Senior DOD officials back Cybercom 2.0, as Cyber Force debate continues to churn

Advocates of creating an independent U.S. military service focused on cyber argue that the Pentagon’s new force generation model isn’t a sufficient solution for fixing the department’s problems. During a congressional hearing this week, senior officials said their revised model is still needed regardless of whether a decision is ultimately made to create a Cyber Force.

The new model, rolled out in November under the “Cybercom 2.0” initiative, aims to modernize the way the Defense Department builds and develops digital forces and talent, including by more closely linking U.S. Cyber Command with the military departments to recruit, assess, select, train and retain the nation’s digital warriors.

“For many years, the department has recognized that our approach to building and sustaining cyber talent was not keeping pace. Our adversaries are investing heavily in cyber, while we have been constrained by traditional force generation models, which, while effective for conventional forces, fail to fully address the unique requirements of cyberspace operations. This has created significant challenges in recruiting the right people, retaining our best operators and providing the agile, specialized training needed to win,” Katie Sutton, assistant secretary of defense for cyber policy and the principal cyber advisor to Secretary of Defense Pete Hegseth, told members of the Senate Armed Services Subcommittee on Cybersecurity.

She continued: “Our legacy force generation model is inconsistent, hindering our ability to adapt at speed and scale to counter threats like Volt Typhoon and Salt Typhoon and quickly integrate emerging technologies like artificial intelligence to address these systematic challenges head-on.”

Core attributes of the new model, according to Sutton, include targeted talent acquisition; incentives for recruiting and retention; tailored and agile training; tailored assignment management; specialized mission sets; integrated headquarters and combat support; and “optimized unit phasing” to prevent burnout and sustain readiness.

At Wednesday’s hearing, Sutton was asked for her response to calls for creating an independent Cyber Force.

“I think this is a really important debate for us all to be having about the future of the cyber warfighting domain. I do think one of the most common misconceptions about Cyber Command is that it’s a debate between Cyber Command 2.0 and a Cyber Force. And they’re actually separate debates that I believe both need to be had, and we need to look closely at the pros and cons of both,” she told senators.

Sutton previously served as chief technology advisor to the commander of Cybercom and as the organization’s director of Pentagon operations.

“As Cyber Command has become operational, we’ve built a set of very capable cyber operators. Now we need to do that at scale and have a system that supports that, rather than doing it on an ad hoc method. And so Cyber Command 2.0 is really that talent management model. And we’ve been very careful as we’ve built that model, that it’s agnostic to the organizational model and that it would support both the current model that where five services present, as well as other organizational models, such as the establishment of a Cyber Force,” she said.

Sutton continued: “We need to make sure that we’re quickly moving ahead with Cyber Command 2.0. We have a lot of work done, and it’s required regardless of what model we have. We have to build the talent, and so that’s our immediate focus is working on all of these fundamental activities that we’re going to need going forward that would enable any future decisions to be made about an organizational change.”

Traditionally, the military services — including the Army, Navy, Marines, Air Force and Space Force — are responsible for manning, training and equipping their units and presenting them to combatant commands — such as Cyber Command — that are responsible for employing them in operations.

Some experts, including personnel at Cybercom, have argued that a new cyber-centric service isn’t needed, while others have called it a strategic necessity.

At Wednesday’s hearing, Army Lt. Gen. William Hartman, the acting head of Cybercom and the National Security Agency, didn’t directly weigh in on whether creating such a service would be beneficial for DOD’s enterprise in the long run. However, he suggested that moving forward with Cybercom 2.0 will enable the department to more quickly bolster its cadres of digital warriors.

“Cybercom 2.0 is certainly important, regardless of any future decision [about a Cyber Force]. I do believe when we did the analysis for Cybercom 2.0, the timeline was fundamentally important, right? And so we did view this through a 2027 lens, we viewed it through a resourcing lens. And through that lens, Cybercom 2.0 provided us the best opportunity in order to build the force that we needed on a 2027 timeline. And I think that’s important,” Hartman told senators at Wednesday’s hearing.

He emphasized the importance of joint force integration from a combatant commander’s perspective.

“The second piece is, I fundamentally believe the ability to integrate across the joint force is best suited to the model that we are developing here in Cybercom 2.0,” Hartman said. “Our ability to integrate, not just left of conflict, but during a conflict, in all phases of the operation, just like any other traditional military capability, is absolutely essential to our delivering the capability that the nation needs. And I think Cybercom 2.0 is really the best course to do that.”

It’s unclear exactly how long it would take to establish a new Cyber Force.

Retired Rear Adm. Mark Montgomery, senior director of the Foundation for Defense of Democracies’ Center on Cyber and Technology Innovation and former executive director of the congressionally mandated Cyberspace Solarium Commission, has estimated that a new cyber service could reach initial operating capability in 12 to 18 months, although fully building it out would be a years-long process. Montgomery is an advocate for that type of effort.

Army Lt. Gen. Joshua Rudd, President Donald Trump’s nominee to be the next commander of Cybercom and NSA director, suggested that he’ll take a wait-and-see approach before weighing in on whether a Cyber Force is needed.

“We need to give them time to work,” Rudd said in his written responses to senators’ questions about “service-like” authorities for Cybercom and enhanced budget control, ahead of his confirmation hearing earlier this month. “Before considering a major reorganization like creating a new service, I would want to understand the results of the ongoing studies mandated by Congress and work with this committee to determine the best path forward for the force.”

In an interview with DefenseScoop in November, shortly after the new force generation model was rolled out, Montgomery suggested that time is of the essence for the Trump administration to decide.

“This is a significant change … to create a Cyber Force,” he noted. “They need consistent, single administration leadership for at least two and preferably three years. So they’ve got to make this decision, I think, in the next six months so they can implement it over three years.”

Congress would need to approve the creation of a new military service. During Trump’s first term, he was able to obtain lawmakers’ approval to establish the Space Force. It remains to be seen how things would play out if he proposes standing up a Cyber Force during his second term.

In November, a senior Pentagon official told DefenseScoop on condition of anonymity that the revised force generation model will preserve “decision space” for the president and lawmakers regarding potential moves toward establishing a Cyber Force.