What has moved, and what has not
Software buying at the Department of War (DoD) has changed faster over the past twelve months than the instructions that govern it. The portfolio acquisition executive is now a role written into title 10. The Software Acquisition Pathway is the preferred route for software, and commercial solutions openings and other transactions are the default way to solicit under it. Meanwhile, the pathway's own operating instruction still carries its 2020 date, the money has not fully followed the organization chart, and the next defense authorization bill is unfinished.
Each of those statements carries a different risk once it is written into an acquisition strategy, so the table sorts law from policy from proposal. One note on names: newer issuances say Department of War and the statutes still say Department of Defense, so this article uses both the way the documents do.
| Item | Status today | Where it lives |
|---|---|---|
| Portfolio acquisition executive (PAE) | Law | 10 U.S.C. 1732, added by section 1802 of the FY2026 NDAA (P.L. 119-60, December 18, 2025) |
| Software pathway | Law, with policy on top | 10 U.S.C. 3603; DoDI 5000.87 (October 2, 2020); DoWI 8430.01 (September 8, 2026) |
| Commercial solutions openings | Law, widened in December 2025 | 10 U.S.C. 3458, amended by section 1823 |
| Consumption-based buying | Law, with a DFARS change directed | 10 U.S.C. 3605, added by section 1825 |
| CSOs and OTs as the default for pathway software | Policy | March 6, 2025 memo; DoWI 8430.01, paragraph 3.8 |
| Contracting officers reporting to PAEs; capability trade councils | Policy | November 7, 2025 memo |
| PAE transfer authority, default government purpose rights, software lifecycle funding language | Proposed, not law | H.R. 8800, sections 833, 861 and 1521, passed by the House; the FY2027 NDAA is not enacted |
| CMMC Phase 2 | Suspended since July 13, 2026 | Department of War memoranda; see the CMMC section below |
What the November 2025 memo directed
On November 7, 2025, the Secretary of War signed "Transforming the Defense Acquisition System into the Warfighting Acquisition System to Accelerate Fielding of Urgently Needed Capabilities to Our Warriors." The Acquisition Transformation Strategy came attached to it and was posted publicly on November 10. The memo redesignated the Defense Acquisition System as the Warfighting Acquisition System, effective immediately.
Its central move was to establish PAEs by transforming and reorganizing the existing program executive offices. Each component had 30 days to nominate initial portfolios and 60 days to submit a complete transformation plan moving all major acquisition activities into PAE portfolios within two years. Read plainly, that window closes around November 2027. The chain of authority runs from the Defense Acquisition Executive to the service acquisition executives to the PAEs, and the structure must preserve the service acquisition executives' statutory authority.
The memo makes the PAE the single accountable official for portfolio outcomes, with authority to do four things that matter to a software buyer:
- Structure programs as schedule-driven capability increments and trade cost, schedule and performance in favor of time to field.
- Run capability trade councils, which replace configuration steering boards, make requirement trades and waive technical standards and certification requirements not mandated by statute or safety.
- Maximize modular open system architectures by obtaining critical system interfaces with government purpose rights.
- Have contracting officers report directly to the PAE in the acquisition chain of command.
The memo also set later clocks: commercial-first guidance within 90 days, updates to the 5000-series instructions and the DFARS within 150 days, and portfolio scorecards within 180 days, measured on time from validated need to operational capability. The paper has arrived unevenly. The commercial-first implementation memo is dated September 8, 2026, the Guidebook for Acquiring Commercial-First followed in October, and Change 2 to DoDI 5000.02, effective April 8, 2026, describes itself as administrative.
What Congress put into law, and what it left out
The FY2026 NDAA turned the role into statute. Section 1802 added 10 U.S.C. 1732, which defines a PAE as the senior acquisition official designated to lead a portfolio of capabilities, "with authority for plans, budgets, and execution of programs assigned to the portfolio, including life-cycle management." Program managers report directly to the PAE unless the component or service acquisition executive directs otherwise, and each PAE reports to that executive.
Three parts of section 1732 matter most to a program office. The PAE must use iterative development cycles, with authority to modify or terminate capabilities that no longer match a requirement or that show significant cost growth, deficiencies or delay. The PAE must prioritize, to the maximum extent practical, prototype transactions under section 4022 and commercial products and services. And contracting, cost estimating and other staff must be assigned to the PAE, with matrixed or dual-reporting arrangements allowed only by written authorization of the Secretary concerned.
