Attachment E-Cyber Survivability Endorsement (CSE) Implementation Guide v3 July 2022.pdf

UNCLASSIFIED

Cyber Survivability Endorsement (CSE)

Implementation Guide

Version 3.0

July 2022

Joint Staff J6, Deputy Director for Information Warfare Requirements Division

Classification Determination: This CSE Implementation Guide is UNCLASSIFIED. All specific vulnerability and threat references were taken from unclassified sources. Its guidance is generic, scenarios are notional, and exemplar language is intended to be tailored for each system. It does not include any specific information on any system, which would likely drive a CUI or classified determination, as would tailoring the exemplar language to describe threshold performance requirements for a specific DoD capability.

Releasability: This guide has been cleared for public release by the Office of the Chairman of the Joint Chiefs of Staff Public Affairs Office.

INTENTIONALLY LEFT BLANK

Table of Contents

Summary of Changes

1.0 Executive Summary

2.0 Intended Audience

3.0 Introduction

4.0 Background

5.0 Using CSE to Determine the Level of Cyber Sufficiency Throughout a Capability’s Lifecycle

6.0 CSE in Alternative Acquisition Pathways

7.0 Overview of the Cyber Survivability Endorsement Process

8.0 Implementing the Cyber Survivability Endorsement Process

8.1 Step 1 –Mission Type (MT)

8.2 Step 2 – Adversary Threat Tier (ATT)

8.3 Step 3 – Cyber Dependency Level (CDL)

8.4 Step 4 – Impact Level of System Loss or Compromise (IL)

8.5 Step 5 – Determine the Cyber Survivability Risk Category of the System

8.6 – CSA Determination from the CSRC Selection

9.0 CSE Process Quick Start for Capability Requirement Documents

10.0 Cyber Survivability in Capability Requirement Documents

11.0 ICD and CDD Exemplar Language for each Cyber Survivability Risk Category

12.0 Cyber Survivability Requirements and Performance Measures

13.0 Tailoring Cyber Survivability Attributes

14.0 CSE Support to Other DoD Initiatives

15.0 CSE Vignette

16.0 Joint Staff Gatekeeping

17.0 Annotated References

18.0 Acronyms

19.0 Glossary

List of Figures:

Figure 1: Integrated Cybersecurity Frameworks Leveraged by CSE

Figure 2: Interactions of the JCIDS and Major Capability Acquisition Process

Figure 3: The JCIDS SS KPP and CSE in All Capability Acquisition Processes

Figure 4: Cyber Survivability Risk Category Determination

Figure 5: Mission Types

Figure 6: Adversary Threat Tiers

Figure 7: Unclassified Adversary Cyber Threat Advisories

Figure 8: Cyber Criticality Analysis

Figure 9: Cyber Dependency Levels

Figure 10: Degree of Connectivity and Operational Requirements

Figure 11: Impact Levels and Criticality Analysis using CNSSI No 1253 Security Categorization

Figure 12: Impact Levels of System Compromise

Figure 13 Determining the Cyber Survivability Risk Category

Figure 14: Cyber Survivability Risk Categories

List of Tables:

Table 1: System Survivability KPP Pillars Mapped to Cyber Survivability Attributes

Table 2: CSE Iterative Approach in Capability Requirement Documents

Table 3: Vignette CDD Table

Summary of Changes

Background: Since the Cyber Survivability Endorsement (CSE) Implementation Guide (CSEIG) was first published in January 2017, the Joint Staff has reviewed over 340 Joint Capabilities Integration and Development

System (JCIDS) requirements documents for cyber survivability in support of the JCIDS System Survivability Key Performance Parameter (SS KPP). These reviews included over 200 unique systems, encompassing mission critical systems and sea/land/air/space capabilities. The Joint Staff used lessons learned from these reviews to coordinate and align cyber survivability threshold performance requirement guidance, along with other DoD efforts to improve the cybersecurity and cyber resiliency of DoD weapon systems throughout their lifecycles.

Over 80 DoD subject matter experts helped to define cyber survivability requirement exemplars, enabling a consistent understanding and expectation of the minimum viable levels of cyber survivability needed to support acquisition, engineering, testing, operation and risk acceptance decisions throughout a systems lifecycle.

Way ahead: CSE threshold performance requirements are referenced in DoD guidance, but a transition from a cybersecurity compliance mindset to cyber survivability focused deliverables will require a concerted effort to fully and formally coordinate all DoD cyber guidance roles and responsibilities. CSE starts with tailoring Initial Capabilities Document (ICD) and Capability Development Document (CDD) exemplar language for the Cyber

Survivability Risk Category (CSRC) and Cyber Survivability Attributes (CSA), but program sponsors will need to continue to develop and mature Cyber Survivability Risk Posture (CSRP) metrics to improve the mission assurance of systems in any acquisition pathway. CSE is particularly well suited to rapid acquisition and should influence risk decisions throughout a systems lifecycle, including fielded mission critical systems in sustainment.

Over the next two years, the Department is pursuing several initiatives to better integrate CSE’s holistic framework of threshold performance requirements into DoD’s cybersecurity risk management, acquisition, system security engineering, mission assurance, and testing processes. The initiatives include pilots to integrate

OSD and Service efforts for defining consistent processes for determining a measurable and testable CSRP, which are expected to drive the next CSEIG version 4 updates.

