DSCA IT Standards - 2025 Update.pdf

INFORMATION MANAGEMENT & TECHNOLOGY

(IM&T) DIRECTORATE

IT STANDARDS

September 29, 2023

Latest Update: October 3, 2025

VERSION HISTORY

Version # Implemented

By

Revision

Date

Approved

By

Approval

Date

Reason

DRAFT • Brooks, Richard

• O’Brien, Kevin

• Morrison, Jory

• Hak, Brian

9/1/23

Release

Candidate

• Brooks, Richard

• Caruso, Sandra

• Dibble, James

• Dill, Josh

• Farling, Gary

• Lester, Gretchen

• Lubinsky, Kevin

• Lundell, Eric

• Miller, Trecia

• O'Brien, Kevin

• Patterson, Richard

• Pillai, Smitha

• Powers, Nick

• Sarcinelli, Nicole

• Shickler, George

• Shinn, Eric

• Wilson, John

• Wismer, Aaron

• Morrison, Jory

• Hak, Brian

9/29/23

OGC Review 10/20/23 OGC 10/20/23 Legal Review per

CATMS CATMS-

101023-2MT2

E&ARB

Review &

Endorsement

• Manish Amin

• Al’Tariq Samuels

• Larry Bainbridge

N/A E&ARB 11/3/23 Incorporated into

DSCA IT

governance process

Update • Brian Hak 8/29/25

Review • Brooks, Richard

• Caruso, Sandra

• Dill, Joshua

• Fairweather, Shawn

• Hak, Brian

• Lubinsky, Kevin

• Morrison, Jory

• O’Brien, Kevin

• Powers, Nicholas

• Reissman, Shelby

• Shinn, Eric

• Weaver, Andrew

10/3/25

• Wismer, Aaron

TABLE OF CONTENTS

1 Introduction

1.1 Executive Summary

1.2 Guiding Principles

1.3 Guidance To Industry

1.4 Policies and Procedures

1.5 Exceptions To Policy

1.6 DSCA IT Standard Definitions

1.7 User Interface/User Experience (UI/UX) Standards

1.8 Software Development Standards

1.9 DevSecOps Standards

1.10 COTS/SaaS/PaaS Platform Standards

1.12 Data Accessibility and Interface Standards

1.13 Infrastructure and Hosting Standards

1.14 Emerging Standards

1 INTRODUCTION

1.1 EXECUTIVE SUMMARY

The Defense Security Cooperation Agency (DSCA) Office of Business Operations (OBO)

Information Management and Technology (IM&T) Directorate manages the Agency’s IT systems across several portfolios that align to the DSCA lines of business. Historically, a program-centric model of IT management was employed, providing programs with broad latitude to use and seek funding for technologies and solutions they deemed best fit their requirements. While this approach served individual programs well, it contributed to a high degree of technical variance and the creation of technology/data silos, leading to:

• High Total Cost of Portfolio Ownership – Duplicative capabilities have been established at DSCA and across the IAs with no economies of scale or standardization able to be realized. This includes areas such as licensing negotiations with vendors, high acquisition overhead to maintain contracts and renewals, and a highly specialized workforce being required to maintain the many disparate technologies in the portfolio.

• Large Cyber Security Attack Surface – Many different Commercial Off The Shelf

(COTS) software stacks in use, all with unique cyber-attack surfaces, vendor support timelines, and vulnerability remediation procedures.

• Siloed Workforce – Difficult to move IT personnel across programs due to high degree of specialized technology and knowledge required on a program-by-program basis.

• Talent Management Challenges – Challenging to attract and retain highly skilled labor due to diverse and aged technologies in use across the portfolio.

• High Acquisition Overhead – Industry engagement is unique for each program in the IT portfolio.