Section 1823 rewrote the CSO authority in 10 U.S.C. 3458 to cover commercial products, commercial services and nondevelopmental items, selected through a general solicitation and a peer, technical or operational review, and it added follow-on production. Section 1825 created 10 U.S.C. 3605, which lets the department buy services metered and billed on actual usage at fixed-price units, and directs a matching DFARS change. Section 1833 created the BOOST program, under which PAEs, program managers and product support managers can ask the Defense Innovation Unit for help finding and integrating commercial technology. It runs through December 31, 2030.
Analysts of the final bill report that many SPEED Act and FoRGED Act provisions survived in reduced form and that more disruptive ideas fell away, capstone requirements among them. The FY2027 NDAA is the next round. The House passed H.R. 8800 by 216-212, while a Senate cloture vote on taking up S. 4784 failed 50-46 on July 14. The House bill would let PAEs transfer up to 10 percent of RDT&E authorized for a fiscal year to move other transaction prototypes into production (section 833), make government purpose rights the default for delivered software and technical data unless a contractor proves otherwise (section 861), and state that O&M, procurement and RDT&E funds may be used at each stage of a software capability's lifecycle (section 1521). The Senate bill would hold back part of the Under Secretary's travel funds until the department reports progress on the software pathway and on CSOs and OTs as the default (section 802). Plan around none of these until they are enacted.
How each service is carrying it out
The services are at different stages, and names keep changing, so confirm your portfolio assignment before relying on anything below.
| Service | Structure | Latest documented change |
|---|---|---|
| Army | Six PAEs, consolidating 12 program executive offices, with requirements, resources and acquisition authority aligned under the PAE | October 2026: capability portfolio executives moved alongside the PAEs and were renamed program manager executives, so program managers no longer report through them |
| Navy and Marine Corps | Nine PAEs: Robotic and Autonomous Systems (December 2025); Industrial Operations, Marine Corps, Maritime, Strategic Systems Programs and Undersea (March 2026); Aviation, Mission Systems and Munitions (May 11, 2026) | Each has direct authority over program offices and related technical, contracting and sustainment functions; the March PAEs each carry a Rapid Capability Cell. Many leaders are interim |
| Air Force | First five PAEs announced January 8, 2026; Secretary Meink's stated goal is about 18 | Meink said in February he expected full implementation within 18 months at the longest, and has described delegating most contracting authority to PAE chiefs of contracts |
| Space Force | Nine mission-area PAEs | Final three set in a June 22, 2026 memo; PAEs report directly to the service acquisition executive |
Across all four, decisions that sat in separate offices are moving under one accountable person, whose portfolio view now decides whether a software capability is reused, merged or stopped.
The software rules now in force
The March 6, 2025 memo, "Directing Modern Software Acquisition to Maximize Lethality," told all components to adopt the Software Acquisition Pathway as the preferred pathway for all software development components of business and weapon system programs. It also directed CSOs and OTs as the default solicitation and award approaches under the pathway, with two limits people often drop: the effort must meet the threshold requirements of 10 U.S.C. 3458 or 4022, and the direction applies to pathway programs in the planning phase before execution.
DoW Instruction 8430.01, "Accelerated Mission Software," effective September 8, 2026, carries this into a standing issuance. It says acquisition programs "will use the software acquisition pathway as the preferred pathway for all DoW software acquisition," that CSOs and OTs "are the default solicitation approaches for this pathway," and that sufficient intellectual property and data rights are required for long-term operation, maintenance, modification and cybersecurity. It applies to acquisition and non-acquisition programs regardless of dollar value, and it excludes software developed under Budget Activities 1 through 4 until that software moves into acquisition or operational use.
The day-to-day mechanics still come from DoDI 5000.87, which sets the working numbers: viability demonstrated within one year after funds are first obligated, new capability delivered at least annually, and value assessments at least annually after fielding. To enter the execution phase, a program needs an approved capability needs statement, user agreement, acquisition strategy, test strategy and cost estimate.
