Attachment_12--Program_Protection_Plan.pdf

UNCLASSIFIED//FOR OFFICIAL USE ONLY

EGI-M Program Protection Plan Ver 1.0

Embedded Global Positioning System (GPS)/Inertial Navigation System (INS) – Modernized (EGI-M) – ACAT II

PROGRAM PROTECTION PLAN (PPP)

VERSION 1.0

SUPPORTING MILESTONE B AND

Technology Maturation & Risk Reduction (TMRR)/Engineering & Manufacturing

Development (EMD)

20 March 2018

LYNDA T. RUTLEDGE, SES, DAF Date Air Force Program Executive Officer Agile Combat Support

Destruction notice: Destroy by any method that will prevent disclosure of contents of reconstruction of the plan. Local reproduction is authorized.

DISTRIBUTION STATEMENT F: Further dissemination only as directed by AFLCMC/WNY, Robins AFB, GA 31098, or higher DoD authority.

WARNING - This document contains technical data whose export is restricted by the Arms Export Control Act (Title 22, U.S.C., Sec 2751 et seq.) or Executive Order 12470. Violation of these export laws is subject to severe criminal penalties.”

Page ii

SUBMITTED BY

ADAM B. BLANKENSHIP, Maj, USAF Date

Deputy Chief, Positioning, Navigation & Timing Electronic Warfare & Avionics SPO

CONCURRENCE

KAREN BRIGANCE, NH-04, DAF

Chief Engineer, Electronic Warfare &

Avionics SPO AFPEO Agile Combat Support

Date MARK J. FRIESEN, Lt Col, USAF Materiel Leader, Positioning, Navigation

& Timing Electronic Warfare and Avionics SPO

Date

APPROVAL

JAMES S. WILSON, Col, USAF Date

Senior Materiel Leader and Program Manager , Electronic Warfare & Avionics System Program Office AFPEO Agile Combat Support

Page iii

Contents

1.0. Introduction – Purpose and Update Plan

1.1. Technology/System Description

1.2. Program Protection Responsibilities

2.0. Program Protection Summary

2.1. Schedule

2.2. Critical Program Information (CPI), Critical Functions, and Critical Components (CC) Protection

3.0. Critical Program Information and Critical Components

3.1. Identification Methodology

3.1.1. CPI Identification and Criticality Analysis Participants

3.1.2. Process for Identifying CPI and CC

3.2. Inherited CPI and CC

3.3. Organic CPI and CC

4.0. Horizontal Protection

5.0. Threats, Vulnerabilities, and Countermeasures

5.1. Threats

5.2. Vulnerabilities

5.3. Countermeasures

5.3.1. System Security Engineering (SSE)

5.3.2. Cybersecurity

5.3.3. Software Assurance

5.3.3.1. Software Development Standards

5.3.3.2. Software Design and Testing Approach

5.3.3.2.1. Operational System Countermeasures

5.3.3.2.2. Development Environment

5.3.3.2.3. COTS Software and Software of Unknown Pedigree Protection, Testing/vetting

5.3.3.2.4. Development Environment Release Testing

5.3.3.2.5. Planned vs. Actual Testing/Evaluation Rates Deviation

5.3.4. Supply Chain Risk Management

5.3.4.1. Trusted Suppliers

5.3.4.2. Counterfeit Prevention

Page iv

5.3.4.3. CP Requirement

5.3.4.4. SCRM Requirements

5.3.5. General Countermeasures

6.0. Other System Security-Related Plans and Documents

7.0. Program Protection Risks

7.1. ASIC & Cryptographic Functions

7.2. Commercial-Off-The-Shelf (COTS)

7.3. Foreign Military Sales (FMS) Exploits

8.0. Foreign Involvement

8.1. EGI-M Foreign Sales Compliance

8.2. Defense Exportability Features

9.0. Processes for Management and Implementation of PPP

9.1. Audits/Inspections

9.2. Engineering/Technical Reviews

9.2.1. System Requirements Review (SRR)

9.2.2. System Functional Review (SFR)

9.2.3. Preliminary Design Review (PDR)

9.2.4. Critical Design Review (CDR)

9.3. Verification and Validation

9.4. Sustainment

10.0. Processes for Monitoring and Reporting Compromises

11.0. Program Protection Costs

11.1. Security Costs

11.2. Acquisition and Systems Engineering Protection Costs

12.0. Acronyms List

Appendix A: Security Classification Guide ................................................................................ A-1

