# DOW Audit Finds C2C Security Gaps

A Department of War Inspector General audit found that none of the six reviewed components had completed all 37 required Comply-to-Connect (C2C) tasks by the September 30, 2025 deadline, leaving device-security and zero-trust implementation gaps. The Department requested $3.3 billion for C2C and baseline zero-trust capabilities across FY2021–FY2025. The IG called for interim safeguards and independent verification of component progress; the audit identifies no solicitation or specific contract opportunity.

- The findings point to potential demand for interim device controls, C2C deployment support, compliance validation, and cybersecurity integration, but do not confirm that any of these services are being procured.
- Procurement teams can use the audit findings to assess component-level implementation and verification needs; contractors offering relevant capabilities should distinguish demonstrated C2C and zero-trust experience without presenting the audit as a pending opportunity.
- The September 30, 2025 completion deadline has passed. The IG said it will track recommendations until management actions are sufficient.

**Jurisdictions:** federal
**Industries:** Defense & Military
**Topics:** Cybersecurity
**Published:** November 04, 2026

### Government Entities
- Department of War (DOW)
- Department of War Office of Inspector General (DOW IG)
- Defense Health Agency (DHA)
- U.S. Northern Command (USNORTHCOM)
- U.S. Transportation Command (USTRANSCOM)

### Key Quotes
> We will track them until management agrees to take actions that we determine to be sufficient to meet the intent of the recommendations.
> — Karla Roark, Assistant Inspector General for Audit, Cyberspace Operations

### Sources
- [DOW IG Audit Finds Gaps in C2C Rollout](https://www.executivegov.com/articles/dow-ig-comply-to-connect-audit-zero-trust) - ExecutiveGov