More recently, DSCA has migrated to a portfolio and enterprise approach to IT management to address the challenges above. In 2023, IM&T established the Engineering and Architecture

Review Board (E&ARB) to augment the existing IT governance process. Chaired by the DSCA

Deputy CIO for Data, Security, and Technology (DST), the E&ARB was instituted to provide a technical review of incoming IT demands and develop recommended Courses Of Action (COAs) prior to review by the CIO, Portfolio Investment Review Board (PIRB) and/or Strategic

Investment Board (SIB). By developing technical COAs that align with enterprise IT direction prior to funding alignment, variance (and the associated challenges) will be reduced over time, leading to a more manageable portfolio of IT systems, and more responsive IT workforce.

The E&ARB requires a baseline set of IT standards to provide consistent, achievable, and practical technical recommendations to investment boards in order to ensure sound Agency technology investments. This document captures DSCA’s enterprise IT Standards, as incorporated into the Security Cooperation Enterprise Architecture to track technical compliance of DSCA software solutions across multiple dimensions (See Table 1).

Standard Dimension Explanation Benefit

User Interface/User

Experience (UI/UX)

Standardize the technology and look and feel of DSCA IT applications

• Consistent look and feel across DSCA IT Systems

• Re-usable UI components and starter templates to avoid starting new projects from scratch

• Reduction in IT variance

• Workforce skill standardization to increase IT personnel portability across programs and minimize talent acquisition overhead

• Provide clear direction and technical guardrails during industry engagement

• Improved compliance with

Section 508 direction for accessibility

Software

Development

Standardize the programming languages and frameworks used to build software

• Re-usable components and starter templates to avoid starting new projects from scratch

• Reduction in IT variance

• Workforce skill standardization to increase IT personnel portability across programs and minimize talent acquisition overhead

• Provide clear direction and technical guardrails during industry engagement

DevSecOps Automate and standardize the way software is built and deployed into use

• Automated compliance with

DoD cybersecurity policy

• Higher confidence in software quality through automated code testing and code quality scans

• Continuous Visibility Into

Software Quality, Security, and Functionality Measure

• Higher Deployment

Frequency, Lower Lead Time, and Lower Mean Time to

Recover

• Provide clear direction and technical guardrails during industry engagement

Data Accessibility and Interfaces

Ensure consistent, reliable approach for system-to-system data exchange

• Enable timely and Secure access to data directly from systems of record to appropriately authorized external systems

• Provide clear direction and technical guardrails during industry engagement

• Improved accuracy and confidence in data, enabling data-backed mission decisions

Commercial Off

The Shelf (COTS)

Software, Software as a Service (SaaS), and Platform as a

Service (PaaS)

Offerings

Define the COTS/SaaS/PaaS platforms of choice used at

DSCA, and a decision tree for use cases best fit for each

• Avoid duplicative

COTS/SaaS/PaaS investments

• Improve time to deliver by leveraging best-fit

COTS/SaaS/PaaS tooling

• Provide clear direction and technical guardrails during industry engagement

• Improved Return On

Investment (ROI) through reuse of a limited set of standard platforms and tools

Infrastructure and

Hosting

The platforms and infrastructure approach of choice for hosting DSCA systems

• Lower Operations and

Management (O&M) burden

• Provide clear direction and technical guardrails during industry engagement

1.2 GUIDING PRINCIPLES

DSCA’s mission is to advance U.S. defense and foreign policy interests by building the capacity of foreign partners to encourage and enable allies and partners to respond to shared challenges.

Information Technology (IT), notably, is not part of the core DSCA mission space. Rather, IT is a force multiplier enabling DSCA to better execute the Security Cooperation mission. As IT is not a core competency, DSCA endeavors to leverage fully-managed DoD and appropriately accredited industry solutions wherever possible to minimize the amount of in-house IT resources devoted to the operations and sustainment of commodity IT and maximize the use of in-house IT resources dedicated to delivering technology solutions that provide direct value to the Agency’s mission. In this vein, when considering new solutions and standards, if an approved Software as a Service (SaaS) solution can be used to meet a requirement, it should be. If SaaS is not practical, capability built on top of an enterprise Platform as a Service (PaaS) is preferred. If no fully-managed SaaS or PaaS can be utilized, custom software development and/or self-managed

Commercial Off The Shelf (COTS) software approaches can be considered. The IT standards outlined in this document provide direction across all architectural patterns outlined above to

DSCA-internal program offices and industry partners to use during the IT project planning cycle to ensure alignment with overall Agency enterprise IT direction and minimize the amount of variance found in the IT portfolio.