CSEIG version 3.0’s most significant changes:

• Expanded Adversary Threat Tiers (ATT) and CSRC summary statements to 5 levels, based on 2021 unclassified Cybersecurity Advisories’ nation-specific capabilities and countermeasures from the National

Security Agency (NSA), Cybersecurity and Infrastructure Security Agency (CISA), and Department of Justice (DOJ). These changes also drive inputs to JCIDS requirement documents’ Threat Summary, with an unclassified cyber threat prior to availability of a Validated Online Lifecycle Threat (VOLT) report.

• Expanded Mission Type (MT), Cyber Dependency Level (CDL) and Impact Level (IL) statements to better differentiate levels. A CSRC and CDL of zero were added for capabilities with no hardware (HW), software

(SW) or firmware (FW) processing, sensors, or information exchange requirements.

• Included references to updated DoD, Service, Agency and National Institute of Standards and Technologies

(NIST) guidance that have incorporated the CSE framework and helped align JCIDS, DoD instructions, and NIST definitions for cybersecurity, cyber resiliency, and cyber survivability.

• Updated CSA-07 to includes a recommendation to implement and maintain a cyber survivability configuration baseline for its Government Off The Shelf (GOTS)/ Commercial Off The Shelf (COTS) HW, SW, FW and open source modules, by version number to ensure an operationally acceptable cyber risk posture 24/7. It also introduces the reporting considerations for its mission relevant terrain in cyberspace (MRT-C).

• Updated CSA-10 to include recommendation to consider a developer requirement to provide a machine-readable Bill of Materials (BOM) of the system’s GOTS/COTS HW, SW, FW and open source modules for a supply chain risk assessment prior to each milestone decision and supported release. It includes operator, defender and analyst inputs to enable cyber sufficiency risk assessments, and risk mitigation POA&Ms.

• Added how requirements for Artificial Intelligence, (AI), Machine Learning (ML), and unmanned systems could drive an early CDL determination for an ICD and consideration in its Analysis of Alternatives (AoA).

CSE framework should lay the foundation for follow-on cyber risk posture activities: This CSEIG also includes additional information on how cyber threshold performance requirements can enable the following activities (see Section 5.0 for details):

• ICD’s CSRC summary statement and list of CSAs to be considered should drive the AoA study team guidance, and the Request for Information (RFIs) needed to differentiate cyber resource and mission risk implications between candidate capabilities and prevent pursuit of capabilities so flawed it would be inconceivable to cost-effectively mitigate known cyber risk to an operationally acceptable level.

• CDD’s CSRC summary statement and subset of CSAs identified as most critical to system survivability should drive development of the Request for Proposal (RFP) and source selection criteria, helping prevent acquisition of foundationally flawed capabilities.

• Program Managers (PM) should use the CDD’s subset of CSA threshold performance requirements to support operational risk trade-space decisions, selection, testing and effective implementation of Risk

Management Framework (RMF) controls associated with the CSAs most critical to system survivability.

• System Security Engineers (SSE) should decompose the CDD’s subset of CSA threshold performance requirements into specific minimum viable cybersecurity and cyber resiliency requirements.

• Program Management Offices (PMOs) and Developmental Test (DT) organizations should use the missions, threats, and CSA threshold performance requirements to plan to execute cyber T&E events, including developer/contractor testing, in the Test and Evaluation Master Plan or other document.

• Milestone Decision Authorities (MDA) should use cyber sufficiency status updates, from the developmental testing associated with the CSA threshold performance requirements, to determine if the program is on a path to achieve an operationally acceptable risk posture.

• Authorizing Officials (AO) should use cyber sufficiency status updates, from developmental testing associated with the CSA threshold performance requirements, to determine if the program has or could reasonably be expected to achieve an operationally acceptable risk posture, as part of the decision to grant an Authorization To Operate (ATO).

• CSE’s CSRC and CSA threshold performance requirements should be leveraged to ensure an alignment with, and support to, Alternate Acquisition Pathways, RMF, Program Protection Plan (PPP) and related requirements critical to achieving and maintaining an operationally relevant cyber survivability risk posture for Combatant Commanders’ Operational Plan (OPLAN) and mission success.

• CSE’s framework of CSRC and holistic CSAs should enable a scalable governance and metric construct for a consistent assessment of cyber risk for DoD Congressional reviews and reporting requirements, such as Strategic Cybersecurity Program (SCP) reviews, other data reporting requirements related to the DoD CIO Top 10 Scorecard, Acquisition Milestone cyber sufficiency reviews, Developmental

Test/Operational Test reports, Deep Cyber Resiliency Assessments (DCRAs), et al.

The Joint Staff J6 has a cyber survivability portal with links to CSE Frequently Asked Questions (FAQ), DoD initiatives, and related reference material that are helping to align cybersecurity and cyber resiliency with cyber survivability, so every organization can leverage the benefits and avoid unintended duplication from each other’s efforts: https://intelshare.intelink.gov/sites/cybersurvivability/ https://intelshare.intelink.gov/sites/cybersurvivability/

1.0 Executive Summary

In 2015, the Deputy Secretary of Defense tasked the Joint Staff to improve requirements for weapon systems cybersecurity, which resulted in adding a Cyber Survivability Endorsement (CSE) to the Joint

Capabilities Integration and Development System (JCIDS) Manual’s System Survivability Key Performance

Parameter (SS KPP).

