Approved for public release, NGA-U-2023-02442
Foreword & Introduction

Letter from the Director

Team NGA,

Cybersecurity is a lifeline for NGA’s business and mission operations. Our nation 

relies on us to sustain GEOINT (Geospatial Intelligence) advantage and to be ready to 

respond to future challenges. Without a secure information technology ecosystem, the 

Agency’s ability to source, store, and disseminate GEOINT for our nation’s warfighters, 

policymakers, and intelligence professionals is jeopardized. Our adversaries know this 

and constantly try to penetrate our networks, attempting to degrade our capabilities 

and erode trust in the reliability of our products and services.

From performing basic cyber hygiene to deploying sophisticated deterrence to supply chain risk 

management, our focus is on thwarting adversaries’ efforts to deny us capability. As part of this collective 

enterprise-wide effort, we have an individual responsibility to be cyber defenders. Protecting our networks 

must be ingrained in the organizational mindset at all levels. Culture change is hard, but with training, best 

practices, and your cooperation it can become second nature.

The 2023 NGA Cybersecurity Strategy—in conjunction with the 2020 NGA Technology Strategy, NGA 

Data Strategy 2021, and the 2023 National Cybersecurity Strategy—will be fundamental to reaching our 

envisioned end state of delivery of GEOINT supremacy, accelerated effects, and decision advantage.

The Cybersecurity Strategy within these pages reinforces the tenets of the NGA Strategy and provides the 

framework for achieving five cybersecurity goals:

We keep our systems secure and mission operational when we all consider cybersecurity an essential part 

of our jobs.

VADM Frank D. Whitworth, USN

Director, NGA

Advance Access 1

Management

2 3 4 5 Deliver a 

Standardized, 

Secure 

Enterprise

Secure Data

as a Strategic 

Asset

Lead with

People

Evolve the 

Culture

2 | NGA Cybersecurity Strategy
Foreword & Introduction

Letter from the CISOs

NGA’s cybersecurity strategy is, first and foremost, 

a means of realizing the Agency’s GEOINT vision 

by keeping cyberspace safe and confronting 

various cyber threats to our missions. In addition, 

the strategy aims to ensure NGA is a leader in 

technological innovation and an active partner 

in shaping the cyber terrain. Alongside NGA’s 

Technology and Data Strategies, this document 

will act as the third foundational pillar to ensure 

NGA achieves its cyber vision and is positioned for mission success.

In publishing this strategy, we recognize that NGA cannot improve cybersecurity in isolation, and that 

partnerships with businesses and community groups will continue to be required if we are to achieve 

success. We will need collaboration from across the enterprise—from the Office of Contract Services to 

Financial Management, Research and Development, Data and Digital Innovation, and more.

This strategy is the conceptual and practical foundation for achieving our goals, designed to efficiently 

structure the Agency’s efforts and ensure a stable, long-term solution for the challenges arising in 

cyberspace. From performing basic cyber hygiene to deploying sophisticated deterrence, we will focus on 

raising the cost of mounting an attack against NGA and will hold aggressors at risk. With this strategy as 

our guide, we will now concentrate on the implementation plan for executing these fundamental goals.

NGA faces real and pervasive threats now. We must all embrace the individual responsibility to be cyber 

defenders if we are to succeed. Although it is crucial that we recognize our past accomplishments, we 

must reinvent our culture and approach to securing our greatest assets. This will not be easy. Our nation 

relies on us to defend NGA’s GEOINT advantage today while evolving to meet the challenges of tomorrow. 

This is our call to arms where, together, we will secure the way.

Gary Buchanan

Chief Information Security Officer, NGA

Monica Montgomery

Deputy Chief Information Security Officer for 

Management and Strategy, NGA

Mike Ryan

Deputy Chief Information Security Officer for 

Compliance and Operations, NGA

NGA Cybersecurity Strategy | 3
Foreword & Introduction

Executive Summary

In the last decade, NGA has seen tremendous growth in the GEOINT discipline and the number of 

practitioners in industry, in academia, and at all levels of government.

As the GEOINT ecosystem has grown, so have its adversaries—who are persistent, adaptive, and often 

anonymous in cyberspace. To meet these threats, NGA will require a synchronized, cross-Agency approach.

Together, we will mindfully shape our cybersecurity efforts and continue to show the way. To do this, we will:

Enhance our access management and cross-domain 

services. NGA will support the ongoing shift to data-centricity 

and aim to securely get the right information to the right people 

at the right time.

Deliver a GEOINT enterprise that is secure and designed to 

higher standards. NGA will distinguish itself through improved 

risk management, zero-trust principles, and advanced defense 

tools.

Employ data as a strategic asset for decision-making. NGA will 

strengthen our use of artificial intelligence (AI), machine learning (ML), 

and computer vision (CV) in cybersecurity to identify patterns and 

threats, provide continuous monitoring, and speed the operational 

effectiveness of our enterprise.