1.3 GUIDANCE TO INDUSTRY

The guidance provided in this document is designed to provide broad technical guidance to ensure consistency in approach to IT programs across the Agency and enable a smooth transition from active system development to sustainment - it is not intended to limit technical innovation proposed by industry by requiring compliance with fine-grained technical requirements. DSCA has strong preference for solutions proposed by industry that fall within the technical guardrails outlined in this document, comply with DOD directives, and are capable of fulfilling the intended mission needs. However, no proposals will be disqualified from consideration if they suggest an alternative approach. If a proposed solution does not align with standards herein, proposals should clearly document why the approach deviates from baseline standards and represents better total value to DSCA.

1.4 POLICIES AND PROCEDURES

This document is intended to be updated periodically. IM&T will perform review of the standards outlined above at least bi-annually to ensure they best align with our mission, allow for consideration of new and innovative technologies, and remain consistent with industry best practices. Following its initial release, changes to this document will be briefed to the E&ARB for concurrence and to IT program managers for the identification of any necessary actions required to bring systems into compliance. The standards may also require ad-hoc updates per

Federal / DoD guidance, cybersecurity issues, etc. In these cases, an ad-hoc review will be conducted to redefine and implement the affected standards.

1.5 EXCEPTIONS TO POLICY

The E&ARB is the governing body responsible for defining and maintaining DSCA IT standards. New IT demands and proposals will be evaluated for compliance with IT standards during the Solutions Analysis phase of the IM&T Intake to Prioritization (I2P) process. Requests for exception to policy are adjudicated by the E&ARB exception process. The E&ARB coordinator will provide guidance on preparation of your request to the E&ARB for consideration, and coordinate logistics to ensure a timely review of request. E&ARB recommendations are provided to the DSCA CIO, who holds the decision authority to approve or deny exception to policy requests, for final determination.

1.6 DSCA IT STANDARD DEFINITIONS

1.7 USER INTERFACE/USER EXPERIENCE (UI/UX) STANDARDS

Area Standard Additional Link

Front-End

Development

Language

TypeScript TypeScript shall be used in favor of

Javascript for strong typing and build-time validation

Front-End Web

Development

Framework

React Latest regular release. See

Emerging Standards.

React

Front-End

Component

Framework

Material UI (MUI), Material React

Table

Latest LTS MUI Core: Ready to use components, free forever, https://www.material-react-table.com/

Styling Approach Tailwind, Emotion and/or native CSS

Tailwind

Emotion

Accessibility

(a11y)/508

Compliance

Eslint-plugin-jsx-a11y, axe-core/react

JSX linter and axe-core/react modules don’t cover the entirety of 508 compliance, but shift feedback left to development time by providing developers information on potential compliance issues prior to build/deploy

GitHub - jsx-eslint/eslint-plugin-jsx-a11y: Static AST checker for a11y rules on JSX elements.