The tasking was driven by the 2015 Director of Operations Test & Evaluation (OT&E) annual report highlighting the same high risk vulnerabilities that were being found in almost every tested system, and should have been fixed prior to OT&E. This happened because requirements documents did not include contractually-binding cybersecurity and cyber resiliency threshold performance requirements, and instead relied on compliance with a multitude of DoD, FISMA, NIST and CNSS guidance. Since these legacy systems’ only cyber requirement was for enough cybersecurity compliance to obtain an Authorization to Operate

(ATO), the OT&E identified recurring cyber risks to individual systems that would require significant reengineering and potentially be too costly to mitigate the risks to an operationally acceptable level. These conclusions foster a re-focus away from solely a system’s approach to a more operational mission risk analysis process, and was a driving force for pursuing this CSEIG.

Although the DoD’s Risk Management Framework (RMF) is necessary, compliance with it isn’t sufficient to achieve and maintain an operationally relevant cyber risk posture. One of the reasons is RMF guidance does not leverage the JCIDS Manual (2018 and 2021) System Survivability KPP guidance on CSE, which holistically adds cyber resiliency considerations critical to mission assurance. JCIDS’ addition of CSE has put cybersecurity and cyber resiliency minimum viable requirements on equal footing with all other system performance requirements, during cost, schedule and performance risk trade-space decisions. Program

Managers (PMs) can use Cyber Survivability Attribute (CSA) threshold performance requirements to justify

(resourcing) specific technical controls from FISMA, NIST and CNSS, but RMF guidance doesn’t define how a linkage to the CSAs could be used to support a PM’s efforts in pursuit of cyber survivability.

CSE targeted the predictable failure of the cybersecurity processes to build-in sufficiently robust cyber capabilities to prevent (resist/anticipate), mitigate (absorb/withstand), recover from, and adapt to the full spectrum of mission assurance cyber-events in plain language requirements that a program manager can understand. The Services have independently developed System Security Engineering guidance to decompose that plain language into cybersecurity technical controls for fielding survivable capabilities and have develop metrics for testing to define their system’s Cyber Survivability Risk Posture (CSRP).

This CSE Implementation Guide (CSEIG) is purposely not prescriptive on how to determine a CSRP, but it has provided information to allow the Services and Agencies to mature their own processes. For example, the

OUSD (A&S) Deep Cyber Resiliency assessment (DCRA), Army Cyberspace Operational Resilience

Assessment – Platform (CORA-P), Air Force Measures of Performance Report, Air Force System Security

Engineering (SSE) Cyber Guidebook version 4, Naval Air System Command’s SSE Process Guide, DoD

Cybersecurity Test & Evaluation Guidebook version 2, DoD Cyber Table Top Guide version 2, MITRE’s use of the Air Force Research Lab’s CSA Tool, and System Engineering Research Center’s Cyberattack Resilient

Systems Report are not sufficient to define a measurable CSRP for the DoD, but they all contribute to the processes for maturing the cyber resiliency, and survivability measurement. Work has begun for CSEIG version 4 to include their best practices. The current concept of the CSRP will continue to mature through collaboration between OSD, JS, CCMDs, Services and Agencies into a repeatable, measurable and testable process that will yield a uniform CSRP.

CSE does not identify any new cybersecurity requirements. The CSE process helps requirement sponsors better understand the cyber risks to the capability’s mission critical functions and performance requirements, in order to state those cybersecurity and cyber resiliency requirements as a reasoned set of cyber survivability threshold performance requirements. These threshold performance requirements are identified early enough in the acquisition process to inform engineering decisions and enable program managers to include them during operational risk trade-space decisions for fielding of a survivable minimum viable capability.

CSE can help requirement sponsors and program managers make defendable operational risk trade-space decisions for those cyber technical controls supporting the subset of CSAs identified as most critical for that system’s survivability. Operational forces need systems that meet mission requirements, and are survivable in their respective operating environment. The warfighter deserves cyber survivability, and the CSE framework supports creation of threshold performance requirements that are designed to prevent, mitigate, recover from and adapt to cyber-events, by applying a risk-managed approach to building and maintaining systems.

Even though CSE is only mandatory for requirements going through the JCIDS process, the Services have seen resource and mission risk benefits to justify considering cyber survivability requirements in all acquisition pathways. CSE is particularly well suited to the higher technology readiness levels associated with rapid acquisition. However, if alternative acquisition pathways (such as Middle Tier of Acquisition and

Joint Urgent/Emergent Operational Needs) do not effectively consider cyber survivability threshold performance requirements, they are at risk of not providing a survivable operational capability. It is recommended that all programs going through the all acquisition pathways consider, and sufficiently apply, the CSE concepts outlined in this guide in order to field survivable DoD capabilities.

CSE can reduce acquisition and sustainment total lifecycle costs and improve mission assurance. This is counterintuitive, since the cost of implementing cybersecurity into legacy weapon systems has historically been seen as cost-prohibitive. However, those costs were driven by the need to reengineer capabilities that were found to be flawed. When made contractually-binding, CSE’s cyber threshold performance requirements have the potential to prevent the acquisition of capabilities that would be too costly to mitigate cyber risks to an operationally acceptable level.

