Attachment 0007 - Manufacturing Readiness Assessment Guidance and Thread.pdf

A-1

APPENDIX A – Detailed MRL Criteria

Table A-1. Manufacturing Readiness Levels for the Technology and Industrial Base Thread

A-2

Table A-2. Manufacturing Readiness Levels for the Design Thread

A-3

Table A-3. Manufacturing Readiness Levels for the Cost and Funding Thread

A-4 Table A-4. Manufacturing Readiness Levels for the Materials Thread

A-5

Table A-5. Manufacturing Readiness Levels for the Process Capability and Control Thread

Table A-6. Manufacturing Readiness Levels for the Quality Management Thread

A-6

Table A-7. Manufacturing Readiness Levels for the Manufacturing Personnel and Facilities Threads

A-7

A-8

Table A-8. Manufacturing Readiness Levels for the Manufacturing Management Thread

A-9

C-1

APPENDIX B – Acronyms

AAF Adaptive Acquisition Framework

ACAT Acquisition Category

ACTD Advanced Concept Technology Demonstration

AoA Analysis of Alternatives

AS Acquisition Strategy

ASR Alternative System Review

ATD Advanced Technology Development

BOM Bill of Materials

CA Contract Award

CDD Capability Development Document

CDR Critical Design Review

CDRL Contract Data Requirements List

CONOPS Concept of Operations

COTS Commercial-Off-the-Shelf

CPD Capability Production Document

CT Critical Technology

DA Decision Authorities

DAB Defense Acquisition Board

DAE Defense Acquisition Executive

DAG Defense Acquisition Guidebook

DCMA Defense Contract Management Agency

DFA Design for Assembly

DFARS Defense Federal Acquisition Regulation Supplement

DFM Design for Manufacturing

DID Data Item Description

DoDI Department of Defense Instruction

APPENDIX B

C-2

DMSMS Diminishing Manufacturing Sources and Material Shortages

ESH Environmental, Safety, and Health

EMD Engineering and Manufacturing Development

FAR Federal Acquisition Regulation

FCA Functional Configuration Audit

FOC Full Operational Capability

FRACAS Failure, Reporting, Analysis, and Corrective Action System

FRP Full Rate Production

GAO Government Accountability Office

GFP Government Furnished Property

IAQG International Quality Group

IAW In accordance with

ICA Industrial Capabilities Assessment

ICD Initial Capabilities Document

IMP Integrated Master Plan

IMS Integrated Master Schedule

IOC Initial Operational Capability

ITR Initial Technical Review

ITRA Independent Technical Risk Assessment

JDMTP Joint Defense Manufacturing Technology Panel

KC Key Characteristic

KPP Key Performance Parameter

LRIP Low Rate Initial Production

MDA Milestone Decision Authority

MDAP Major Defense Acquisition Program

MDD Materiel Development Decision

MMP Manufacturing Maturation Plan

C-3

MRL Manufacturing Readiness Level

MRO Maintenance, Repair & Overhaul

MS A Milestone A (DoD decision point)

MS B Milestone B (DoD decision point)

MS C Milestone C (DoD decision point)

MSA Materiel Solution Analysis

MTA Middle Tier of Acquisition

NASA National Aeronautics and Space Agency

NTIB National Technology Industrial Base

O&S Operations and Support (DoD acquisition phase)

PCA Physical Configuration Audit

PDR Preliminary Design Review

Pre-MDD Pre-Materiel Development Decision (DoD acquisition phase)

PQM Production, Quality, and Manufacturing

PRR Production Readiness Review

PSM Product Support Manager Guidebook

PWB Printed Wiring Board

QMS Quality Management System

R&D Research & Development

RFP Request for Proposals

S&T Science & Technology

SD System Design

SDS System Design Specification

SEP Systems Engineering Plan

SFR System Functional Review

SIE Special Inspection Equipment

SME Subject Matter Expert

C-4

SML Sustainment Maturity Level

SOO Statement of Objectives

SOW Statement of Work

SPC Statistical Process Control

SRR System Requirement Review

STE Special Test Equipment

SVR System Verification Review

T&E Test and Evaluation

TBD To Be Determined

TMRR Technology Maturation Risk Reduction

TRA Technology Readiness Assessment

TRL Technology Readiness Level

TRR Test Readiness Review

UON Urgent Operational Need

WBS Work Breakdown Structure

WIP Work in Process

C-1

Appendix C – Operational Technology Cybersecurity

Malicious actors have increasingly targeted the manufacturing industrial base with software attacks that could disrupt manufacturing operations and degrade the quality of the products being produced without being detected. Therefore, manufacturing readiness must include the protection of shop floor computer networks and equipment.

