Army Facility Systems Get Zero Trust Prototype

The four-month ICED-603 prototype tests whether control systems can be secured without replacing existing equipment.

Updated on Nov. 2, 2026 in Cybersecurity

Army Facility Systems Get Zero Trust Prototype

Live Poll

Should the government spend more on cybersecurity for critical infrastructure systems?

The U.S. Army has awarded RMC 2021 LLC an Other Transaction Agreement under the ICED-603 Phase 2 prototype effort to strengthen the cybersecurity of operational technology that runs facility systems. The award was made by Army Contracting Command at Aberdeen Proving Ground's Huachuca Division on behalf of Army Materiel Command, and the prototype is approximately four months long. This is a prototype-stage effort rather than a deployed production system.

Why it matters

The prototype targets facility-related control systems such as building automation and utilities, which are often hard to secure without replacing existing infrastructure. The stated aim is to reduce cyber risk while preserving operational continuity, and to produce remediation patterns reusable across other Army installations.

The award is documented as a prototype Other Transaction Agreement, a contracting vehicle that lets the government test new approaches without the full procurement rules of a standard contract. The source gives a duration of approximately four months but does not report a dollar value or measured security results.

The players

RMC 2021 LLC

RMC is a contractor holding the ICED-603 prototype award and serving as prime contractor on the effort.

Concurrent Technologies Corporation

Concurrent Technologies Corporation is the subcontractor supporting RMC on the ICED-603 award.

U.S. Army Contracting Command

Army Contracting Command, based at Aberdeen Proving Ground, awarded the agreement on behalf of Army Materiel Command.

The details

The effort combines mission-informed risk assessment and remediation with secure network segmentation, which divides a network into isolated zones so a breach in one area cannot spread freely. It also includes maintenance access controls, security monitoring, and an operational technology data integration layer, which collects data from industrial control equipment into a common system. The approach is described as vendor-agnostic and aligned with Zero Trust, a security model that verifies every access request rather than trusting users inside the network by default. The team will deliver Risk Management Framework evidence, the federal process for documenting security controls, along with training and transition support.

Prototype runs approximately four months, with no start or end dates stated in the source.

The Tech Race

The effort extends Zero Trust thinking from office IT networks into the control systems that run buildings and utilities, a harder area because those systems were often not designed with modern security in mind. Its emphasis on avoiding wholesale replacement of existing equipment positions it against approaches that would require new hardware across an installation.

The prototype is aimed at Army installations, so the near-term effect falls on military facilities rather than the public. Whether the reusable remediation patterns reach other Army sites depends on the outcome of the approximately four-month prototype and a possible follow-on production OTA, neither of which has a stated date.

The takeaway

Watch whether the Army exercises the follow-on production OTA option once the four-month prototype concludes, since that decision would show whether the remediation patterns move beyond a pilot. The source does not give that conclusion date, so confirmation will depend on a public award notice.