Strata Code Tech
Thought Leadership

Insights

Analysis, perspectives, and practical guidance from the Strata Code Tech team on the priorities shaping federal IT modernization, data strategy, and mission delivery.

Featured ArticleCybersecurity

Zero Trust Is Not a Product. It's a Mission Posture.

It was 2 a.m. when the alert fired. A lateral movement signature - quiet, methodical - the kind that doesn't trip perimeter alarms because it never touched the perimeter. The attacker was already inside, moving through a network that had been declared "secure" after a six-figure firewall purchase the year before. The agency's CISO told us afterward: "We bought Zero Trust. We just never built it." That distinction - between buying and building - is the most expensive mistake in federal cybersecurity today. Zero Trust is not a product you procure. It is not a checkbox on an authorization package. It is an architectural philosophy that demands you assume breach at every layer, verify every identity on every request, and enforce least-privilege access as a standing operating procedure, not a quarterly audit. CISA's Zero Trust Maturity Model and OMB M-22-09 have given agencies a clear mandate and a measurable framework. But the agencies making real progress are not the ones who bought the right tools - they are the ones who started with identity, mapped their data flows, and built enforcement into the architecture before they wrote a single procurement. For agency CIOs and program managers preparing their next IT investment, here is the honest truth: your network perimeter is already gone. The question is whether your architecture knows it yet.

Strata Code Tech Security PracticeSeptember 20265 min read
OMB M-22-09: Moving the U.S. Government Toward Zero Trust
IT Advisory
5 min readAugust 2026

Shared Services Are Not a Cost Play. They're a Capability Strategy.

The President's Management Agenda has made something clear that many agencies have resisted hearing: doing everything yourself is not a sign of mission strength, it is a sign of resource misallocation. The PMA's focus on shared services - through the Quality Service Management Office framework and the push toward governmentwide platforms for HR, finance, grants, and IT - is not about cutting budgets. It is about redirecting capacity. When an agency runs its own payroll system, its own travel platform, and its own grants management infrastructure, it is spending engineering hours, security resources, and leadership attention on commodity functions that have nothing to do with its core mission. Those are hours not spent on the work that only that agency can do. We have worked with agencies at every stage of shared services adoption. The ones who get it right treat the transition as a mission investment, not an IT project. They start by being honest about what is truly mission-differentiating and what is infrastructure. They build a transition roadmap that accounts for data migration, change management, and the workforce impact of moving off legacy systems. And they measure success not by the number of systems decommissioned, but by the mission capacity they freed up. The PMA has set the direction. The agencies that move deliberately and strategically will be the ones that emerge with more resources pointed at the work that matters.

President's Management Agenda: Shared Services
Cybersecurity
6 min readJuly 2026

The Security Posture Gap: Why Agencies Must Move from Compliance to Resilience

There is a version of federal cybersecurity that looks good on paper and fails in practice. It passes every FISMA audit. It has a current ATO. It checks every box on the NIST 800-53 control list. And it would not survive a determined adversary for seventy-two hours. Compliance and security are not the same thing, and the gap between them is where breaches happen. The threat landscape agencies face today - nation-state actors, ransomware groups targeting critical infrastructure, supply chain compromises that bypass perimeter controls entirely - was not the threat landscape FISMA was designed for. That does not mean compliance frameworks are useless. It means they are a floor, not a ceiling. The agencies building genuine resilience are doing three things differently. First, they are treating threat intelligence as an operational input, not a quarterly briefing. Second, they are running continuous monitoring programs that actually generate actionable findings, not just dashboard metrics. Third, they are investing in incident response capability before they need it - tabletop exercises, playbooks, and clear escalation paths that have been tested under pressure. The PMA's emphasis on strengthening the federal cyber workforce and accelerating Zero Trust implementation reflects a recognition that the compliance-first era is over. Agencies that treat security as a mission capability rather than a regulatory obligation are the ones that will be standing after the next major incident.

NIST SP 800-53: Security and Privacy Controls
Artificial Intelligence
5 min readJune 2026

AI That Advises vs. AI That Acts: The Line Federal Agencies Cannot Afford to Blur

There is a moment in every AI integration project where someone in the room asks the question that changes everything: "Can we just let it decide?" We have been in that room. The answer is almost never simple, and in a federal context, it carries weight that no commercial AI deployment ever will. The Biden administration's AI executive order and the subsequent OMB guidance on federal AI governance established a framework that is not bureaucratic language - it is an engineering specification. When you are integrating machine learning into a system that informs benefits determinations, resource allocation, or threat assessment, the difference between a model that advises a human and a model that acts autonomously is not a product feature. It is a legal and ethical boundary. The PMA's focus on responsible AI adoption reflects a hard-won lesson from early federal AI pilots: the agencies that deployed models without governance frameworks spent more time unwinding decisions than they saved in automation. The agencies getting AI right today started by defining the human-machine boundary precisely - who owns the decision, what data the model can access, how the recommendation is surfaced to the operator, and what the override mechanism looks like. They built the governance layer before they built the model. The technology is ready. The question for every agency is whether the accountability structure is ready too.

OMB M-24-10: Advancing Governance, Innovation, and Risk Management for Agency Use of AI
Data Strategy
5 min readMay 2026

Data as a Strategic Asset: What the Federal Data Strategy Actually Demands

The Federal Data Strategy's core premise is deceptively simple: data is a strategic asset, and agencies should manage it like one. The execution is anything but simple. Most agencies have spent decades accumulating data in siloed systems, inconsistent formats, and undocumented schemas. The data exists. The ability to use it - to query across it, trust it, share it with mission partners, or feed it into an analytics platform - often does not. The Federal Data Strategy's 40 practices and 20 action steps are not aspirational language. They are a diagnostic framework. When we work with agencies on data strategy, we use them as a gap analysis tool: where is the agency today against each practice, and what is the minimum viable investment to close the gap that is blocking the most mission value? The agencies making real progress are not trying to implement all 40 practices simultaneously. They are identifying the two or three data capabilities that would most directly accelerate a mission priority - faster reporting, better resource allocation, more accurate program evaluation - and building toward those outcomes first. The strategy is the map. The mission is the destination. Start with the destination.

Federal Data Strategy: 2020 Action Plan
Workforce
6 min readApril 2026

The Workforce Behind the Modernization: Why Technology Transformation Fails Without People Strategy

Every failed federal IT modernization we have studied has a technology story and a people story. The technology story gets written up in the GAO report. The people story is what the program manager tells you off the record. The system worked. The workforce did not adopt it. The training was inadequate. The change management plan was a PowerPoint. The subject matter experts who knew the legacy system retired before the transition was complete. The PMA's focus on workforce development and the Federal Workforce Priorities Report both reflect a recognition that the human capital dimension of modernization is not a soft consideration - it is a hard dependency. You cannot automate a process your workforce does not understand. You cannot migrate to a new platform if the people who run the mission do not trust it. You cannot sustain a modernized system if you do not have the technical talent to operate and evolve it. The agencies getting workforce strategy right are treating it as a parallel workstream to the technology program, not a downstream activity. They are mapping the skills the modernized environment will require, identifying the gaps against their current workforce, and building a plan that combines training, hiring, and strategic use of contractors to bridge the transition. The technology is the easy part. Build the people strategy first.

OPM Federal Workforce Priorities Report