Acquisition Archetypes Seen in the Wild, DevSecOps Edition: Cross-Program Dependencies

This post examines problems that arise from a shared DevSecOps platform. Because a DevSecOps platform and tool pipeline is too complex and expensive to create and manage separately for each program, the platform often needs to be a shared capability. This situation creates dependencies and cooperation issues. These problems are examples of an acquisition archetype, which is how we refer to a pattern of organizational system behaviors that have been seen during the SEI’s experiences in conducting invited independent technical assessments (ITAs) on technical and programmatic aspects of the DoD acquisition programs. In these ITAs, program management office (PMO) staff, contractor staff, users, and other external stakeholder organizations provide open and candid responses under the condition of anonymity that provide the SEI team insight into what is truly happening in a program. These insights suggest that similar, recurring problems in software acquisition and development -- archetypes -- arise across separate and seemingly dissimilar programs. A previous SEI blog post examined an archetype of clinging to the old ways. In this post, I discuss the recurring problem of cross-program dependencies. I describe the behavior in the context of a real-world scenario and provide recommendations on recovering from and preventing future occurrences of this problem.