In September 2026, GAO reported that 6 of 18 DoW IT business programs had not developed zero trust plans for DOD's 2027 deadline. GAO's count was 4 of 24 a year earlier. No new recommendation covers the gap, so primes face it as a bid question.
On September 28, 2026, GAO published IT Systems Annual Assessment: DOD Should Improve IT Fraud Risk Management Practices (opens in a new tab) (GAO-26-108596), its yearly review of DoW (formerly DoD) IT business programs. Twelve of the 18 programs reported implementing zero trust architecture as part of their security framework. Six had not developed plans to implement zero trust in their cybersecurity frameworks by DOD's 2027 deadline.
A year earlier, GAO-25-107649 (opens in a new tab) put the same gap at 4 of 24 programs, with 20 of 24 reporting implementation. GAO reviewed 24 programs then and 18 now, so the two counts are not a trend line.
Neither report makes a new recommendation on zero trust. In June 2025 GAO said it would continue to monitor the department's progress in developing zero trust plans. The 2026 report's one new recommendation covers fraud risk training, and GAO reiterated six earlier recommendations that remain unimplemented.
GAO's text does not say why programs lack plans, and this brief won't guess. The record does show how the requirement is stacked.
As GAO describes it, a May 2021 executive order told agencies, DoW included, to develop a zero trust plan. The FY 2022 NDAA then directed DOD to produce a strategy, a model architecture, and implementation plans (opens in a new tab). According to the DoD Office of Inspector General (DODIG-2025-090), a non-GAO source, the DoD Zero Trust Strategy (opens in a new tab) sets a target level for each capability by the end of FY 2027, and that review of component plans is the subject of a separate Avalon brief.
The units differ. The OIG reviewed component-level plans, 11 of 45. GAO's questionnaire went to individual business programs, such as financial management, logistics, health care, and contracting systems, which sit inside those components. Whether a component's plan covers a given program's boundary is a question GAO's count doesn't answer.
The counts also come from program offices' own answers. "Reported implementing" and "has a plan" are different measures, and neither shows what a system enforces today.
Program-level IT work at DoW, whether sustainment, modernization, or a cyber support task order for a business system, now carries a deadline that GAO counts program by program. FY 2027 ends September 30, 2027, so a task order awarded early in the year has months, not years, to show progress.
Expect a technical volume on this work to be read for three things. A stated boundary comes first: which system, which enclave, and which outside capabilities it relies on. Next is a plan tied to named target-level activities, with dates. Last, evaluators want to see how the offeror will show enforcement rather than ownership.
A prime that offers only "we will implement zero trust" gives the evaluator nothing to score. A prime that brings a dated plan for the program's boundary answers the exact question GAO keeps asking.
The method below comes from Avalon's Zero Trust Architecture Implementation service, in its assessment and roadmap shape. It describes how the work is done, at the methodology level, for unclassified environments.
Avalon designs and documents. It does not validate target-level achievement, certify zero trust maturity, or issue authorizations. Those belong to the Department's own assessment process.
GAO has not defined closure for zero trust plans because it made no new recommendation on them. These are targets, not GAO criteria.
A later GAO count showing no program without a plan would be the visible sign.
GAO made no new recommendation on zero trust plans and said in June 2025 it would keep monitoring. As of GAO's last update, September 2026, the new recommendation in GAO-26-108596, on fraud risk training, is open. Six earlier recommendations are reiterated as not yet implemented.
| Field | Detail |
|---|---|
| NAICS | 541512 |
| Avalon's sub role | Program-level zero trust baseline against the DoW target-level activities, NIST SP 800-207 target architecture, and a dated implementation roadmap with an activity-to-evidence matrix under the prime's IT or cyber task order, in unclassified environments |
| Small-business status | Small business; HUBZone (in progress) |
| Likely vehicles | GSA MAS (SIN 54151HACS Highly Adaptive Cybersecurity Services); GSA MAS (SIN 54151S IT Professional Services); GSA OASIS+ |
If DoW business-system work is in your capture plan, Avalon teams as the sub that baselines the program's boundary against the target-level activities and turns it into a dated zero trust plan the evaluator can score.