@axe-core/react -npm (npmjs.com)

Styling/Branding DSCA MUI Theme TBD https://react.dev/ https://mui.com/core/ https://mui.com/core/ https://mui.com/core/ https://www.material-react-table.com/ https://www.material-react-table.com/ https://tailwindcss.com/ https://github.com/emotion-js/emotion https://github.com/jsx-eslint/eslint-plugin-jsx-a11y https://github.com/jsx-eslint/eslint-plugin-jsx-a11y https://github.com/jsx-eslint/eslint-plugin-jsx-a11y https://github.com/jsx-eslint/eslint-plugin-jsx-a11y https://github.com/jsx-eslint/eslint-plugin-jsx-a11y https://github.com/jsx-eslint/eslint-plugin-jsx-a11y https://www.npmjs.com/package/@axe-core/react https://www.npmjs.com/package/@axe-core/react

Icon Library Material UI

Material Icon

Material Icons -

Material UI

(mui.com) https://mui.com/material-ui/material-icons/ https://mui.com/material-ui/material-icons/ https://mui.com/material-ui/material-icons/

1.8 SOFTWARE DEVELOPMENT STANDARDS

Area Standard Additional Link

Back-End

Development

Language

Java – For web applications

Node.js – For web applications

Python – For data, AI and web applications

Latest LTS

Back-End

Development

Framework

Spring/Spring Boot – For

Java web applications

Express – For Node applications

Flask – For Python applications

Latest LTS Spring Boot

Express

Flask

Package

Managers

Java – Maven

Node/Typescript – NPM

Python – pip

Latest LTS Maven –

Welcome to

Apache Maven npm (npmjs.com) pip · PyPI

Version

Control

Protocol

Git Preference for trunk-based development workflow https://spring.io/projects/spring-boot https://expressjs.com/ https://expressjs.com/ https://flask.palletsprojects.com/en/stable/ https://maven.apache.org/ https://maven.apache.org/ https://maven.apache.org/ https://www.npmjs.com/ https://pypi.org/project/pip/

Design

Methodology

Cloud Native/12-factor app design

Follow 12-factor app design principles to architect cloud native solutions

The Twelve-

Factor App

(12factor.net)

Coding Style Google Style Guide Enforce through IDE linter of choice

Google Style

Guides | styleguide

AI Copilot

Adoption

Various DSCA encourages maximum adoption of AI

Copilots throughout the software development lifecycle to improve productivity and velocity.

Ensure that the AI tooling you choose is appropriately accredited to process any data that you pass to it.

https://12factor.net/ https://12factor.net/ https://12factor.net/ https://google.github.io/styleguide/ https://google.github.io/styleguide/ https://google.github.io/styleguide/

1.9 DEVSECOPS STANDARDS

Area Standard Additional

DevSecOps

Toolkit

DISA Citadel Custom software will be built, tested, scanned through CI/CD pipelines built using the DISA Citadel software factory to comply with the DSCA DevSecOps KPIs.

DevSecOps KPIs DSCA DevSecOps KPI See Attachment A

Container

Runtime

OCI compliant container runtime

Layer on top of base images pulled from

DoD secure container repository, Iron

Bank

Container Images Distroless, Alpine,or

RHEL UBI from IronBank for in-house software.

When deploying a vendor-provided container image, utilizing the vendor-provided container image can be acceptable but requires coordination with cyber to assess the base image. Depending on the results of the assessment, hardening the base image or swapping the base image for a hardened substitute may be warranted.

Selected image should have: passing Risk

Assessment Score, passing Compliant

Acceptance Baseline Criteria, and a passing Findings Verified threshold.

Container images should be minimal in nature, ideally containing only components sufficient for runtime.

Whenever possible, containerized deployments (inside container) should not utilize root user.

When Distroless, Alpine, or RHEL UBI images are not suitable, select a container image with passing thresholds and of

RHEL distribution

1.10 COTS/SAAS/PAAS PLATFORM STANDARDS

Area Standard Additional

User Authentication/Authorization DISA DoD E-ICAM via OIDC/Oauth2 or

SAML

Utilize the DISA DoD

Enterprise ICAM service to manage Authn/Authz for all users. Non CAC/PIV holders should use ECAs

Collaboration Suite Microsoft Office

DoD365-J instance for all non-

DSCU/Regional Center activities

Backoffice Automation/BPM Microsoft Office

DoD365-J instance for all non-

DSCU/Regional Center activities

Content Management System Drupal Managed Drupal via Acquia

Cloud

Analytics and Business Intelligence ADVANA or

PowerBI

Analytics and Business

Intelligence requirements should be met through the use of the DoD ADVANA platform or Microsoft PowerBI

ITSM ServiceNow

Robotic Process Automation (RPA) Power Automate

Foundry Automate

UiPath

Internal to O365

Internal to Advana

Cross-platform, large-scale automations.

