The U.S. Marine Corps is widely known for its precision and talent to adapt on the battlefield. However behind the IT scenes, one other battle was happening in opposition to outdated IT techniques that made it more durable to serve Marines and their households.
That’s the place Marine Corps Group Companies took command. The group is the division throughout the USMC accountable for packages that enhance Marine high quality of life, from youngster care and household counseling to health facilities, retail shops, and eating services.
But, MCCS was slowed down by sluggish IT processes. Approvals for brand spanking new techniques—referred to as authorizations to function (ATOs)—might take years and price greater than $1 million per system. These roadblocks made it tough to maintain tempo with fashionable wants.
“With IT service supply, there are various constraints that create very lengthy cycle occasions,” says David Raley, digital program supervisor at MCCS. “It might take 5 years for a functionality to be obtainable due to ‘waterfall’ practices and legacy compliance round safety.”
That frustration set the stage for Operation StormBreaker, a groundbreaking initiative that used DevOps and agile growth practices to redefine how IT techniques are developed, examined for safety, and authorised.
Operation Stormbreaker rethinks the event playbook
By 2023, MCCS had run out of endurance with the inflexible, sequential waterfall growth, and determined to construct Operation Stormbreaker round DevOps and agile practices that depend on automation, brief iterations, and fixed suggestions.
Raley and his staff started by making a Marine Corps–approved touchdown zone in Amazon Net Companies, permitting safety controls to be inherited throughout a number of techniques. They then paired that basis with the Division of the Navy’s RAISE (speedy assess and incorporate software program engineering) platform, which applies agile and DevSecOps practices to embed safety all through the software program lifecycle. With added steerage from exterior companions RegScale and Raven Options, MCCS drastically minimize down ATO approval occasions.
“With these instruments and companions, we had been in a position to construct an agile ATO course of and a CI/CD pipeline to custom-build, safe, and deploy techniques a lot faster,” Raley defined.
The impression was instant. Fairly than treating IT techniques like tanks—bought as soon as, then maintained for many years—Raley and his staff might now consistently push software program updates by a pipeline that routinely checked for safety compliance in actual time.
Tech companies made safer and environment friendly by Operation StormBreaker, embody:
- All Marine Corps web sites
- Content material supply system
- Occasion administration and appointment reserving techniques
- E-commerce and level of sale techniques
- Human sources system
The problem of tech innovation in a forms
The largest barrier throughout Operation Stormbreaker, in line with Raley, was the bureaucratic nature of working inside the federal government.
MCCS confronted what Raley known as the “frozen center,” an online of disconnected gatekeepers and systemic inertia that slowed innovation. Consequently, Raley was persistently up in opposition to lengthy delays which might be all too frequent with conventional authorization processes that depend upon huge batches of safety checks.
To push previous these limits, Operation StormBreaker separated work into “batch sizes of 1,” validating every safety management step-by-step as an alternative of ready till the top. This new course of, whereas very efficient, was a tradition shock for groups accustomed to linear, project-based work.
“We had to assist groups perceive the distinction between being a waterfall mission group and a product-based staff tradition,” says Raley. “Now, we ship in two-week sprints, concentrate on minimal viable merchandise, and deal with each system as a dwelling, respiration product that evolves.”
Equally vital was constructing belief throughout departments. Operation StormBreaker introduced collectively compliance officers, cybersecurity leaders, and acquisition employees. With persistence and transparency, Raley and staff helped flip skeptics into collaborators.
Rising pace, strengthening safety, saving cash
Since launching in 2023, Operation StormBreaker has dramatically decreased ATO occasions and minimize thousands and thousands of {dollars} in wasted prices.
“The sport-changer for MCCS is we will now ship software program functionality and get an ATO in someday as an alternative of 18 months,” says Raley.
“Whenever you’re doing growth with a CI/CD pipeline, the RAISE course of has a designation to substantiate that the workload is assembly [Department of Defense] safety necessities. This may be achieved in quarter-hour by automation. So, that bottleneck of ready 18 months to get the ATO is gone as a result of we get authorization whereas we’re constructing.”
Moreover, by shifting cybersecurity “to the left,” builders now get instantaneous suggestions, studying to code securely from the beginning. That method has considerably decreased safety vulnerabilities in addition to approval occasions.
When it comes to monetary impression, every system authorised by the brand new DevOps and agile growth course of saves MCCS about $1 million per ATO, says Raley. In two years, this system eradicated greater than $10 million in delay-related prices.
Operationally, Marines and their households now expertise extra user-friendly digital companies. One of many first wins of the mission was consolidating facility web sites throughout 17 Marine Corps installations. Earlier than StormBreaker, every facility had its personal web site, making it complicated for Marines transferring from one station to a different.
“Now they’ve a unified expertise,” Raley stated. “It’s simpler to search out info, navigate web sites, and, most significantly, these websites now all meet DoD safety necessities.”
For its Operation Stormbreaker mission, MCCS earned a 2025 CSO Award. The award honors safety initiatives that exhibit excellent thought management and enterprise worth.
Breaking the mildew: Classes from Operation StormBreaker
For public-sector CIOs and safety leaders, Operation StormBreaker gives a basic case for find out how to modernize IT companies with out sacrificing safety.
Listed here are three classes Raley discovered throughout the mission:
Rethink how you concentrate on danger
Too usually in authorities, compliance danger overshadows mission danger. Raley urges leaders to assume past checkboxes.
“Whenever you concentrate on simply the compliance aspect, the mission or enterprise final result finally ends up serving compliance,” he says. “However that’s not the purpose of compliance. Compliance exists to make sure the mission and safety dangers are being thought-about. It shouldn’t overshadow the precise enterprise outcomes you’re attempting to realize.”
Don’t settle for ‘no’ at face worth
Bureaucracies are likely to default to warning, however Raley stresses that progress requires persistence.
“I’m usually advised ‘no’ to my IT mission requests, however there isn’t an actual cause apart from saying ‘no’ is the least dangerous choice. So I’ve needed to press by and ask, ‘Why is that this a no? What’s the challenge? Is that this one thing we will overcome?’”
Perceive that pace and safety can co-exist
Shifting sooner doesn’t imply slicing corners. Actually, Raley argues, pace makes techniques safer.
“There’s a misnomer that being sluggish and methodical results in higher safety, however there doesn’t need to be a trade-off between safety and pace,” he says.
“With DevOps and agile growth, we run workloads by a CI/CD pipeline each night time. If a brand new vulnerability pops up, we kill it instantly. The method is repeatedly monitoring and displaying a real-time view of your safety posture. It’s proof you possibly can transfer sooner and be safer.”
From bottlenecks to agile breakthroughs
Operation StormBreaker is an IT success story—nevertheless it additionally validates that cultural shifts are attainable in a forms. By tearing down silos and embracing DevOps and agile growth, MCCS has proven that even entrenched authorities procedures might be reinvented.
And the timing couldn’t be higher. With 14,000 staff and $1.2 billion in income supporting Marines and their households, MCCS now has the instruments to ship companies on the pace of contemporary life.
“This course of permits us to deploy capabilities orders of magnitude sooner, at a fraction of the associated fee,” Raley stated. “On the finish of the day, that’s the true worth of Operation StormBreaker.”
Modernizing IT at Mission Velocity
The Marine Corps’ Operation StormBreaker proves that even essentially the most entrenched bureaucracies can ship sooner, safer digital companies. Uncover how different CSO Award winners are driving innovation and management—register for the CSO Convention & Awards in the present day → CSO Convention & Awards
