GDIT wins $1.3bn Guard cyber network contract

General Dynamics Information Technology has secured a $1.3 billion contract to operate, modernise, integrate, and defend Army National Guard enterprise networks, combining day-to-day IT support with cybersecurity, data, communications, and artificial-intelligence services.

The Enterprise Network Operations and Cybersecurity Support contract was awarded through the General Services Administration’s Assisted Acquisition Services organisation. It carries a one-year base period with six one-year options, creating a potential seven-year framework for work supporting the Guard and other federal government partners.

The scope includes classified and unclassified networks, new operations centres, workforce support, technology provisioning, on-site services, AI, data analytics, and communications. GDIT will therefore be responsible for more than maintaining an established network: the requirement combines operation with continued technical change.

That combination reflects the way military enterprise networks have evolved. Connectivity alone is no longer an adequate measure of performance. Systems have to remain available while security teams monitor vulnerabilities, compromised devices, identity activity, software weaknesses, configuration changes, and attempted intrusion across a distributed organisation.

Putting network operations and cyber defence inside the same contract can reduce the divide between the teams responsible for keeping services running and those responsible for securing them. Configuration changes intended to improve performance can introduce vulnerabilities, while security controls can disrupt legitimate operations if they are applied without enough understanding of the mission.

The Army National Guard presents a particularly broad operating environment. Units work from permanent facilities but also deploy for military operations, training, homeland missions, and support to civil authorities, creating changes in location, bandwidth, equipment, access requirements, and mission tempo.

Enterprise services therefore have to support users whose network conditions are not constant. A system designed around reliable fixed-site connectivity may perform poorly when the same personnel are operating from temporary locations or working through constrained communications during an emergency response.

Operations centres are intended to provide a more coherent view of that environment. Central teams can monitor service availability, network conditions, alerts, incidents, and performance across a distributed estate, but the value depends on whether information from numerous management and security tools can be correlated into something operators can act on.

Data quality becomes critical once artificial intelligence and analytics are introduced. Automated tools can help identify unusual behaviour, prioritise alerts, forecast equipment issues, classify support requests, or find patterns across network telemetry, but those outputs are only as useful as the asset inventories, logs, identities, and configuration data feeding them.

An incomplete inventory can leave security software looking for devices that no longer exist while missing equipment that has appeared on the network outside the approved process. Poorly normalised logs can produce large numbers of alerts without enough context to distinguish a genuine compromise from ordinary operational activity.

AI consequently does not remove the underlying engineering work. Identity systems, logging architecture, network segmentation, endpoint management, software baselines, configuration databases, communications infrastructure, and data governance all have to function reliably before automation can reduce operator workload.

The classified and unclassified environments add further constraints. Information cannot cross security domains simply because doing so would improve convenience or speed. Approved gateways, user identities, access rules, encryption, endpoint controls, and data-handling procedures have to preserve separation while still allowing authorised personnel to perform their missions.

Modernisation also has to account for legacy systems. Military networks rarely receive the luxury of a complete replacement on a single date because specialist applications, interfaces, and equipment can remain operational for years. New cloud services, communications tools, identity platforms, and cybersecurity technologies must therefore coexist with systems designed around earlier architectures.

Configuration management becomes the thread connecting those generations. Software versions, security patches, certificates, device settings, network policies, and access rules have to remain controlled across a large environment if modernisation is to improve resilience rather than create another collection of incompatible systems.

The seven-year contract structure gives GDIT room to treat that work as a continuing programme rather than a one-off migration. The technology used in 2033 will not match the environment present at award, so architecture and support processes have to accommodate repeated refreshes without forcing wholesale redesign every time a new platform or security requirement appears.

Cyber threats will change across the same period. Tools capable of detecting current intrusion methods can lose effectiveness as attackers alter their techniques, while legitimate network behaviour changes as the Guard introduces new applications and operating models. Monitoring and detection therefore need to evolve alongside the enterprise they protect.

The contract builds on GDIT’s existing Army support work, but its scale places enterprise resilience at the centre of the new requirement. The company is taking responsibility for operating networks while also changing the technologies, security controls, and data systems that sit underneath them.

The first test will be whether services remain stable during transition. The more important measure over the full contract will be whether the Guard gains an enterprise that is easier to understand, defend, and modify — rather than merely replacing one generation of network complexity with another.