2.0 Intended Audience

This SS KPP’s CSEIG is primarily intended for requirements/resource sponsors developing an ICD, CDD, Information System ICD (IS-ICD), or IS-CDD that will be used in the JCIDS process. Resource sponsors and program office personnel should also use the CSEIG as a reference in:

• developing AoA study team guidance, including market research planning and RFIs;

• drafting RFP and source selection criteria;

• decomposing CSAs for system security engineering;

• assessing cyber sufficiency status for making milestone decisions;

• drafting developmental/operational test plans;

• drafting cybersecurity strategy and program protection plans;

• defining requirements for adaptive (DevOps) improvements throughout a capability’s lifecycle; and

• making risk acceptance decisions.

CSE’s non-prescriptive approach can also be used by Combatant Commands (CCMDs), Services, and

Agencies to assess the cyber survivability risk posture of OPLANs and missions. The need to assess and mitigate cyber-risks in legacy and future systems is universal, and the CSEIG provides a mission-focused approach and holistic set of cyber survivability requirements that can support achieving and maintaining an operationally-relevant mission risk posture.

Requirements sponsors can seek support from the Joint Staff (J6 and J8), prior to formal capability submission through the Joint Staff’s Knowledge Management and Decision Support (KM/DS) system, to help them understand and effectively apply the CSE process. This support is available regardless of the

Acquisition Category, level of JCIDS interest, Service responsibility, or acquisition pathway selected. CSE is flexible enough to support non-JCIDS requirements, including all acquisition pathways, including Middle

Tier of Acquisition, software development, and using DevOps practices.

3.0 Introduction

The CSE framework does not identify any new cybersecurity or cyber resiliency requirements. The CSE process was designed to help requirement sponsors better understand the cyber risks to the capability’s functional performance requirements, in order to articulate a reasoned set of cyber survivability threshold performance requirements, early enough in the acquisition process to inform engineering decisions, and support operational risk trade-space decisions for fielding a survivable minimum viable capability.

It helps requirement sponsors identify and tailor the CSAs most critical to system survivability, balance performance tradeoffs, and to assess, achieve, and maintain an operationally-relevant risk posture commensurate with the capability’s risk category. The exemplar statements provided in this guide are descriptive, and not prescriptive of specific engineering solutions. They are intended to describe a reasoned set of cyber attributes that can be placed on contract, decomposed and implemented by system security engineers, supported by program managers, and tested throughout the development phase, to ensure an acceptable level of mission assurance in the expected operational environment.

Contrary to popular belief, both acquisition and sustainment lifecycle costs could be reduced in future weapon systems, if cyber survivability is effectively factored into AoA/Capability Based Assessment (CBA), RFP/source selection criteria, and operational risk trade-space decisions throughout the system’s lifecycle.

This is because early consideration of cyber survivability requirements can prevent the selection of foundationally-flawed technologies and systems that have been rushed to market without incorporating best business practices for risk assessment of cybersecurity and cyber resiliency.

For example, anyone who has purchased the latest personal computer technologies, or first year of a new car redesign, has probably experienced the following:

• Low return on investment: ~30% greater component cost than the previous generation’s now-mature capabilities, which could be considered this generation’s threshold requirements.

• Software flaws: Down-time and unknown, emergent security risks, until early adopters have identified problems for eventually mitigating/fixing by the manufacturer.

• Buyer’s remorse: Wishing they had not prioritized immature technologies (objective requirements), and instead acquired the hardware processing and storage flexibility to add them only when proven to be cost-effective, secure and resilient.

Initial acquisition costs may be lower, lifecycle total cost of ownership may be lower (if cost effective mitigations to achieve an operationally relevant risk posture are included), and mission assurance should be higher, through such an analytic trade-space approach, since functionality will only be acquired when it has proven to be survivable and cost-effective. There would also be less need to remove unacceptably risky functionality, or bolt-on costly and potentially performance-robbing, complex cybersecurity capabilities between it and the rest of the force.

Currently fielded systems have accepted risks and not allocated resources for cyber, because it was cost-prohibitive to add-on or re-engineer needed cyber risk mitigations. However, there are likely some risk mitigations that could still be applied to reduce the operational mission risk to an acceptable level. This is why the DoD’s most mission critical systems should consider resourcing to proactively adapt their capabilities to identify and address evolving cyber-risks by actively managing the system’s configuration to achieve and maintain an operationally-relevant cyber survivability risk posture.

This CSEIG contains cyber survivability exemplar statements that should be considered for all capability requirement documents. Starting with the ICD, the CSEIG provides five categories of CSRC-level exemplar language that integrate anticipated adversary cyber threat and countermeasure requirements, even before a capability’s specific technologies are known, and before a tailored cyber threat assessment can be made.

The Mission Type (MT) and Adversary Threat Tier (ATT) are the two factors that can almost certainly be determined at the ICD phase (From here, an initial CSRC can be determined). The CSEIG identifies the ten high-level CSAs that requirements sponsors must ensure the AoA study team considers, to ensure that the recommended capability solution is not inherently incapable of being made cyber survivable.