To assess this critical area, the MRL Working Group developed cybersecurity criteria to be included in multiple threads throughout the MRL matrix. The scope of the cybersecurity protections being assessed as a part of MRLs is limited to

Operational Technologies (OT).

National Institute of Standards and Technology (NIST) standard NIST SP 800-

37, ‘Risk Management Framework for Information Systems and Organizations’ defines Operational Technology as:

“Programmable systems or devices that interact with the physical environment (or manage devices that interact with the physical environment). These systems/devices detect or cause a direct change through the monitoring and/or control of devices, processes, and events. Examples include industrial control systems, building management systems, fire control systems, and physical access control mechanisms.”

Other examples of OT systems include NC machines, automated inspection equipment, and sensors. The term ‘Operational Technology’ (OT) is used to distinguish manufacturing technologies from Information Technologies (IT), Platform Information Technology (PIT)/mission data, or other enterprise/business

Management Information Systems (MIS). OT sometimes slips through the cracks and may not always be controlled as tightly by the IT department or evaluated as thoroughly as part of IT reviews and audits. Therefore, OT should be addressed during MRL Assessments.

MRL Assessments using the cybersecurity criteria are not intended to be detailed cybersecurity audits. Instead, the purpose is to ask simple, fundamental questions to assess whether or not OT cybersecurity has been considered by the organization and determine whether or not basic, common-sense controls have been implemented. The end goal is to identify risks or potential major gaps in OT protection.

Manufacturing Subject Matter Experts (SME) who are conducting MRL

Assessments are not expected to be cybersecurity experts. The new criteria are

C-2 written at a top level and address basic controls and considerations that do not require specialized cyber knowledge to evaluate. However, if the discussions begin to get too technical, or it appears something is not quite right based on unclear or incomplete answers, the Manufacturing SME should get help from a cybersecurity expert.

When asking questions about the OT cybersecurity criteria, team members should keep in mind that this is a new area for many companies. Organizations are still adapting to meet current and emerging DoD cybersecurity requirements and guidance. There will likely be a great deal of variability in how the OT cybersecurity controls are implemented, so evaluators will need to be flexible.

Prior to conducting Manufacturing Readiness Level assessments, the following business environment related to OT cybersecurity should be understood:

1) If the effort is under a Federal Acquisition Regulation (FAR) based contract, the MRL assessment team should be aware of what types of information the manufacturing facility handles:

a. When classified information is involved, then FAR Clause 52.204-2

Security Requirements apply, and implementation status at the manufacturing facility is documented in the contractor’s “Security

Plan”—contact the Defense Counterintelligence and Security

Agency.

b. When Controlled Technical Information (CTI) (includes but not limited to export controlled), then Defense Federal Acquisition

Regulation Supplement (DFARS) Clause 252.204-7012

Safeguarding Covered Defense Information and Cyber Incident

Reporting applies

2) Type of organization that operates the manufacturing facility:

a. Federal System - that is, a system used or operated by an executive agency (e.g., DoD), by a contractor of an executive agency, or by another organization on behalf of an executive agency - must comply with the requirements in FISMA (Federal

Information Security Modernization Act), including the requirements in FIPS 200 and security controls in NIST SP 800-53 (See 44 USC

3554, Federal agency responsibilities). This includes DoD (e.g.