Software Fast Track and the new evidence bar
Software Fast Track (SWFT) began with an April 2025 DoD CIO memo, "Accelerating Secure Software," which opened a 90-day sprint to build a faster way to authorize software, with third-party assessment and software bills of materials at its center. The CIO's office published a summary of more than 400 industry responses in December 2025, and by early 2026 trade press described SWFT as moving from a sprint toward a permanent program.
DoWI 8430.01 does not use the name SWFT, but it now sets the evidence bar a contract should anticipate. Read SWFT as the direction of travel and the instruction as the rule that binds. Components must ensure an accurate software bill of materials for covered software. Software platforms and factories must share machine-readable evidence that supports continuous authorization, and authorizing officials are told to accept that evidence for reciprocity. Contracts must give the government access to business value, value stream and team-level metrics from contractor and subcontractor environments.
Two AI rules belong in every statement of work. AI-generated code counts as unverified input, and security-critical or safety-critical changes need human review and approval at a minimum. Non-public department information, code and documentation included, may not go into generative AI services unless they reside on DoW information systems and are approved for use.
CMMC: Phase 2 is suspended
Phase 2 was due to start on November 10, 2026. On July 13, 2026, the department suspended it, along with pending and future CMMC milestones, and gave a CMMC Reform Task Force 60 days to deliver recommendations to the CIO. As of late October the report had not been published, and no replacement date had been announced.
Phase 1 self-assessment requirements remain in place, along with SPRS status and DFARS 252.204-7012 obligations under NIST SP 800-171 Rev. 2. Do not write a third-party certification requirement while the suspension holds. The department said existing contracts carrying Phase 2 or Phase 3 requirements will have them removed by modification.
Portfolio funding is the unfinished piece
The law gives a PAE authority over plans and budgets, and the memo told the department to pursue budget line item and reprogramming reform within portfolios. Congress has moved more cautiously. For FY2026, the Army asked for about $2.4 billion in agile funding authority to move money among its drone, counter-drone and electronic warfare portfolios. Appropriators declined and discouraged similar requests, while approving more than a dozen budget line consolidations. The Army has since said it is pursuing consolidation for command and control lines in FY2027.
Consolidation is the path that has worked so far. Build a software funding profile line by line, know which lines could merge, and do not assume money can move across portfolios mid-year. FY2027 adds a timing problem. The government is operating under a continuing resolution through December 11, 2026 (P.L. 119-103), at FY2026 levels, and continuing resolutions generally do not allow new starts. An effort that needs a new line should have its acquisition package ready and its fallback plain.
What this means for a program office
Write requirements at the level a PAE can trade
A capability needs statement that lists features gives the capability trade council nothing to work with. State the mission outcome, the users and the measures, and let the backlog carry the detail. The Joint Capabilities Integration and Development System has been disestablished, so check with your PAE which process now validates your need.
Treat delivery and value as the reporting system
Portfolio scorecards are built around time to capability, and DoWI 8430.01 tells programs to measure user value and the flow of work from funding through deployment. Put both in the contract from the start: release cadence, usage and satisfaction measures, pipeline metrics and government access to them. Give the value assessment a sponsor and a date, and tie options to its result.
Structure the commercial solutions opening around section 3458
Start with what you are buying. Section 3458 reaches commercial products, commercial services and nondevelopmental items, implemented at DFARS 212.70. If the work is new development, a prototype OT under section 4022 is usually the cleaner route, and counsel should confirm the basis either way.
Building a software CSO
Three drafting points save time later. Awards under section 3458 must be fixed-price, including fixed-price incentive, so price the work in increments or capacity. State the follow-on path in the solicitation, because the statute now allows a follow-on production contract, subject to section 3204(e) approval for a sole source, or a follow-on production OT. And negotiate data rights and license terms for commercial software early; DoWI 8430.01 requires enough rights to sustain the software, and the Commercial-First Guidebook tells buyers to review license terms and decide whether more is needed. If usage is the honest unit of value, as with cloud, read section 3605 and check whether its DFARS change has been issued.
Other transactions are now a routine way to buy. DoD's report to Congress counts 7,409 OT actions in FY2024, up from 1,702 in FY2019, with $18.03 billion obligated in FY2024. GAO's September 2025 review reports the same rise, from $1.8 billion in FY2016 to more than $18 billion in FY2024.