Unless the capability includes requirements for Artificial Intelligence, Machine Learning, continuous information exchange, or unmanned/autonomous control, there will likely not be sufficient information to determine the capability’s Cyber Dependence Level (CDL) until after the AoA. After the solution is selected, the CDL and the estimated mission Impact Level (IL) of system loss or compromise can be determined, which will refine the program’s CSRC level (CSRC factors are described in detail in section 7). However, the

IL determination will not be fully rationalized until the CCMDs, including the assigned cyber defenders, are able to assess its risk implication to their OPLANs and missions. Nevertheless, this incomplete CSRC cyber threat and countermeasure requirements statement can be used until an operationally-relevant cyber threat assessment can be performed, to help identify and tailor an appropriate subset of the ten CSAs to support creation of system-specific, measurable, testable requirements in the draft CDD, IS-ICD or IS-CDD.

CSE and the SS KPP are only required for capabilities going through the JCIDS process, meaning those requirements identified as Joint Requirements Oversight Council (JROC) interest, Joint Capabilities Board

(JCB) interest, or as Joint Information. However, its flexible approach can also support acquisition programs that are not subject to the JCIDS process, within the Adaptive Acquisition Framework’s other pathways.

Services and DoD component sponsors have been encouraged to use this guide, or develop similar guidance, to ensure their programs have an operationally acceptable level of cyber survivability to support mission assurance. The Services have seen the positive implications of applying CSE, and have published acquisition, system engineering and test guidance to support its use.

The CSRC uses a broad operational threat perspective and can help bound the number of CSAs critical to system survivability, since it provides a consistent perspective of the level of cyber survivability required throughout a capability’s lifecycle. This consistency enables capabilities to be defined, acquired, engineered, tested, operated, and maintained using the same framework. While all ten CSAs must be considered during the AoA or CBA, the number of CSAs selected for implementation in a capability’s development and testing varies by CSRC. The selected subset of CSAs should also support the development of capability requirements, including exemplar statements for the RFP, and for source selection criteria. The

CSRC of a capability is also an indicator of the level of Cybersecurity Maturity Model Certification (CMMC) required for the protection of the Controlled Unclassified Information (CUI) used in developing and testing the capability by Federal contractors.

Selecting more CSAs than necessary for a CSRC level, or not tailoring them to the capability, could lead to unintended costs. The CSA exemplars are system-agnostic and can be used as written, but it is important to perform a criticality analysis to identify and tailor a subset of CSAs most critical to the system’s survivability and its move, shoot, and communicate functions. However, tailoring is NOT engineering. CSAs should be kept at a high level to allow developers the flexibility to be creative in meeting the intent of each cyber threshold performance requirement with new technologies and processes.

Although the level of detail in each tailored CSA will be different, the CSAs can be used during development to determine the progress in achieving system’s required CSRC level, and during sustainment to determine if it is has achieved, and is maintaining, an operationally acceptable risk posture commensurate with its

CSRC. Assessing the risk posture requires analyzing the strength and the effectiveness of a system’s procedural and technical control implementations to meet the intent of each CSA’s threshold performance requirement. The likely operational scenarios for the system’s employment are the relevant lenses for viewing its risk category.

Constructing, and regularly reviewing, the system’s plan for analyzing, prioritizing, and mitigating mission risks is the means for achieving and maintaining an acceptable risk posture. Together, the CSRC, CSAs, and

CSRP provide the foundation for cyber survivability, which can be considered as part of the system’s operational risk trade-space, along with other functional requirements.

Assessing and updating a system’s risk posture should ideally be done several times a year during its development phase, prior to any version update or sprint release, and in response to increasing cyber adversary capabilities or intent. It should also be done during its operational phase, and reported to the operational chain of command. This guide is intended to support the incorporation of a CSRP as one aspect of a system’s risk posture. System survivability assessments, and mitigation plans to prioritize vulnerabilities with the greatest mission risk, are responsibilities of both the capability owners and the senior echelon officials, as part of their implicit duty to field effective and survivable military capabilities. If they are not survivable, then they have little operational relevance in a cyber-contested environment.

As will be shown in this guide, CSA-10 is the most critical attribute, due to:

• a system’s evolving and potentially expanding cyber-attack surface;

• constantly increasing adversary cyber capabilities;

• complexity of identifying vulnerability risks from connected and supporting systems; and

• the requirement to assess and prioritize mitigation of vulnerabilities with the greatest mission risk.

Although CSA-10 was designed to improve and maintain the risk posture of future capabilities, it should be considered for implementation by the DoD’s most mission critical legacy capabilities. No matter what risks were accepted by an Authorizing Official (AO) on day 1 of a new ATO, the use of CSA-10 will enable agile changes to systems in response to evolving threats and missions, making risk assessment and acceptance more adaptive to operational needs.

The resources required to support efforts associated with CSA-10 are not a management reserve. There is always a known list of cybersecurity and cyber resiliency risks that need to be assessed, prioritized and mitigated, since there are no 100% RMF-compliant ATOs. A signed ATO does not negate the residual risk being accepted or imply an operationally acceptable cybersecurity or cyber resiliency risk posture. In addition, new adversary cyber threats continue to be identified that elevate the mission risk of previously accepted risks or new vulnerabilities which may pose an unacceptable risk. CSA-10 is a defined requirement to actively manage the system’s configuration, and defensibility, to achieve and maintain an operationally relevant cyber risk posture.

