Katie Arrington Returns to Pentagon as DoD CISO

The White House appointed a Trump ally and former Department of Defense cybersecurity official as DOD CISO, an unexpected return to the Pentagon for an official previously removed under a cloud of security concerns.

See Also: New Attacks. Skyrocketing Costs. The True Cost of a Security Breach.

Katie Arrington, who has experience at Booz Allen, Centuria Corporation and Dispersive Networks, announced her new role Tuesday on LinkedIn, as the administration’s cyber leadership begins taking shape across the federal government (see: Trump Taps Former RNC Executive for National Cyber Director).

Defense officials placed Arrington on administrative leave in May 2021, citing reports that she disclosed classified information. Arrington alleged in a lawsuit that her suspension was “designed to interfere with the cybersecurity activities that Arrington was running through DoD, which NSA did not support.” She also alleged that Biden political appointees at the Pentagon wanted to force her from her position “due to her close previous ties with President Trump.”

At the time, Arrington was as chief information security officer in DoD’s office of acquisition and sustainment and an advocate for the Cybersecurity Maturity Model Certification program, an effort to ensure that vendors implement minimum cybersecurity standards (see: DOD Unveils Final CMMC Rule for Defense Contractors).

Arrington settled in January 2022 a lawsuit accusing the government of denying her due process. A separate open records lawsuit from Arrington against the Defense Department is still open, with the parties pledging Feb. 4 to resolve their differences.

Arrington returns to the Pentagon just as newly ordered 8% defense budget cuts threaten to derail efforts to strengthen cyber defense standards.

Defense Secretary Pete Hegseth issued a Wednesday memo ordering senior leaders to draft the sweeping budget cuts by Feb. 24, the Washington Post reported, with exemptions for southern border defense and the modernization of nuclear weapons.

Arrington will likely focus on finalizing the defense acquisition regulation to formally implement the CMMC program – assuming she has the resources and personnel to make it happen, said Ashley Powers, former senior counsel in the contract law division at the CIA.

“Her ability to issue the DFARS rule and effectively implement the CMMC program could be significantly hampered if the administration starts cutting the federal employees necessary for the implementation and administration of that program,” said Powers, now an attorney at Miller and Chevalier. “If the administration starts cutting DOD employees involved with that program, the success or the value of the program is going to be significantly threatened, as will the country’s cyber and national security.”

Arrington has served as a one-term Republican state representative and launched an unsuccessful congressional bid against Rep. Nancy Mace, R-S.C., with Trump’s endorsement.

With civil service cuts and budget reductions, there’s a risk that cybersecurity efforts at the Pentagon could be deprioritized in favor of immediate operational needs, said Jean-Paul Bergeaux, vice president of federal strategy and CTO for GuidePoint Security. Arrington should champion the long-term security benefits of zero trust adoption, he said.

“While progress has been made, maintaining momentum and ensuring continued investment in zero trust initiatives will be critical,” Bergeaux told Information Security Media Group. Arrington’s “experience in cybersecurity policy and compliance may signal a renewed push for stronger cyber hygiene practices and industry collaboration to address emerging challenges.

The Defense Department did not immediately respond to a request for comment.

With reporting from Information Security Media Group’s David Perera in Washington, D.C.