Comply-to-Connect: Build the Foundation for Zero Trust with F5
The U.S. Department of Defense (DoD) has taken a significant step toward securing one of the world’s most expansive and sensitive networks, the Department of Defense Information Network (DoDIN), through its Comply-to-Connect (C2C) framework. DoDIN spans over 15,000 unclassified, classified, and cloud-based environments and faces close to 800 million cybersecurity incidents daily. C2C is a foundational initiative within the DoD’s zero trust journey, designed to ensure comprehensive visibility and protection of all assets—traditional and non-traditional—connected to its vast network.
By enforcing principles of zero trust, such as least privilege access, C2C identifies, authenticates, and assesses all devices and users while automating security functions like remediation and continuous monitoring. With C2C, DoD aims to transition away from checkbox-driven readiness toward a sustainable, automated approach to cybersecurity. As reflected in improved cyber readiness inspection scores and operational efficiency gains across military bases, C2C is already making a meaningful impact.
C2C isn’t just a framework—it’s a transformative shift in how the DoD defends its critical infrastructure. With cyber threats escalating globally and the increasing complexity of managing access in hybrid environments, C2C matters now more than ever. It lays the groundwork for smarter, more effective security measures aligned with zero trust principles.
Challenges with Comply-to-Connect
As the DoD works to implement C2C, it faces numerous challenges. One pressing obstacle is the sheer scale and complexity of the DoDIN. Managing security across such an extensive enterprise network requires advanced tools capable of monitoring, automating, and securing a broad range of devices and systems—including industrial control systems, logistics platforms, and operational technologies.
Another major challenge is the rise in access-related breaches, making trusted access solutions essential. Attackers increasingly exploit encrypted traffic to hide malicious payloads, introducing additional layers of complexity.
Finally, ensuring rapid adoption of C2C under the zero trust framework demands seamless integration with existing systems, robust encryption strategies, and unified policy enforcement. Agencies must overcome these hurdles to achieve the visibility and security automation required for zero trust success.
How F5 can help with C2C and zero trust
Embracing zero trust requires a comprehensive ecosystem of solutions that address device visibility, secure access, and application protection—exactly what F5 brings to the table. By leveraging F5’s specialized capabilities, agencies can overcome the challenges of C2C implementation while maturing their cybersecurity posture across a range of potential entry points and attack surfaces.
- Endpoints: Trusted app access with F5 BIG-IP Access Policy Manager (APM)
Access control is a critical pillar of zero trust. BIG-IP APM simplifies and centralizes access to applications, APIs, and data across cloud and on-premises environments. It offers modern authentication, single sign-on (SSO), and a consistent user experience—all within a stronger security framework powered by F5 BIG-IP Identity Aware Proxy (IAP). For federal agencies, BIG-IP APM enhances access validation by displaying custom warning banners, supporting strong credentials, and querying user attributes to enforce least privilege access.
Additionally, BIG-IP APM provides advanced client integrity checks, ensuring endpoint compliance with government security standards like the Host Based Security System (HBSS) and verifying the use of Government Furnished Equipment (GFE). This comprehensive approach enables agencies to safeguard against unauthorized access and improve endpoint security, a critical aspect of the C2C initiative. - Network infrastructure: Securing encrypted traffic
As SSL/TLS encryption becomes the standard, malicious actors frequently leverage it to mask their attacks. To address this, F5 offers SSL visibility solutions that decrypt/encrypt traffic, eliminate blind spots, and apply policy-based orchestration across the full security chain. By securing inbound and outbound encrypted traffic, F5 enables agencies to enhance visibility while preventing threats from bypassing security controls—aligning perfectly with the goals of C2C and zero trust. - Applications: Layer 7 security for mission-critical apps
With organizations managing hundreds of applications, application-layer security is more important than ever. F5 provides advanced Web Application Firewall (WAF) solutions that protect against a range of threats, including Layer 7 distributed denial-of-service (DDoS) attacks, API attacks, and credential-based exploits. Behavioral analytics are continuously applied to ensure apps remain healthy and secure, supporting agencies’ zero trust strategies by securing mission-critical and cloud-based applications alike. - Identity services and integration partnerships
Zero trust is rooted in identity verification, and F5 solutions seamlessly integrate with trusted providers like Microsoft, Okta, and Ping. This partnership strengthens identity services for mission-critical applications, SaaS platforms, and cloud-based services, delivering a unified and secure user experience. By bridging identity gaps across diverse environments, F5 ensures agencies maintain strong, scalable zero trust capabilities.
The path forward
With C2C as its foundation, the DoD is making bold strides toward a zero trust ecosystem, aiming for full implementation as soon as possible. Yet, realizing the vision of zero trust requires not only diligence but also the right tools and expertise. F5 is uniquely positioned to help agencies navigate this transformative shift, offering scalable, secure solutions across endpoints, networks, and applications.
Whether defending against access-related breaches, managing encrypted traffic, or fortifying applications, F5 solutions align with the operational needs of federal agencies. By partnering with F5, agencies can overcome C2C challenges and accelerate their journey toward a resilient, zero trust environment that secures both today’s networks and tomorrow’s mission-critical systems.
Learn more about how F5 solutions can help with zero trust.