Appendix B: Counterintelligence Support Plan .......................................................................... B-1

Appendix C: Criticality Analysis ................................................................................................ C-1

Appendix D: System Security Engineering Plan ........................................................................ D-1

Appendix E: Acquisition Cybersecurity Strategy ........................................................................ E-1

Appendix F: EGI-M Critical Program Information and Critical Components List ..................... F-1

Page v

List of Tables

Table 1 PPP Update Record Table 2 Program Information Table 3 Program Protection Responsibilities Table 4 EGI-M Schedule After TMRR Award Table 5 Candidate CPI & CC Countermeasure Protection Summary Table 6 Inherited CPI and CC Table 7 Candidate Organic CPI and CC Table 8 Horizontal Protection Information Table 9 Summary of CPI Threat, Vulnerabilities, and Countermeasures Table 10 Threat Product References Table 11 Identified or Potential Threats Table 12 Potential CPI and CC Vulnerabilities Table 13 Protection Requirements Incorporation into Contracts Table 14 Notional Application of Software Assurance Countermeasures Table 15 EGI-M Program Countermeasures/Security Activities Table 16 EGI-M Document Responsibilities for Program Protection Plan Table 17 Other System Security Related Plans and Documents Table 18 Mitigation Plan Table 19 Foreign Involvement Summary (mandated) Table 20 Test & Evaluation Documents Table 21 Security Costs Above NISPOM Requirements (mandated) Table 22 Acquisition and Systems Engineering Protection Costs (mandated)

List of Figures

Figure 1 Notional EGI-M Schedule 7 Figure 2 Critical Protection Item Identification 10 Figure 3 Critical Component Identification 11 Figure 4 Program Protection Risk Cube 37

1.0. Introduction – Purpose and Update Plan

Program protection delivers trusted defense systems by ensuring that programs adequately protect their technology, components, and information throughout the acquisition lifecycle. This Program Protection Plan (PPP) is a risk-based, comprehensive, living plan intended to document and identify what is important to protect Critical Program Information (CPI) and technology from adversaries, threats, and malicious intent thereby preserving the integrity of warfighting systems. It also includes implementation guidance, monitoring procedures, and effectiveness assessment criteria for applied countermeasures. This plan is intended to be used by all government, contractor, and subcontractor personnel directly supporting the EGI-M Program at locations where CPI /Critical Components (CC) are stored, processed, handled, transmitted, or tested from inception until system demilitarization. Contractual documents will include requirements to assist identification of CPI, development of System Security Engineering (SSE) documentation, and implementation of protection threat mitigations within the EGI-M design.

At a minimum, this PPP will be reviewed at each technology insertion for needed updates reflecting program changes and/or when there is a change in the threat and vulnerability environment. If necessary, a revised PPP will be drafted and submitted for approval. Major updates will be approved by the Program Executive Officer. Minor updates (i.e., “.x” updates) may be approved by the Program Manager. The PPP update record is shown in Table 1. Any future changes or revisions to this document will be added to this table.

Table 1 PPP Update Record Revision Number Date Changes Approved By

1.0 20 Mar 2018 Initial See Signature Page

1.1. Technology/System Description

The EGI-M is a component of the Global Positioning System (GPS) which provides global, real-time accurate positioning, navigation, and timing (PNT) to users across the Department of Defense (DoD). The system operates in all weather and electromagnetically jammed environments supporting peace and wartime air, space, sea and land operations. The GPS system, or Enterprise, is divided into the Space Segment (SS), Control Segment (CS), and User Segment (US).

EGI-M is a component of the user segment and provides position, navigation and timing for DoD platforms.

The EGI-M is a self-contained, all-attitude navigation system providing outputs of linear and angular acceleration, linear and angular velocity, position, attitude (roll, pitch), platform azimuth, magnetic and true heading, altitude, body angular rates, time tags, and Coordinated Universal Time (UTC) synchronized time. The EGI-M can be customized to provide additional outputs.

