is also about generating usable outputs, from threat indicators to technical support and industry engagement.
Readiness and compliance signals
Some of the strongest statistics in the dataset come from GAO and other oversight-style reporting, because they show where the gap between requirements and implementation still exists.
CUI systems and compliance
GAO found DOD had approximately 2,900 CUI systems in its review and said that as of January 2022, none of the DOD components were fully compliant with the CUI cybersecurity requirements (GAO-22-105259).
GAO also reported that implementation of the selected CUI requirements ranged from 70% to 79% for the CMMC program and was over 90% for authorization of systems to operate as of January 2022 (GAO-22-105259).
That range matters. It suggests that some aspects of compliance were relatively advanced while others remained incomplete.
Why the CUI numbers are important
The CUI figures show three things at once:
- the scale of the environment is large,
- compliance is uneven,
- and full implementation has to span multiple requirements, not just one control area.
The dataset also notes that the DOD CIO issued CUI implementation guidance in October 2021 and that the deadline for all CUI systems to implement required controls was March 2022 (GAO-22-105259). Those dates reinforce the idea that implementation and oversight operate on a tight timeline.
Incident context
The same GAO source notes a 2015 phishing attack on the Joint Chiefs of Staff unclassified email servers caused an 11-day shutdown and affected roughly 4,000 military and civilian personnel (GAO-22-105259).
That one incident provides useful context for the rest of the data. It shows why the Department places so much emphasis on resilience, coordination, and cyber workforce depth.
How to read the latest defense cybersecurity statistics
Taken together, the numbers show a defense cybersecurity posture with four defining traits:
- It is strategic, because the DIB Cybersecurity Strategy aligns with several broader defense and national cybersecurity frameworks (DoD DIB Cybersecurity Strategy 2024).
- It is long-running, because the voluntary program dates to 2008 and contractor requirements date to 2013 (DoD DIB Cybersecurity Strategy 2024).
- It is operationally dense, because the support network includes thousands of partners, exchanges, and channels across industry, education, and standards bodies (NSA Cybersecurity Year in Review 2024).
- It is still incomplete, because workforce vacancies, partial compliance, and uneven funding all show remaining execution gaps (FY2024 Annual Performance Report for the DOD Strategic Management Plan; GAO-22-105259; DISA Cyber FY 2025 Budget Estimates).
A practical reading of these defense cybersecurity statistics is that the Department is managing a multi-year transition from baseline requirements toward a more connected, resilient, and measurable cyber posture. The strongest evidence in the dataset is not a single number. It is the way the numbers stack across policy, workforce, standards, partnerships, and oversight.