Strengthen operations through people-driven cybersecurity. To 

bolster our future cybersecurity, NGA will communicate more 

transparently and comprehensively about cybersecurity, focus 

on recruiting and retaining cyber-savvy talent, and commit to 

increased cyber training for our workforce.

Redefine the culture of cybersecurity. NGA must reinvent 

its perspective on cybersecurity. As one team, we must 

understand that cybersecurity is no longer an IT challenge, but 

an Agency-wide business problem that we will face together.

4 | NGA Cybersecurity Strategy
NGA Cybersecurity Strategy | 5
Key Goal 1 | Advance NGA’s Access Management

 Protect the people of NGA and our GEOINT enterprise by safeguarding critical infrastructure, 

workflows, and data through Federal Identity, Credential, and Access Management (FICAM).

 To achieve the goal of advancement within access management, NGA must focus on two 

fundamental topics: FICAM and Cross-Domain Services (CDS).

 Multi-factor authentication (MFA) and fine-grain access control (FGAC) are critical elements of 

FICAM and achieving this goal. MFA secures access and 

data by requiring multiple login credentials. FGAC further 

secures access by allowing only users with mission needs 

to retrieve specific data and use specific systems. These 

two elements will yield an improved level of overall security, 

limit risk, enhance attribution, and expand control between 

interrelated programs.

To further support the DoD shift to data-centricity, we 

will aim for improved location awareness for devices with 

access to NGA networks, such as laptops and mobile 

devices. In order to achieve greater governance and 

orchestration of a more secure operating environment and 

to facilitate data-driven decision-making, we must focus 

on location-specific services, enhanced machine identity 

management, and advanced data tagging.

 CDS is necessary to access or transfer data between 

multiple networks using different security classifications. It 

enables immediate and secure information-sharing with the 

right people at the right time, such as warfighters requiring 

GEOINT data to make real-time decisions. 

 The areas of emphasis for CDS include “Raise the Bar” 

(RTB) compliance and full governance. 

o RTB is a set of cybersecurity standards designed 

to protect National Security Systems (NSS) by 

improving security and capabilities from design, 

development, assessment, implementation, and use 

perspectives. 

o Full governance of CDS and data flows helps 

enhance decision-making, manage policy, and improve enterprise efficiency through 

standardized, enterprise-level practices that help specific operations succeed. 

 We are committed to working at the speed of mission, but it is critical to balance that speed with 

risk management.

6 | NGA Cybersecurity Strategy
Key Goal 2 | Deliver a Standardized, Secure Enterprise

 Leverage and enforce IC, DoD, and industry standards to create an improved security posture 

through secure enterprise architecture, risk management framework, zero trust, and computer 

network defense.

 A secure enterprise architecture is built on the inclusion of best practices in information technology 

(IT) security: from design to execution and, ultimately, decommissioning. We will start with the 

principles outlined in NGA’s Technology Strategy and realized 

within the NGA Common Operations Release Environment 

(CORE), as we are guided by the tenets of the NGA Software Way.

 Risk Management Framework (RMF)

RMF is a comprehensive, flexible, repeatable, and measurable 

process for organizations to manage information security and 

privacy risk for systems and organizations. It will provide NGA 

with continuous system and capability monitoring for timely 

notification and management of vulnerabilities, incidents, and 

potential threats. 

Early, vigorous adoption of cybersecurity within the acquisition 

and system development lifecycle (SDLC) will enable NGA to 

deliver authorization to operate (ATO) at the speed of mission. 

Throughout, we will maintain the critical balance between 

speed and the risk-based approach required for successful 

implementation of security principles. 

 Zero-Trust Architecture

Implementing a zero-trust architecture—a security model 

that acknowledges threats exist both inside and outside 

the traditional network boundary—is a strategic approach 

to securing an organization’s IT enterprise and digital user 

identities by removing the implicit trust between systems and 

users in favor of continuously reevaluating credentials at every 

digital interaction.

 Computer Network Defense (CND)

The CND cybersecurity methodology uses computer networks 

to protect, detect, and react against a variety of cyber threats, 

which provides NGA’s security architecture with multiple layers of defense. It also reduces our risk 

of attack or intrusion by aligning our technology components with the most effective policy, controls, 

and security management practices. This reduced risk yields lower costs for security integration, 

enhances identification and attribution of cyber perpetrators, and expands communication between 

interrelated programs and systems.

NGA Cybersecurity Strategy | 7
Key Goal 3 | Secure Data as a Strategic Asset

 Obtain and use trusted, relevant data to make proactive cyber decisions across the Agency 

through data-driven decision-making; include AI, ML, and CV in business workflows; and 

mitigate risk through continuous authorization and continuous monitoring (CONMON).

 Using data as a strategic asset starts with collecting the right data within the GEOINT pipeline. 

Using the principles of NGA’s Data Strategy, we can adapt our security posture to address evolving 

global threats.

