# Integrated Defensive Cyberspace System (IDCS) Development

**R-2A activity** of project 677824 — Integrated Defensive Cyberspace System  
**Program element:** 0208088F — AF Defensive Cyberspace Operations  
**Component:** U.S. Air Force · **Budget Activity:** 7  
**Vintage:** President's Budget PB2027  
**Canonical URL:** https://hitchintel.com/programs/0208088F/677824/a0  
**Parent:** https://hitchintel.com/programs/0208088F/677824

## Summary

This activity requests $76.8M in FY2027, 100% of project 677824, down 8.7% on FY2026. The R-2A exhibit describes it across FY2026–FY2027, including what the FY2027 money is planned to buy.

## What the FY2027 request buys

**FY2027 planned work.** • Will continue to develop and execute a phased integration of identified DCO systems into the IDCS ecosystem, prioritizing systems with the highest operational impact and lowest integration complexity. • Will continue to develop, test, and deploy cloud-based threat hunting and deception capabilities within the IDCS environment, including the implementation of honeypots, decoy systems, and automated threat intelligence feeds. • Will continue to research and assess interfaces and data exchange requirements for full integration with ABMS/JCWA. Will develop, test, and implement necessary interface adapters and data transformation processes. • Will continue to develop, test, and implement an advanced analytics platform within the Integrated Defensive Cyberspace System (IDCS) environment, capable of processing and analyzing large volumes of data to identify trends, patterns, and anomalies. Will deploy initial analytics dashboards. • Will continue to develop and deploy a federated query mechanism that allows users to query data across all endpoint Local Tactical Access Controller (LTAC) instances, while maintaining data security and access control. • Will continue to develop, test, and implement decentralized data retention that allows tactical edge platforms to retain critical Defensive Cyberspace Operations (DCO) data locally, ensuring continued operations in disconnected or degraded network environments. • Will continue to develop, configure, and integration test a DCO System Integration Lab environment. • Will continue to develop and implement automated Continuous Integration/Continuous Deployment (CI/CD) pipelines for IDCS, enabling the rapid deployment of 95% of patches and security updates, minimizing operational disruption and increasing system cyber readiness. • Will continue to integrate and exercise Development, Security, and Operations (DevSecOps) framework across the cyber test squadrons, including automated security testing and vulnerability management.

**FY2026 to FY2027 change.** The decrease from FY2026 to FY2027 is due to acceleration of autonomous recovery requirements in FY2026, completion of Firestarter requirements, and re-phasing of DCO requirements to align with DAF cyber priorities.

## Before the request year

**FY2026 plans — current year.** • Develop and execute a phased integration of identified Defensive Cyberspace Operations systems into the IDCS ecosystem, prioritizing systems with the highest operational impact and lowest integration complexity. • Develop, test, and deploy cloud-based threat hunting and deception capabilities within the IDCS environment, including the implementation of honeypots, decoy systems, and automated threat intelligence feeds. • Research and assess interfaces and data exchange requirements for full integration with Air Battle Management System/Joint Cyber Warfighting Architecture (ABMS/JCWA). Will develop, test, and implement necessary interface adapters and data transformation processes. • Develop, test, and implement an advanced analytics platform within the Integrated Defensive Cyberspace System (IDCS) environment, capable of processing and analyzing large volumes of data to identify trends, patterns, and anomalies. Will deploy initial analytics dashboards. • Develop and deploy a federated query mechanism that allows users to query data across all endpoint Local Tactical Access Controller (LTAC) instances, while maintaining data security and access control. • Develop, test, and implement decentralized data retention that allows tactical edge platforms to retain critical Defensive Cyberspace Operations (DCO) data locally, ensuring continued operations in disconnected or degraded network environments. • Develop, configure, and integration test a DCO System Integration Lab environment. • Develop and implement automated Continuous Integration/Continuous Deployment (CI/CD) pipelines for IDCS, enabling the rapid deployment of 95% of patches and security updates, minimizing operational disruption and increasing system cyber readiness. • Integrate and exercise Development, Security, and Operations (DevSecOps) framework across the cyber test squadrons, including automated security testing and vulnerability management.

## Funding

| Fiscal Year | Estimate Type | Amount ($M) |
|---|---|---|
| FY2025 | Actual | 75.3 |
| FY2026 | Enacted | 84.0 |
| FY2027 | Request | 76.8 |

> Prior, current and budget year only — an R-2A activity carries no five-year plan. It sums exactly into its project in the request year and not necessarily in any other.

## Source & machine access

- **Source:** FY2027 Department of the Air Force RDT&E Budget Justification, Exhibit R-2A, PE 0208088F project 677824 (PB PB2027). Narrative is the government's own text.
- **No marks, no contractors at this grain** — congressional marks land on the program element and R-3 performers on the project.
- **MCP:** `mcp.hitchintel.com` — `budget_get_activity`.

*HitchAI is an independent intelligence service, not affiliated with the U.S. Department of Defense. Budget figures are requests/estimates, not obligations.*