Army, Navy, Air Force etc.) owned and operated systems and

C-3 contractor systems operated on behalf of DoD. Examples of

Federal/DoD Information Systems include:

Systems Operated on Behalf of the DoD

Systems Operated on Behalf of a Federal Agency

Information systems embedded in DoD Systems/DoD

Equipment

Information systems embedded in Federal Systems/Federal

Equipment

Cloud Services provided by a federal Agency/DoD

b. Non-Federal Systems – When systems that do not meet criteria of a Federal information system, NIST SP 800-171 contains recommended security requirements for protecting the confidentiality of CUI (Controlled Unclassified Information, which is unclassified information that must be safeguarded from unauthorized disclosure and is governed by DoD Instruction

5200.48, “Controlled Unclassified Information,” ) when the information is resident in Nonfederal information systems This includes contractor owned - contractor operated systems. The following are examples of Non-Federal/Contractor Information

Systems:

Internal cloud services provided by a Non-Federal

Organization/Contractor and operated on behalf of the contractor

Internal IT processing (operated on behalf of the contractor) to develop a product or service for a Federal Agency/DoD (not including IT processing services that a Federal Agency would normally provide for itself)

Cybersecurity requirements for Non-Federal Systems are captured in NIST SP

800-171, Protecting Controlled Unclassified Information in Non-Federal Systems and Organizations and conveyed in contractual vehicles or other agreements established between agencies and Non-Federal organizations (e.g., FAR 52.204-

21, Basic Safeguarding of Covered Contractor Information Systems; DFARS

252.204-7012, Safeguarding Covered Defense Information and Cyber Incident

Reporting; or as otherwise identified in the contract for certain specified CUI safeguarding requirements, such as HIPAA).

C-4

Contractor Owned and Operated manufacturing facilities: When DFARS

252.204-7012 is in the contract, security requirements should be implemented in accordance with NIST SP 800-171 Protecting Controlled Unclassified Information in Nonfederal Systems and Organizations). Other DFARS clauses (such as

252.204-7019 and 252.204-7020) require that a NIST SP 800-171 DoD

Assessment be completed to assess a contractor’s implementation of the NIST

SP 800-171 security requirements and assessment results will be posted in the

Supplier Performance Risk System (SPRS). The SPRS can be accessed to see the assessment results for each contractor (non-federal) information system/system security plan that has been assessed.

The following are some general cybersecurity concepts to consider from NIST

SP 800-82, Guide to Industrial Control Systems (ICS) Security. Additional considerations can be found in the MRL Users Guide under the appropriate MRL thread.

Identify security policies, procedures, training and educational materials that apply specifically to the manufacturing environment.

Address cybersecurity throughout manufacturing readiness level maturation starting with manufacturing concept development to full-rate production manufacturing capability.

Implement a network topology for IT/OT networks in a manufacturing environment that have multiple layers, with the most critical communications occurring in the most secure and reliable layer.

Provide logical separation between corporate and IT/OT networks.

Employ a DMZ network architecture (i.e., prevent direct traffic between the corporate and IT/OT networks of the manufacturing environment).

Ensure that critical components, such as those of a process control system (PCS) are on redundant networks.

Consider protecting manufacturing process related data including recipes, configuration control information, test parameters and results, etc. (may be a counterintelligence challenge).

Where possible, use operator authentication to manufacturing OT equipment.

Ensure the protection of non-conformance issues associated with critical manufacturing processes. For example, handle all non-conformance information with Marking and Dissemination Statements for controlled technical information that have been directed in the contract or use of

C-5 company proprietary markings; each are categories of Controlled

Unclassified Information

Small Business manufacturing companies should make use of guidance and training offered by the Small Business Administration Office, such as the

Procurement Technical Assistance Centers (PTAC), NIST Manufacturing

Extension Partnership (MEP), Cybersecurity Evaluation Tool (CSET), prior to using an external or independent organization check/audit/test and after they have conducted an internal self-test.

Note regarding CMMC (Cybersecurity Maturity Model Certification): CMMC is a certification process that leverages the security requirements in NIST SP

800-171; it is not the source of the requirements required to protect CUI. The requirements to protect CUI (including Controlled Technical Information) when it is processed on, stored or, or transits a Non-Federal system are found in NIST

SP 800-171.