 Data-Driven Decision-Making

Data-driven decision-making provides visibility into the enterprise by turning standardized, current 

security data into risk management insights that counter emerging threats and challenges. This 

process helps us identify security gaps through a comparison of risk vectors and supports informed 

security improvement plans across NGA. It also significantly improves visibility into business 

intelligence and how we can better incorporate unbiased data and program collaboration into the 

decision-making process.

 AI, ML, and CV Within Cybersecurity

Analyzing past and current enterprise security data will enable us to predictively identify trends, 

patterns, and threats. Over time, these adaptive security measures will also enable us to automate 

many decision-making processes.

Developing tools that integrate AI, ML, and CV into decision-making can help NGA manage large 

volumes of data and hasten our detection of and response to both routine and sophisticated multipoint threats. This will enable our workforce to engage in complex analysis more efficiently and 

improve the delivery of that analysis and other information to stakeholders.

 Continuous Authorization to Operate (cATO) and CONMON

After a system or software is authorized or approved for use, cATO provides continuous discovery 

and monitoring of risk and external threats to a security environment—effectively integrating 

automation within system monitoring. Used together, these strategies strengthen the RMF and 

other NSS controls, and promote an effective shift to a data-centric model for real-time analytics 

and threat response.

8 | NGA Cybersecurity Strategy
Key Goal 4 | Lead with People

 Strengthen people-driven cybersecurity through training that reinforces collaboration and 

advances the cybersecurity tradecraft.

 Through leading-edge workforce training, community collaboration events, and focused awareness 

of changing cyber issues and practices, we will usher in a future that advances cybersecurity 

work roles at NGA, heightens talent recruiting and retention, raises cybersecurity awareness, and 

supports DoD 8140 policy series, which provides guidance for redefining and managing the cyber 

workforce.

 Supplying relevant workforce training provides cybersecurity consistency for NGA and its partners, 

increases the knowledge and scope of cyber roles, and lays the foundation for future cyber 

initiatives.

 As we develop a new cadre of cyber professionals, NGA will focus on continually improving our 

cybersecurity practices and related tradecraft.

 In addition to strengthening the knowledge and capability of our workforce, we will provide them 

with the technology necessary to secure our GEOINT advantage.

 To socialize and emphasize the importance of the cyber mission throughout the workforce, our 

message must be:

o Understandable. We must clearly express how the cyber mission interacts across the 

enterprise in a manner that connects us all to GEOINT.

o Unified. NGA and our partners have a stake in GEOINT security; we must face cyber threats 

together. 

o Diversified. We must improve how NGA communicates and shares the cyber mission so we 

can better connect our people to what they need to know. 

o Prioritized. To protect our greatest assets—people, tradecraft, and data—security must be 

at the forefront of what we do. To be successful, we must reinforce operational security and 

better understand how to identify suspicious activity. 

o Ongoing. The threats we face are persistent—we must remain vigilant and work this problem 

together. 

NGA Cybersecurity Strategy | 9
Key Goal 5 | Evolve the Cybersecurity Culture

 Reach an Agency-wide understanding that cybersecurity is a shared responsibility, not simply 

an IT challenge.

 Cybersecurity is more than an IT challenge—it is a business problem that requires an Agency-level 

focus. End-user security awareness is not enough to reduce our cybersecurity risks. We must 

heighten cybersecurity accountability and situational awareness—from start to finish—and 

strengthen community collaboration and partnerships within the GEOINT ecosystem.

 Successfully integrating cyber-accountability into our business practices will provide incentives for 

and promote the adoption of cybersecurity best practices and standardize them throughout the 

Agency. Increased collaboration with the Office of Contract Services on cybersecurity projects will 

help integrate cyber requirements within the acquisition process from the start. Enhancing the 

incorporation of cybersecurity into contracts is integral to maintaining the security standards that 

we set across our contracts, the bidder’s library, and the entirety of NGA’s enterprise. We must give 

security and mission requirements equal weight. 

 The fight for a secure GEOINT enterprise cannot be won 

alone. We will collaborate more broadly with those who can 

help make a difference. Whether it is an Educational 

Partnership Agreement (EPA) that helps contribute to the 

curricula being taught to future cyber professionals or 

a Cooperative Research and Development Agreement 

(CRADA) to share hard problems and prepare for 

future acquisitions, our cyber efforts will expand 

the scope of collaboration.

 #SecureGEO is our initiative to lead 

the way in cybersecurity alongside the 

community and our partners. Expanded 

collaboration—such as CRADAs, EPAs, and 

Partnership Intermediary Agreements that 

we establish under our Title 15 authority—

will strengthen how we integrate our 

strategic partnerships into acquisition. 

Focusing on tailored engagements will 

help stimulate community participation 

by improving our understanding 

of how we can align our efforts 

with industry and academia to 

achieve common goals and will 

aid in the development of cyber 

professionals who understand 

the GEOINT mission.

10 | NGA Cybersecurity Strategy

Approved for public release, NGA-U-2023-02442