Pentagon Audit Finds No Component Met Cyber Deadline

Inspector General review of six Department of War components found none completed all 37 Comply-to-Connect tasks by the September 2025 deadline.

Updated on Nov. 4, 2026 in Military Jobs

Isometric editorial illustration of a row of gray network-switch ports in a server rack, one port holding a loose, unmatched cable plug. — The Pentagon's Inspector General found that none of six audited military components completed all 37 network-security tasks due by September 30, 2025. AI Illustration. Upload story photo >

The Department of War Office of Inspector General released its Comply-to-Connect audit on Oct. 26, finding that none of six audited components finished all 37 tasks due by Sept. 30, 2025. Auditors covered the Army, Navy, USNORTHCOM, USTRANSCOM, DFAS, and the Defense Health Agency.

Why it matters

Comply-to-Connect is the Department of War's effort to bring devices under centralized network control, and the audit shows gaps persisting well past the deadline. For the United States, the findings raise questions about how consistently the military's networks are being secured.

The audit measured six components against 37 Comply-to-Connect tasks, with USNORTHCOM showing the largest gap at 33 outstanding tasks as of June. The DOW requested $3.3 billion for C2C and zero trust efforts from FY2021 through FY2025, but the report does not say how much of that has been spent on remaining work.

The players

Department of War Office of Inspector General

The internal watchdog of the Department of War that conducts audits and evaluations of the department's programs and operations.

USNORTHCOM

The United States Northern Command, which is responsible for homeland defense and military operations within North America.

USTRANSCOM

The United States Transportation Command, which provides global air, land, and sea transportation for the U.S. military.

Defense Health Agency

The Department of War agency that manages military health care delivery and medical services across the military services.

The details

Auditors connected a compliant but unauthorized laptop, phone, and USB drive to networks at five components during on-site testing. Tools at four components detected and interrogated those devices, while one component's tool did neither.

Sept. 30, 2025: Deadline for Steps 1-4 of the C2C implementation plan passed.
June: Outstanding task counts recorded for each component.
Oct. 26: DOW Inspector General released the audit report.
Nov. 30: USNORTHCOM expects to finish remaining installations.

Roadmap

The audit measures each component's progress against the Comply-to-Connect implementation plan's Steps 1-4 deadline of Sept. 30, 2025. Its findings show that the plan's schedule and actual network remediation have diverged across the department.

The outstanding tasks mean some military networks still operate outside the department's intended device controls past the deadline. Service members and civilian staff at affected components may see device and network changes as the remaining installations are completed through 2027.

The takeaway

Meeting cybersecurity deadlines across a large department depends on tracking each component's progress, not just setting the schedule. Readers following military technology or defense careers should watch whether the projected 2027 completion dates hold.

What happens next

USNORTHCOM expects to finish its remaining installations by Nov. 30, and USTRANSCOM expects to meet C2C requirements by June 2027. The Army plans to shift continental U.S. assets to the Army Global Unified Network by March 30, 2027.