Katie Arrington speaks on Nov. 17 at CyberSat in Reston, Virginia. Photo: Access Intelligence

The Pentagon’s acting Chief Information Officer (CIO) Katie Arrington tasked space cyber professionals with pushing the boundaries and not falling into complacency in a Monday morning keynote address at CyberSat in Reston, Virginia. 

Arrington spoke Nov. 17 about a week after the Department of Defense’s long-awaited Cybersecurity Maturity Model Certification (CMMC) entered its enforcement phase on Nov. 10. CMMC assesses defense contractor compliance with existing information safeguarding requirements for federal contract information (FCI) and controlled unclassified information (CUI).

“We have the best military in the world. What we have is complacent people in cyber,” Arrington said. “CMMC finally came to life after seven years. I joke she’s a 48-pound baby, seven years in gestation. We did [CMMC] so that the basics got covered.”

Arrington had no patience for CMMC naysayers, saying that CMMC was needed because the defense industrial base wasn’t upholding the basics of cybersecurity. 

“CMMC is great. You need to do more. I only did that because you weren’t doing the basics,” Arrington said. “CMMC you may think is a pain in the butt — but if you guys did what you were supposed to do, the F-35 wouldn’t look like the J-20 flying in China right now. If you guys did what you were supposed to do and lock it down, the adversary wouldn’t be as far as they are.” 

She pushed for industry to “move at the speed of where risk lives and innovation thrives,” highlighting the example of SpaceX’s “fail early, fail often” culture.

Arrington’s message was about fighting complacency and going after boundary-pushing ideas, talking about how small ideas may cause a ripple effect and lead to a critical impact in space defense. 

“It can be making a workflow or process speed up a half a second faster,” Arrington said. “When you drop your pebble in the river, your ripple effect is so far out and out that seven years from now — when someone goes to launch a kinetic satellite that punches another bad satellite out of orbit, you speeding up a workflow on that processor was the eighth of the second that was needed that stopped the war.” 

More from CyberSat 2025: 

• • Multi-Orbit Networks Expand the Attack Surface, But Basic Cyber Threats Remain, Experts Say
  • NRO Establishes Space Cyber Program After Last Month’s Moonshine Guardian Exercise
  • DHS Wants Satellite Volunteers to Test New Cyber Tools