For OTs, the Guide to Prototype Other Transactions issued October 14, 2026 changes the drafting. It reads "significant extent" as any unique contribution material to the prototype, prefers fixed-amount milestone payments, and expects follow-on production planning in every prototype OT, with successful-completion criteria written into the agreement. The statute still requires a section 4022(d) condition, such as significant nontraditional participation or a one-third cost share, and approvals still apply above $100 million and $500 million.
Bring in small businesses and SBIR Phase III
Portfolios can squeeze out small firms if every need is bundled into one large vehicle. Modular competition is the counterweight: buy critical interfaces with government purpose rights, as the memo directs, so a small business can compete for one module. Section 4022(d) also rewards small business and nontraditional participation directly.
SBIR authority lapsed on September 30, 2025, and P.L. 119-83, signed April 13, 2026, extended it through September 30, 2031. Phase III covers work that derives from, extends or completes an earlier SBIR effort, paid for with non-SBIR money. Under 15 U.S.C. 638(r)(4), agencies are to issue such awards "without further justification" to the greatest extent practicable, sole source included. The new law adds Phase III training for contracting staff and calls for simplified procedures and standard clauses. A PAE reviewing its portfolio should ask which Phase II efforts already meet a portfolio need.
Dates to plan around
| Date | Event | Effect on a software buy |
|---|---|---|
| November 7, 2025 | Warfighting Acquisition System memo | PAEs directed; two-year transition begins |
| December 18, 2025 | FY2026 NDAA enacted | Section 1732, amended section 3458, new section 3605 |
| July 13, 2026 | CMMC Phase 2 suspended | The November 10, 2026 start no longer applies |
| September 8, 2026 | DoWI 8430.01 effective | Evidence, metrics and AI rules enter contracts |
| October 14, 2026 | Prototype OT Guide issued | New drafting expectations for OTs |
| December 11, 2026 | Continuing resolution ends | Next FY2027 funding decision point |
| April 2027 | One-year deadline for SBA's directive change under P.L. 119-83 | Watch for revised Phase III guidance |
| Around November 2027 | Two-year PAE transition window closes | All major acquisition activities in portfolios |
What to do in the next 90 days
- Confirm your portfolio. Get in writing which PAE owns your effort, who your contracting officer now reports to, and who approves your acquisition strategy.
- Inventory your software. List each effort's pathway, funding lines, authorization status and last value assessment, and mark it as commercial, nondevelopmental or new development.
- Check artifacts for execution. Confirm the capability needs statement, user agreement and strategies are approved and current.
- Update templates. Add software bill of materials, build evidence, metric access, AI use and data rights language under DoWI 8430.01, and follow-on production planning and completion criteria under the October OT Guide.
- Fix cyber language. Keep self-assessment and SPRS terms, and remove any leftover third-party certification requirement.
- Prepare for the continuing resolution. Identify new starts and what each effort does if funding slips past December 11.
- Search your own SBIR portfolio. List Phase II efforts that match a portfolio need, and ask your contracting office about Phase III.
- Watch the FY2027 NDAA. PAE transfer, data rights and software funding sections would change your plan if enacted.
Frequently asked questions
No. Section 1732 gives the PAE authority for plans, budgets and execution across a portfolio, with dedicated personnel, and the November 2025 memo adds requirement trades through capability trade councils and direct reporting by contracting officers.
It is the preferred pathway for all DoW software acquisition under DoWI 8430.01, and the instruction applies regardless of dollar value. Preferred is not the same as exclusive. The instruction also provides an exception-to-policy process, and embedded software follows its host system's schedule under DoDI 5000.87.
Section 3458 covers commercial products, commercial services and nondevelopmental items. Tailoring or integrating a commercial product may fit, depending on the facts. New development usually fits better as a prototype other transaction under section 4022. Have counsel confirm the authority before release.
Not while Phase 2 is suspended. Self-assessment, SPRS status and DFARS 252.204-7012 obligations remain in force. Check the latest DoW CIO announcement before release, because the task force's recommendations could change the program.
The portfolio changes who decides. The Phase III test stays the same: the work must derive from, extend or complete an earlier SBIR effort and use non-SBIR funds, and 15 U.S.C. 638(r)(4) allows sole source awards.