This proactive approach will require a cultural change, since most programs view an ATO as giving sufficient cyber protections, and do not include an ongoing, sustained process, or funding, to actively manage its cyber survivability risk posture throughout the lifecycle of the system. We know that when an adversary builds a more capable surface-to-air missile that we will need to respond with improvements to our aircraft or its defenses, but these physical/kinetic risks change more slowly, and the long timelines for iterative resourcing to fund those improvements can meet operational requirements. Unfortunately, those same one to three year timelines to devise, design, fund, produce, test and field cyber risk mitigations do not meet cyber-risk-to-mission requirements. Having a support team in place and funded to proactively act will dramatically reduce that delay and provide and operationally timely level of mission assurance.

Support for systems’ implementation of CSA-10 is needed, because known/unknown system/mission risks are being accepted on the first day any new capability is deployed, while the adversaries’ increasing capabilities, addition of new system functionality and connection to external capabilities are adding known/unknown system/mission risks or increasing the risks of previously accepted vulnerabilities to an unacceptable operational level. Getting an ATO needs to be viewed as the beginning of a system’s risk management process, not the end, in achieving and maintaining an operationally-relevant risk posture. For example, CSA-07, CSA-08 and CSA-10 could be tailored to support requirements for a cATO determination.

Mission-Based Cyber Risk Assessments (MBCRAs), such as Cyber Table-Top (CTT) exercises, and cooperative and adversarial testing performed during system development, should help the PMO determine a cyber sufficiency level in support of each milestone decision or knowledge point, and postulate if the system is on a path to achieving an operationally-relevant cyber risk posture before Initial Operating Capability (IOC).

These activities can also generate the data used to assess a mitigation POA&M’s potential to improve the cyber risk posture, if effectively implemented. See DoDI 5000.89 [“Test and Evaluation”] for more information on MBCRAs and other cyber testing.

Although the level of detail and artifact granularity will be different, planners for CCMD wargames and exercises could use the CSAs in a similar way to determine a CCMD’s OPLAN and mission risk posture, by assessing the risks associated with the risk posture of each of the systems and supporting infrastructure critical to OPLAN and mission success. System owners for systems identified as critical to OPLAN/mission success and with significant cyber survivability risk, should consider requesting resources to support implementing a CSA-10 capability to actively manage the system’s configuration to achieve and maintain an operationally acceptable cyber risk posture, and increase mission assurance.

4.0 Background

The CSE was created with representatives from the Joint Staff, OUSD (A&S), OUSD (R&E), DoD CIO, NSA, DIA, DOT&E, OUSD (I&S), and the Services. The group focused on improving cybersecurity requirements in

CDDs; however, the Services and OSD representatives confirmed that cyber threat and requirements statements would have greater impact if the CSAs were included in ICDs and considered during AoAs, and if the CSAs better articulated cyber resiliency requirements.

The 2018 JCIDS Manual update added Joint Staff reviews of ICDs, and more guidance on requirements for identifying the CSRC and CSAs. The early inclusion of specific cyber survivability requirements in these acquisition documents was intended to allow for more cost-effective, timely, and survivable solutions.

Otherwise, solutions might be pursued that are more difficult and costly to implement than survivable options that would also meet operational requirements.

Although CSE is aligned with the SS KPP’s cybersecurity intent to Prevent and cyber resiliency's intent to

Mitigate, Recover and Adapt from a cyber-related event, CSE had to overcome the cultural paradigm that if the capabilities are inexpensive enough, you can provide sufficient mission assurance and resiliency by acquiring more of them. However, the perspective that one, or more, kinetic bullets are required to achieve one kinetic weapon system kill does not apply to cyber capabilities, where one cyber bullet (one exploitable vulnerability) can potentially kill ALL similarly configured and connected systems.

Integration of DoD Cybersecurity Frameworks Applicable to Weapon Systems: The CSE was developed to ensure alignment with existing and evolving DoD and National guidance, including the implementation of the NIST Cyber Resiliency frameworks, the JCIDS SS KPP, DoD instructions for cybersecurity (RMF) and cyber resiliency, and cyber threat intelligence products. Figure 1 visually depicts how CSE integrates with these frameworks, and how the SS KPP terminology connects cyber to kinetic functionality, for enabling consideration of both sets of threshold performance requirements within the same operational risk trade-space with all of the systems other functional requirements.

There is no longer a need to push for Cost, Schedule, Performance and Security. JCIDS has defined Cyber

Survivability as a performance attribute, and cybersecurity and cyber resiliency requirements are holistically included in cyber survivability. There is no need to add security as a fourth factor.

Figure 1: Integrated Cybersecurity Frameworks Leveraged by CSE

Implementation of CSE has helped to begin alignment of cyber terminology across the Department. The latest iteration of the cyber survivability definition aligns well with, and is intended to integrate, the definitions of cybersecurity and cyber resiliency in recent changes to NIST SP 800-160 Volume 2, DoD

Dictionary of Military and Associated Terms, DoDI 8500.01 and the JCIDS Manual, that makes references to

“Cyber Survivability Considerations (cybersecurity and cyber resiliency)”.

