The US military currently possesses an asymetric advantage in most weapons systems. One area in particular is the cyber domain; however, the US is losing its advantage in this domain by relying on the same acquisition and testing process for information systems as it uses for hardware-centric systems. This paper reviews the current acquisition and operational testing process for information technology and offers a more flexible, responsive, risk-based approach for testing software-centric acquisition programs.