The EGI-M operates with Direct Current (DC) from the host vehicle electrical power, and will continue to operate after loss of host vehicle power when provided with a nominal battery/backup power. The EGI-M accepts, processes, and responds to the MIL-STD-1553B data bus according to the IS-EGI-179 Interface Specification (IS). The EGI-M accepts Radio Frequency (RF) Global Positioning System (GPS) satellite transmissions, and provides these signals as inputs to the Embedded GPS Receiver (EGR). Two RF ports are included that supply redundant signal connections, allowing two separate antennas to be connected. Up to 24 Space Vehicle (SV) signals may be tracked simultaneously by the EGI-M GPS receiver. The EGR supports the GPS and blended GPS/Inertial Navigation System (INS) navigation solutions.

Neither inputs to, nor outputs from, the EGR are required to support the EGI-M pure inertial navigation solution.

The EGR will allow user selection of: 1) Precise Positioning System-Lockout (PPS-LO) Standard Positioning Service (SPS) Coarse/Acquisition (C/A) code only, 2) PPS Y-code only mode, 3) Military Code (M-Code) only mode, 4) MY-Code only mode or 5) mixed code (YMCA) mode of EGR operation. PPS EGRs and required cryptology keys are only available to users approved/authorized by the United States (U.S.) Government. Additionally, the EGI-M will provide an ARINC 429 interface in accordance with (IAW) the IS-EGI-179 IS. The EGI-M ARINC 429 interface consists of 6 high speed transmit and receive channels. The 6 channels support two separate data sets (standard mission data or Automatic Dependent Surveillance – Broadcast (ADS-B) output data) that can be output on each channel based on the ARINC configuration table settings.

The EGI-M Program pillars are:

• Provide a resilient response to an evolving threat

• Meet DoD and Federal Aviation Administration (FAA) mandates o M-Code – Build a system that provides the M-Code capability o ADS-B Out – Build a system that supports the ADS-B Out mandate

• Obsolescence – Address Diminishing Manufacturing Sources (DMS) concerns within the architectures

• Configuration – Reduce the number of overall embedded GPS/INS (EGI) configurations to sustain

The EGI-M effort is dependent upon the GPS Directorate’s Military GPS User Equipment (MGUE) program which will develop and test GPS cards capable of using M-Code and legacy signals to provide improved security, greater resistance to jamming and interference, faster crypto key distribution, increased accuracy, and more robust operation in urban, mountainous, and under foliage environments. MGUE is being delivered via an evolutionary acquisition approach. These MGUE cards will also support ADS-B, which is the cornerstone of the FAA NextGen air traffic modernization program. The FAA has mandated ADS-B Out be implemented by 1 Jan 2020 in all aircraft operating in the national airspace to include DoD aircraft. Integration of these cards’ technology into an EGI creates the EGI-M system. For more information regarding the technology/system description, please see the program documentation listed in Table 2. The Mission Assurance Category (MAC) could be a level I or level II depending on platform integration.

Table 2 Program Information

Program Name Acquisition Category (ACAT) Level

Mission Assurance Category (MAC) Last Milestone

Embedded GPS/INS – Modernized (EGI-M) II I/II Pre-Milestone B

1.2. Program Protection Responsibilities

The Program Manager (PM) is responsible for overall Program Protection on the program and Table 3 identifies those responsible for all aspects of Program Protection.

Table 3 Program Protection Responsibilities Title/Role Name Location Contact Info

Program Manager (PM) Col James S. Wilson AFLCMC/WNY Comm: 478-926-3371

DSN: 468-3371

James.wilson.4@us.af.mil

Lead Systems Engineer (SE) Charles Jackson AFLCMC/WNY

PNT-PO

Comm: 478-926-1497

DSN: 468-1497

charles.jackson.2@us.af.mil

Software Assurance Lead (SWA) Charles Jackson AFLCMC/WNY

PNT-PO

Comm: 478-926-1497

DSN: 468-1497

charles.jackson.2@us.af.mil

Program Protection Lead (PPL) Priest Blackstock AFLCMC/WNY

PNT-PO

Comm: 478-926-3587

DSN: 468-3587

priest.blackstock@us.af.mil

Cybersecurity Lead (CL) Bryan Johnson

AFLCMC/WNY

Comm: 478-926-7673

DSN: 468-7673

bryan.johnson.25@us.af.mil

Supply Chain Risk Management Lead (SCRM) Joseph Torres

AFLCMC/WNY

Comm: 478-926-5096

DSN: 468-5096

Joseph.torres.19@us.af.mil

Security Specialist Lead Wendy Myers AFLCMC/WNE-IP Comm: 478-926-5105

DSN: 468-5105

wendy.myers.1@us.af.mil

The following documents, categorized by source, are relevant to the processes, functions, and approaches discussed in this PPP.

