By GAO made seven recommendations to help DoW (formerly DoD) carry out its software modernization strategy, and five were open as of GAO's August 2024 update. The ones on performance measures and data ask how DoW will show the reforms are working.
GAO's May 2025 letter, Chief Information Officer Open Recommendations: Department of Defense (opens in a new tab) (GAO-25-108211), lists 54 open recommendations to DoW (formerly DoD). One asks the department to take steps to carry out its planned software modernization and acquisition reforms.
The source is Software Acquisition: Additional Actions Needed to Help DOD Implement Future Modernization Efforts (opens in a new tab) (GAO-23-105611, April 2023). GAO found DoW had at least partially implemented all 17 Defense Science Board and Defense Innovation Board recommendations, but for 13 of the 17 it had yet to take certain actions. GAO then made seven recommendations of its own.
As of GAO's August 2024 update, five were open. They cover performance measures, the resources to lead the reforms, roles and responsibilities, data collection against the goals, and a software workforce plan. The two on implementation plans with milestones had closed. This brief takes the measurement recommendations, numbers 1 and 6, because they are the ones a contractor's delivery data can help answer.
DoW set the goal before the measures. In a February 1, 2022 memo, the Deputy Secretary of Defense approved the Software Modernization Strategy (opens in a new tab), and a steering group was to develop performance metrics against meaningful operational outcomes. Metrics, targets, and baselines are not specified in the document.
GAO's notes show how far that got. DoW's March 2023 implementation plan aligned some metrics with GAO's attributes of successful performance measures, but more were still in development, and GAO had asked for the metrics documentation. On data, DoW said it planned to collect and normalize metrics in its enterprise data platform and brief progress monthly to the Deputy Secretary. GAO had asked for that documentation too.
The programs hold the data. In IT Systems Annual Assessment: DOD Needs to Strengthen Software Metrics and Address Continued Cybersecurity and Reporting Gaps (opens in a new tab) (GAO-24-106912, July 2024), GAO reviewed 21 IT business programs planning $9.1 billion from FY 2022 through FY 2024. Four of the 10 programs developing software with Agile approaches did not use metrics and management tools DoW requires. That recommendation was open as of January 2025.
These recommendations go to the steering group of the DoW CIO and two Under Secretaries, not to contractors. They still decide what DoW asks of the software work it buys. The department's FY 2025 and 2026 implementation plan, as ExecutiveGov reported in May 2025 (opens in a new tab) in a non-GAO account, groups tasks under cloud, software factories, and speed with resilience, and again calls for measures of progress on adoption and impact.
That reaches software factory support, DevSecOps platform, and application modernization task orders at DoW components. An evaluator reading a technical volume looks for a baseline and a way to show change. An offeror who promises faster delivery without saying how it will be measured, from what data, and who owns the definition offers the gap GAO describes.
Recompetes sharpen it. An incoming team that baselines delivery in its first weeks gives the component a number to hold the next contract against.
The method below comes from Avalon's CI/CD Pipelines service, with baseline and decommission work drawn from its Application Modernization service. It is scoped as one assignment at a time with one to three pilot applications, on agency-furnished environments and licenses, for unclassified work.
Avalon builds the measurement. DoW's steering group sets the goals, assigns roles, and resources the reforms, and the workforce plan sits outside this work, as do cATO program design, security tool selection, and running the pipeline after handoff. The measures show progress; they do not guarantee it, and they are not an independent verification or an authorization.
GAO closed the two implementation-plan recommendations when DoW published plans with milestones and deliverables. For measures and data, GAO's notes say what it still wants to see: documentation of the metrics and of the processes that collect the data.
For GAO-24-106912, DoW's corrective action plan described reviewing its documentation and policies to find where Agile metrics and tools help most, and gathering data on how many programs use them.
Practical targets, written as targets:
As of GAO's August 2024 update, recommendations 1 and 3 of GAO-23-105611 were open and partially addressed, 2, 6, and 7 were open, and 4 and 5 were closed. The GAO-24-106912 metrics recommendation was open as of January 2025, with DoW estimating completion in September 2025. The May 2025 CIO letter lists the reform recommendations among DoW's open items.
| Field | Detail |
|---|---|
| NAICS | 541512, 541511 |
| Avalon's sub role | Delivery baseline and measure definitions, a pipeline-fed measurement dashboard, and application disposition and decommission plans under the prime's software factory, DevSecOps, or modernization task order, in unclassified environments |
| Small-business status | Small business; HUBZone (in progress) |
| Likely vehicles | GSA MAS (SIN 54151S IT Professional Services); GSA Alliant 3 |
If software factory, DevSecOps, or application modernization work at a DoW component is in your capture plan, Avalon teams as the sub that baselines delivery from the pipeline and turns it into measures the component can report.