The 10 recommendations found on the "cheat sheet" (page xv): Line of Effort A (Congress and OSD): Refactor statutes, regulations, and processes for software

The 10 recommendations found on the "cheat sheet" (page xv): Line of Effort A (Congress and OSD): Refactor statutes, regulations, and processes for software * [A1] Establish one or more new acquisition pathways for software that prioritize continuous integration and delivery of working software in a secure manner, with continuous oversight from automated analytics * [A2] Create a new appropriation category for software capability delivery that allows (relevant types of) software to be funded as a single budget item, with no separation between RDT&E, production, and sustainment Line of Effort B (OSD and Services): Create and maintain cross-program/cross-Service digital infrastructure * [B1] Establish and maintain digital infrastructure within each Service or Agency that enables rapid deployment of secure software to the field, and incentivize its use by contractors * [B2] Create, implement, support, and use fully automatable approaches to testing and evaluation (T&E), including security, that allow high-confidence distribution of software to the field on an iterative basis * [B3] Create a mechanism for Authorization to Operate (ATO) reciprocity within and between programs, Services, and other DoD agencies to enable sharing of software platforms, components, and infrastructure and rapid integration of capabilities across (hardware) platforms, (weapon) systems, and Services Line of Effort C (Services and OSD): Create new paths for digital talent (especially internal talent) * [C1] Create software development units in each Service consisting of military and civilian personnel who develop and deploy software to the field using DevSecOps practices * [C2] Expand the use of (specialized) training programs for CIOs, SAEs, PEOs, and PMs that provide (hands-on) insight into modern software development (e.g., Agile, DevOps, DevSecOps) and the authorities available to enable rapid acquisition of software Line of Effort D (DoD and industry): Change the practice of how software is procured and developed * [D1] Require access to source code, software frameworks, and development toolchains —- with appropriate IP rights —- for DoD-specific code, enabling full security testing and rebuilding of binaries from source * [D2] Make security a first-order consideration for all software-intensive systems, recognizing that security-at-the-perimeter is not enough * [D3] Shift from the use of rigid lists of requirements for software programs to a list of desired features and required interfaces/characteristics to avoid requirements creep, overly ambitious requirements, and program delays