Program Protection

• DoDI 5200.39, Critical Program Information (CPI) Identification and Protection Within Research, Development, Test, and Evaluation (RDT&E), 28 May 15

• M-Code Cryptographic Key Handling Concept of Operation (CONOP) For USAF Embedded GPS Inertial Navigation Systems (EGI) Modernization Program

• AFPAM 63-113, Program Protection Planning for Life Cycle Management, 17 Oct 13

• DoDI 5200.44, Protection of Mission Critical Functions to Achieve Trusted Systems and

Networks (TSN), 25 Aug 16 http://www.dtic.mil/whs/directives/corres/pdf/520039p.pdf http://www.dtic.mil/whs/directives/corres/pdf/520039p.pdf

Security

• DoDI 8500.01, Cybersecurity, 14 Mar 14

• DoDI 8581.01, Information Assurance (IA) Policy for Space Systems Used by the

Department of Defense, 8 Jun 10

• DoD 5220.22-M National Industrial Security Program Operating Manual (NISPOM), 18

May 16

• Committee on National Security Systems Instruction No. 4009, National Information

Assurance (IA) Glossary, 26 Apr 10

• HR4310, National Defense Authorization Act for Fiscal Year 2013, Section 933, 3 Jan 12

• Application Security and Development (ASD) Security Technical Implementation Guide

(STIG) Version 4, Release 1, 25 Jul 16

• DO-178C, Software Considerations in Airborne Systems and Equipment Certification, 5

Jan 12

• DoD GPS Security Policy, 4 Apr 06

• DoDM 5200.01 Volume 3, DoD Information Security Program: Protection of Classified

Information, 19 Mar 13

• DoDD O-5240.02, Counterintelligence (CI), 17 Mar 15

• AFI 16-1404, Air Force Information Security Program, 29 May 15

Anti-Tamper

• Program Manager’s Process Guide & Checklist for Anti-Tamper, 4 Aug 11

• DoDD 5200.47E, Anti-Tamper (AT), 4 Sep 15

• CPI Identification Survey

• CPI Identification Decision Aid

Foreign Disclosure

• Section 2778 of Title 22, United States Code (U.S.C.), International Traffic in Arms Regulation, (ITAR) 1 Apr 09

• DoDI 3020.46, Military Critical Technologies List (MCTL): Section 11 – Lasers, Optics, and SensorsTechnology, 24 Oct 08

• DoDD 5230.11, Disclosure of Classified Military Information to Foreign Governments and International Organizations, 16 Jun 92

• DoDD 5530.3, International Agreements, 21 Nov 03

• DoDI 2040.02, International Transfers of Technology, Articles, and Services, 27 Mar 14

• DoD 5105.38-M, Security Assistance Management Manual, 3 Oct 03

• AFI 16-201, Air Force Foreign Disclosure and Technology Transfer Program, 23 Jul 14

• 15 CFR, Commerce and Foreign Trade, 1 Jan 16

• Defense Exportability Features Policy Implementation Memorandum and Guidelines, 9 Apr 15

Public Disclosure

• DoDD 5535.3, DoD Domestic Technology Transfer (T2) Program, 21 May 99

• DoDI 5535.8, DoD Technology Transfer (T2) Program, 14 May 99

Operations Security

• AFI 10-701, Operations Security (OPSEC), 8 Jun 11

• DoDD 5205.02E, DoD Operations Security (OPSEC) Program, 20 Jun 12

• DoD 5205.02-M, DoD Operations Security (OPSEC) Program Manual, 3 Nov 08

Other

• Public Law 111-383, Ike Skelton National Defense Authorization Act for Fiscal Year 2011, 7 Jan 11

• Defense Federal Acquisition Regulation Supplement (DFARS), 4 Nov 16

• DoDI 5000.02, Operation of the Defense Acquisition System, 26 Nov 13

• Program Protection Plan Outline & Guidance, Jul 2011

2.0. Program Protection Summary

2.1. Schedule

Since the EGI-M Program is transitioning to an official program of record with no prior requirement for a PPP, specific details and schedules are not yet defined. The EGI-M will accomplish the bulk of the EGI-M criticality analysis in the Technical Maturation and Risk Reduction (TMRR) phase and finalize the remaining tasks in the Engineering and Manufacturing Development (EMD) phase. Below is a 36 month top level program schedule starting at the TMRR phase with overlaying program protection events depicted in Table 4 and a program schedule depicted in Figure 1. Program Protection Events and associated schedules will be determined during program execution.