• Cyber Survivability – The ability of warfighter systems to prevent, mitigate, recover from and adapt to adverse cyber-events that could impact mission related functions, by applying a risk managed approach to achieve and maintain an operationally relevant risk posture, throughout its lifecycle. Source: JCIDS

Manual, para 2.5.1.4

• Cybersecurity - Prevention of damage to, protection of, and restoration of computers, electronic communications services, wire communication, and electronic communication, including information contained therein, to ensure its availability, integrity, authentication, confidentiality, and nonrepudiation. Source: DoD Dictionary of Military and Associated Terms, DoDI 8500.01

• Security - A condition that results from the establishment and maintenance of protective measures that enable an enterprise to perform its mission or critical functions despite risks posed by threats to its use of information systems. Protective measures may involve a combination of deterrence, avoidance, prevention, detection, recovery, and correction that should form part of the enterprise’s risk management approach. Source: CNSSI 4009

• Cyber Resiliency - The ability to anticipate, withstand, recover from, and adapt to adverse conditions, stresses, attacks, or compromises on systems that use or are enabled by cyber resources.

Source: NIST SP 800-160 volume 2, Revision 1 (1 Dec 2021)

The NIST cyber resiliency principles in SP 800-160 Volume 2, and DoDI 8500.01, include the adapt component for addressing the evolving and emerging threats to support cyber resiliency. The JCIDS SS KPP helps requirement sponsors to understand and holistically articulate these cybersecurity and cyber resiliency requirements in cyber survivability terms for warfighting systems. CSRC helps define the strength of cybersecurity and cyber resiliency required for these systems, and can be viewed as the on-ramp and partner to RMF.

The cyber threat intelligence support products inform capability owners and RMF AOs, as well as the Joint

Staff reviewers evaluating the requirements documents, concerning the level of ATT expected in the intended mission’s operational environment. Intelligence cyber threat assessments must be actionable, timely, and released at a classification level usable by requirement sponsors to drive cyber survivability requirements. NSA’s unclassified Cybersecurity Advisories have provided a sufficient level of threat information for an ICD and draft CDD, and form the basis for defining the cyber threshold performance requirements and a strength of mechanism measurement of cyber defenses. These threat intelligence products should be reviewed regularly during operations and sustainment so that both the system developers and the operational chain of command maintain awareness of evolving system and mission risk.

Satisfactorily meeting the JCIDS SS KPP CSE requirement does not result in a system’s ATO. However, it does define the subset of CSAs determined to be most critical to system survivability. They should enable a program’s System Security Engineers to decompose measurable and testable threshold requirements for the RFP to identify source selection criteria. This will enable program managers to use the CSAs, flowed down into the Work Breakdown Structure (WBS), to support justification of specific NIST SP 800-53 security controls during operational risk trade-space decisions. Instead of relying exclusively on RMF’s

Confidentiality, Integrity, and Availability (C, I, A) categorizations for a program, the system’s CSRC value enables program managers to identify the most critical capabilities supporting move, shoot, and communicate functions requiring cyber survivability.

The NIST Cybersecurity Framework organizes basic cybersecurity functions at their highest levels. The framework focuses on using business priorities to guide cybersecurity activities, and considering cybersecurity risks as part of the organization’s risk management practices. They help an organization express its management of cybersecurity risk by organizing information, enabling risk management decisions, and addressing threats. The functions also align with existing methodologies for deficiency and incident management, and to show the impact of investments in cybersecurity. CSE integrates with this framework to leverage their value and the benefits of their guidance.

• NIST Identify and Protect (Anticipate) (CSE Prevent) – organizational understanding of what is required to manage cybersecurity risk to systems, assets, data, and capabilities; safeguards to ensure delivery of critical infrastructure services

• NIST Detect and Respond (Withstand) (CSE Mitigate) – activities to identify the occurrence of a cybersecurity event; appropriate actions to take regarding a detected cybersecurity event

• NIST Recover and Adapt (CSE Recover and Adapt) – activities to maintain resiliency and restore capabilities and/or services that were impaired due to a cybersecurity event

For information on the NIST Cybersecurity Framework, see https://www.nist.gov/cyberframework/

For the Committee on National Security Systems Instruction (CNSSI) 4009 definition of “cyber incident”, see the glossary, or review the document at the Cyber Survivability SharePoint site on the NIPRNet at https://intelshare.intelink.gov/sites/cybersurvivability/

The SS KPP pillars are mapped to attributes that contribute to the survivability of a system’s capabilities.

These include Prevent attributes that support reduced likelihood of being hit by these fires, reduced vulnerability and impact if hit by these fires (including in cyberspace), and resiliency of the system and overall force (broader than a single system architecture) to complete the mission. The Mitigate attributes support completing the mission despite the loss of some cyber functionality, with a minimum cyber capability remaining. The Recover attribute supports restoring the system to a known good condition to fight another day. The Adapt attribute enables the constant monitoring and maintenance of the capability over its lifecycle. The cyber requirements of the SS KPP must be feasible to implement, be measurable, and be testable. The requirements are based on the mandatory SS KPP pillars for cyber-event effects:

• Prevent – Design requirements to identify, protect and harden weapon system’s functions from adversary cybersecurity threats (to anticipate most likely and greatest risk)

• Mitigate - Design requirements to detect and respond to cyber-events making it through defenses;

enabling cyber operational resiliency (to complete the mission)

• Recover - Design requirements to recover to a known good condition after a cyber-event; at a minimum, restore sufficient capability (to fight another day)

• Adapt – Enables a sustained capability to adapt to changes in adversary threat and vulnerabilities

(to win this war and the next) through processes such as DevOps

The Protection Functional Capability Board (FCB) is the office of primary responsibility for the SS KPP. The

Chair of the Protection FCB endorses the SS KPP in accordance with the Gatekeeping process described in

Appendix C to Enclosure A of the 2021 JCIDS Manual. The SS KPP endorsement is applicable to CDDs, IS-

ICDs and IS-CDDs. Certain precursor steps and requirement development activities are applicable to ICDs.