1.12 DATA ACCESSIBILITY AND INTERFACE STANDARDS

Area Standard Additional Link

API Architectural

Style

REST

API Specification OpenAPI 3.0 or 3.0.X -

Compatibility issues have been observed with API

Gateway support for

3.1+

Home - OpenAPI Initiative

(openapis.org)

API Standards DoD Enterprise APIs for

Data Sharing (EADS) https://dodcio.github.io/eads/ https://www.openapis.org/ https://www.openapis.org/ https://dodcio.github.io/eads/

1.13 INFRASTRUCTURE AND HOSTING STANDARDS

Area Standard Additional

Cloud Platforms Software Factory

1. DISA Citadel

Hosting Platform

• AWS Elastic

Container Service

(ECS)

• If product cannot be containerized, fallback to use AWS EC2

Multi-cloud approach. Utilize best fit enterprise DoD cloud platform.

DSCA has strong preference for the use of DoD enterprise

Software as a Service (SaaS) and Platform as a Service

(PaaS) solutions. If your program can be deployed on a

DoD enterprise approved

SaaS platform, do so.

If not, evaluate DoD PaaS offerings that provide fully managed infrastructure supporting both application hosting and DevSecOps tooling.

PaaS providers are listed in order of adoption preference.

Before committing to a platform, be cognizant of the technical guardrails and capabilities of target platform and ensure that your program can operate within those constraints.

If, and only if, your requirements cannot be met by a SaaS or PaaS solution, fallback to the use of an approved Infrastructure as a

Service (IaaS) provider.

Relational Database PostgreSQL Latest LTS, use fully managed cloud database instance

Document (NoSQL)

Database

MongoDB Latest LTS, use fully managed cloud database instance

Server Operating System Red Hat Linux Latest LTS, if unable to wrap deployment in container and require host OS

In the case of vendor-packaged software reliant or containing another OS, latest

CentOS and Ubuntu LTS are permitted.

In all cases, any relevant

STIG for the given OS should be applied.

In the absence of a STIG for the OS, Center for Internet

Security (CIS) Benchmarks are a suitable alternative for hardening.

Desktops, Domain

Controller Operating

System, and Edge Cases

Windows Use appropriately supported versions of Microsoft

Windows only for Domain

Controllers and

Virtual/Physical Desktops.

Windows will only be considered for other use cases as an option of last resort (i.e.

critical software runs on

Windows only).

1.14 EMERGING STANDARDS

DSCA IM&T is currently coordinating standards in the following areas and anticipates forthcoming additional guidance to be incorporated into this document.

Area Additional

API Gateway AWS API Gateway has been approved for use within DSCA and is currently being configured for enterprise deployment

Authorization Library(ies) While OAuth2 is an identified standard, additional standards must be defined to better support role and attribute-based authorization schemes for applications or API’s.

React: Build, Routing, Querying Technologies and

Patterns

Currently experimenting with Vite and Tanstack

Large Language Models

(LLMs)

The AI LLM landscape is rapidly changing within the DoD.

DSCA encourages the use of approved LLMS to increase productivity but cannot standardize on a specific set of models until the landscape within the department stabilizes.

AI model training AWS Sagemaker is currently being evaluated for use within

DSCA. The Agency will consider standardizing on Sagemaker after review of results from initial pilot project.

Learning Management

System (LMS) and Student

Information System (SIS)

DSCA IM&T will work in conjunction with DSCU to identify an enterprise LMS and SIS solution.