The Central Intelligence Agency has cut its technology acquisition timeline from nearly three years to six months, using a framework the agency says pairs centralized vendor vetting with a streamlined IT authorization process, according to the CIA's own announcement of the new acquisition framework. The agency has already used the new process to complete almost 400 tech procurements, according to Federal News Network's account of remarks CIA Director John Ratcliffe delivered at the AWS Summit in Washington in June 2026.

Ratcliffe described the change as a wholesale rework of how the agency buys technology, not a minor tweak. The old system paired roughly 24 months for onboarding a new technology with about nine months for security assessment, a combined 33-month slog that routinely left the CIA fielding gear that was already behind the commercial curve. "By that time, the technology has become outdated," Ratcliffe said, according to Federal News Network's account of the AWS Summit remarks.

Background

The CIA has spent years wrestling with an acquisition system built for an era when technology cycles moved in decades, not months. Legacy security assessment and onboarding processes were designed with caution as the top priority, appropriate for an agency handling classified systems and sensitive data, but the layered reviews created a bottleneck that commercial vendors increasingly could not tolerate. A startup with a six-month product cycle had little incentive to wait through a three-year federal onboarding process, and the CIA found itself locked out of the fastest-moving corners of AI, cloud and cybersecurity innovation.

The agency moved to address that gap in February 2026, when it rolled out a new acquisition framework explicitly aimed at what the CIA called turbocharging collaboration with the private sector, according to the CIA's own account of the launch. The framework Ratcliffe detailed at the AWS Summit in June builds directly on that February effort, adding organizational changes and a leadership hire to back up the faster timeline with structural changes rather than a one-time policy memo.

Key Details

The centerpiece of the overhaul is centralized vendor vetting paired with a streamlined IT authorization process, according to the CIA's account of the framework. Rather than routing every acquisition through the full 33-month sequence, the CIA now vets vendors once, centrally, and pushes buy authority down to officials closest to the requirement. "We've stripped away all of the cumbersome red tape; delegated down to the lowest possible level to ensure that those who are closest to the issues are the ones who are making the decision," Ratcliffe said, according to MeriTalk's account of his remarks.

That process has already produced results: nearly 400 technology acquisitions completed in the six months before the AWS Summit remarks, according to Federal News Network and MeriTalk. ExecutiveGov, citing the same remarks, reported the agency is targeting a six-month window for most enterprise acquisitions through centralized vetting.

The overhaul also reshuffled the CIA's org chart. The Directorate of Digital Innovation has been renamed the Directorate of Mission Systems, with a mandate focused on data, cybersecurity and infrastructure, according to ExecutiveGov's and Federal News Network's reporting on the milestones Ratcliffe outlined. The Center for Cyber Intelligence has been elevated to full mission-center status, giving cyber work the same standing as the agency's traditional operational mission centers. A new Office of Corporate Partnerships was also created as a single point of access for industry, replacing the fragmented entry points vendors previously navigated to reach the CIA.

Leading the effort is Efstathia Fragogiannis, who joined the CIA as Chief Procurement Executive in November 2025. Fragogiannis previously served as chief procurement executive at the Defense Advanced Research Projects Agency, and her hiring signals that the CIA's new framework draws on the high-tempo acquisition model DARPA has long used to move fast on emerging technology. Her arrival less than a year before the AWS Summit remarks suggests the agency recruited someone with a track record running a faster acquisition shop, rather than building that expertise internally. The priority technology areas cited in coverage of the framework include artificial intelligence, cybersecurity and advanced data infrastructure, according to Federal News Network's reporting.

The framework Ratcliffe described at the AWS Summit did not emerge in isolation. It follows a broader pattern across the intelligence and defense communities of leadership publicly complaining that legacy acquisition rules cannot keep pace with commercial AI and cloud development cycles, and then pointing to specific organizational and procedural changes as the fix rather than simply asking Congress for new authorities. The CIA's approach leans on delegation and centralized vetting instead of new statutory authority, meaning the changes described by Ratcliffe were implemented administratively and could, in principle, be reversed or adjusted without additional legislation.

What It Means for Contractors

For companies that have found the CIA's acquisition process too slow to justify pursuing, the shortened timeline changes the calculus. A vendor no longer has to weigh a three-year onboarding slog against the pace of its own product roadmap. Centralized vetting also means a company that clears the CIA's bar once may find subsequent acquisitions move faster, since it will not have to restart a full security assessment for every individual buy.

The creation of the Office of Corporate Partnerships gives industry a defined front door instead of an ad hoc network of contacts across directorates. Companies working in AI, cybersecurity and data infrastructure in particular should expect the agency to be a more active, faster-moving buyer than it has been, and should treat the DARPA-style tempo Fragogiannis is importing as the new baseline rather than an experiment. Firms that already do business with DARPA or have experience with its rapid prototyping and other transaction authority models may find their existing compliance and proposal muscle memory translates directly to the CIA's new process.

The renaming of the Directorate of Digital Innovation to the Directorate of Mission Systems, and the elevation of the Center for Cyber Intelligence, also signal where the agency expects to spend. Contractors in cybersecurity and data infrastructure should expect that mission center's elevated status to translate into a larger and more autonomous acquisition footprint. Vendors should also watch for whether the CIA publishes further detail on how centralized vendor vetting works in practice, since the specifics of that process, not just the headline six-month target, will determine how quickly a given company can actually get through the door.

Sources