Cybersecurity and RMF for DoD Information Technology: The CSAs are supported by a subset of the DoD’s

RMF and its NIST SP 800-53 controls. Each of the CSAs and their strength of implementation must be considered to appropriately address cyber risk. For information on RMF controls, refer to DoDI 8510.01, RMF for DoD Information Technology (IT), available on the Cyber Survivability SharePoint site. For information on strength of implementation, see CNSSI 1253, also available on the Cyber Survivability

SharePoint site. CSAs provide the outcome of defined cyber threshold performance requirements that should drive development of the RFP and source selection criteria, support system engineering decomposition, and a program manager’s operational risk trade-space decisions for resourcing RMF

Security Controls.

System Security Engineering (SSE): The SS KPP pillars, and their CSA categories, provide a foundation for developing an architecture to support cyber security and cyber resiliency requirements. Early determination of a system’s CSRC and selecting a tailored subset of CSAs in a requirement’s criticality analysis and design provides the engineers with options to support decisions prior to establishing the https://www.nist.gov/cyberframework/ solution architectures. This maximizes the trade-space available for cybersecurity solutions, which is necessary to ensure the SS KPP is achievable within identified priorities and constraints.

The CSE Community of Interest teamed with the Air Force Research Laboratory (AFRL) to produce an automated CSA Tool to assist requirements sponsors. The tool helps to determine a system’s CSRC statement for an ICD, recommend AoA guidance to understand the resource and mission risk implications of each CSA, refine the CDD’s CSRC statement, and identify the subset of CSAs most critical to system survivability. The tool also identifies NIST SP 800-53 security controls that could support the decomposition of CSAs for each CSRC level. This enables sponsors to perform a what-if, intrinsic assessment of the system’s potential CSRP based on the technical controls selected. Vulnerabilities with system and mission risk can be mapped to the CSAs to begin to assess the overall CSRP for the system and the mission.

The Department of Defense Chief Information Officer (DoD CIO) drafted a CSEIG Volume II to supplement this guide that supports implementation of the cyber survivability requirements and follow-on acquisition and testing community efforts. In this document, the Deputy DoD CIO for Cybersecurity, through collaboration with the Joint Staff/J6, the DIA, and the NSA’s (then-named) Information Assurance

Capabilities Office, organized the CSAs into a Systems Engineering/Systems Security Engineering (SE/SSE) view. This illustrates how the SS KPP cyber survivability requirement should be addressed in a logical deconstruction of the capabilities documents. AFRL has integrated this Volume II information into the CSA

Tool. Its automated integration has also met the intent of NSA’s Volume III supplement to help define a suggested strength of implementation for the CSAs, so that the cyber threshold performance requirements are commensurate with the MT, ATT, CDL, and IL in the expected operational environment. The Air Force’s

Cyber Resiliency of Weapons Systems (CROWS) team of System Security Engineers is also supporting CSA

Tool development using the content of their SSE Cyber Guidebook with workflow processes and artifacts.

All references cited in this guide are available on the Cyber Survivability SharePoint sites:

https://intelshare.intelink.gov/sites/cybersurvivability/ https://intelshare.intelink.sgov.gov/sites/cybersurvivability/

Cyber Supply Chain Risk – Supply Chain Risk Management (SCRM) presents a greater impact on system survivability with recent discoveries of nation-state threat actors’ involvement in the global supply chain for hardware, software and firmware (HW, SW, FW). Cyber SCRM encompasses a range of risk management activities that go beyond traditional configuration management best practices. Cyber SCRM influences multiple CSAs, but should be addressed in CSA-10 to address Cyber SCRM across the system’s lifecycle.

CSA-07 and CSA-10 have been updated with functional requirements that should drive Contract Deliverable

Requirements List (CDRL) requirements for a Bill of Materials configuration baseline of the GOTS/COTS HW, SW, FW and open source modules by version number, along with their associated supply chain risk assessment information, for each milestone decision and supported release.

Cyber Threat Intelligence –The cyber-contested environment should be described within all capability requirement documents, and the Intelligence Community (JS J2, NSA and DIA) has worked closely on CSE to ensure the availability of actionable cyber threat information earlier in the acquisition process. The threat environment characterization should include data informing Critical Intelligence Parameters (CIPs). The IC https://intelshare.intelink.sgov.gov/sites/cybersurvivability/ should drive requirement changes to account for the integration of the classified cyber threat with the commercially-available cyber threat data, and make it available for the acquisition and operational communities. If possible, threat details should be inclusive of state actors or countries in which threats are expected to emanate.