Despite significant ongoing advancements in federal cybersecurity, data breaches continue to rise, posing a persistent challenge. The U.S. Government Accountability Office (GAO) reported a nearly 10 percent increase in cybersecurity incidents from 2022 to 2023–climbing from over 29,000 to more than 32,000. Traditionally, agencies have relied on a perimeter-based security model, often compared to a “castle and moat” defense, designed to keep external threats out. However, as modern cyberattacks are increasingly bypassing these barriers, targeting sensitive data directly, agencies are shifting toward a data-centric cybersecurity model.
The future of effective cybersecurity lies not in building higher walls, but in fundamentally rethinking how we protect information. Forward-thinking security strategies focus on securing data itself across organizational boundaries, allowing sensitive information to flow freely while maintaining security, control, and privacy. Aligned with Zero Trust principles, these data-centric controls empower agencies with the freedom to collaborate externally without compromising security, accelerating mission outcomes through secure, frictionless information exchange.
The Shortcomings of Perimeter-Centric Security
Government agencies operate in complex environments, handling highly classified and sensitive data. In this context, highly sensitive data must move securely between departments, allied nations, and mission partners. This is also true of systems and devices that handle this sensitive data: Cloud storage, endpoints, and data lakes must also be protected from unauthorized access. While perimeter-based security has been the standard framework for decades, it can create bottlenecks that hinder the seamless flow of mission-critical information. Jason Green, Vice President of Federal at Virtru, explained, “The defensive intelligence community faces challenges with cross-organizational and inter-agency information sharing, largely due to the outdated ‘castle and moat’ security model. These traditional, perimeter-based approaches create significant barriers to collaboration, especially when data needs to flow across boundaries.”
Recognizing these limitations, the Department of Defense (DoD) has made Zero Trust a cornerstone of its cybersecurity strategy. The DoD Zero Trust Strategy, released back in 2022, outlines a shift from network-based security to a data-centric model, where security is applied directly to data, regardless of location. It states, “Defending DoD networks with high-powered and ever-more sophisticated perimeter defenses is no longer sufficient for achieving cyber resiliency and securing our information enterprise.” By 2027, the DoD aims to implement a Zero Trust baseline, requiring continuous verification of users, devices, and data access. The goal is to continuously ensure that the people and systems gaining access to sensitive data can prove that they are, indeed, authorized to view that information.
The Zero Trust Data Framework
Progress toward Zero Trust is gradual but steady. In February 2025, Col. Gary Kipe, Chief of Staff of the DoD’s Zero Trust Portfolio Management Office, revealed that the department is 14 percent of the way to compliance. “Fourteen percent is a good start, but far from being done,” he noted. The most challenging aspects remain identity verification and data protection, two pillars addressed by data-centric security.
A key component of this approach is embedding access controls and classification markers directly within data objects. This ensures that only authorized personnel (based on roles, clearance, and mission needs) can access sensitive data. By securing data itself, rather than just the perimeter, agencies can eliminate barriers to collaboration.
Project Olympus is one initiative from the DoD that is a great example of leveraging Zero Trust to ensure security is embedded within data itself. Jim Knight, the U.K. lead for the project, stated, “We’re moving from not only securing our networks at the boundary, having high castle walls… but we’re also applying security and information sharing to individual data objects.”
To support this shift, frameworks like the Trusted Data Format (TDF) and the Zero Trust Data Format (ZTDF), provide a path forward. The ZTDF is an interoperable variation of TDF, designed to bridge the gap in data security and sharing between the U.S. Intelligence Community (IC), the DoD, and NATO member countries. These frameworks wrap sensitive data in a persistent security layer, ensuring encryption and access controls remain intact, regardless of where the data travels. The adoption of TDF-based security by the IC and other entities underscore the critical role of data-centric security in enabling secure international collaboration.
As new technologies like quantum computing emerge, they present fresh challenges to traditional encryption methods. While quantum computing poses a threat, it also drives innovation in cybersecurity, like post-quantum encryption algorithms. Green noted, “By implementing flexible, data-centric security frameworks like TDF and ZTDF, agencies can integrate post-quantum encryption standards in the future without disrupting existing security.”
Regulatory Compliance and Adaptability
Data-centric security also simplifies regulatory compliance. Agencies across government sectors adhere to different mandates, and implementing persistent encryption and access controls at the data level strengthens compliance with diverse security requirements. Green explained, “A data-centric approach streamlines compliance by addressing key controls. For example, the Trusted Data Format can help organizations meet CMMC Level 2 requirements, — representing a big step forward for defense contractors going into their CMMC assessments.”
Securing Data for Enhanced Protection and Collaboration
The need for secure, adaptable, and collaborative cybersecurity solutions has never been more critical for government agencies, and the shift from perimeter-based security to a data-centric model represents a fundamental rethinking of how sensitive information is protected in an era of evolving threats. By securing the data itself, everywhere it moves, agencies can enhance collaboration, fortify compliance, and prepare for the next generation of cyber challenges, including quantum computing. As government cybersecurity strategies evolve, the focus must remain on ensuring that data remains secure no matter where it goes, because in the modern digital landscape, it’s not about defending the castle, but securing the crown jewels.
Discover how data-centric security can transform security for the Department of Defense. Learn more here.