Table 4 EGI-M Schedule After TMRR Award Program Event Schedule Date Program Protection Events Create Draft Cybersecurity Platform Information Technology (PIT) package

July 2016 RMF step1 – Categorize System (On-going) Finalizing the PIT package

Held a RMF workshop with ISSM and GPS Engineers to select security controls

August 2016 RMF step 2 – Select Security Controls (On-going) Creating a GPS System Security Plan (SSP)

Create an Architectural Analysis Report (AAR) with ISSM and Lead Engineer

October 2016 RMF step 3 – Implement Security Controls (On-going) Creating an Architectural Analysis Report (AAR)

Start of Work/Kick Off March 2017 CPI assessment completed. Initial SSE documentation generated (prime contractor develops)

Security Control Assessment Representative assess Architectural Analysis Report (AAR)

Dec 17-Jul 18 RMF step 4 – Assess Security Controls Security Control Assessment Representative assess Architectural Analysis Report (AAR)

Delta System Requirements Review and System Functional Review

Mar 18 CPI and SSE in system functional baseline.

CPI updated

Technology Readiness Assessment (TRA) May 18 SSE assessed for Technology Readiness Level

(TRL)

Security Control Assessment Representative issues Security Assessment Report (SAR)

Aug 18 RMF step 5 – Receive the Plan of Action and Milestones (POA&M) or Successful Assessment document.

Preliminary Design Review (PDR) NLT Aug 18

Initial SSE documentation submitted. Initial V&V Plan submitted. SSE in allocated baseline.

CPI updated/finalized.

Engineering and Manufacturing Development Contract Award July 18 / Nov 18 Includes SSE requirements

Monitor Security Controls Aug 18+ RMF step 6 – Monitor Security Controls Contractor Qualification Testing Jul Sep 18 – Jul

Critical Design Review Jan 19

Final SSE documentation and Final V&V Plan submitted. SSE in product baseline (hardware and software)

Technical Readiness Review Aug 19 Ensure Final SSE V&V Plan approved Government Testing Nov 19 – Jul 20 System Verification Review (SVR)/Functional Configuration Audit(FCA)/Production Readiness Review (PRR)

May 20 SSE V&V Report completed and approved.

Milestone C May 20 V&V Complete, V&V Report Approved Post Milestone C After May 20 Ensure SSE included POM Planning for

Roadmap development.

Physical Configuration Audit (PCA) Aug 20 Product Baseline with SSE included Contract Complete Jul 20 / Nov 20

Figure 1 Notional EGI-M Schedule

2.2. Critical Program Information (CPI), Critical Functions, and Critical Components (CC) Protection

Candidate CPI and CC will be developed by a government/industry team. The EGI-M Systems Engineer (SE) and Program Protection Lead (PPL) engineer, with inputs from the prime contractors, will evaluate the EGI-M program and make recommendations to the EGI-M PM on whether or not the program contains CPI. In order to identify CPI, a thorough decomposition of the system is necessary to ensure that all components and subsystems that may contain CPI are evaluated on their own merit. The result of the system decomposition determines the items that are evaluated using a CPI Identification Survey and Decision Aid. The SE and PPL, with inputs from the prime contractors, will determine the appropriate level of decomposition in order to identify CPI. The PM approves CPI and CC destinations for the EGI-M system.

The EGI-M System Security Working Group (ESSWG) will establish key program milestones to measure progress in the development and implementation of the EGI-M PPP. Actions to take and the resulting activities are:

• Determine/define CPI for EGI-M Program

• Submit candidate CPI list to PM for approval & check Acquisition Security Database

(ASDB) for horizontal protection

- Analyze and define threat for EGI-M program

- Conduct vulnerability Assessment

- Conduct security audit

- Engage with Systems Engineering Technical Reviews (SETR)

- Assess foreign involvement events

• Submit drafts and updates of the EGI-M PPP

• Re-evaluate threat for follow-on program phase & recommend countermeasures

• Submit revised EGI-M PPP

• Review and finalize changes to EGI-M PPP

• Implement and track EGI-M PPP elements for EGI-M activities

• Provide security input

• Review and finalize changes to the EGI-M PPP

• Monitor EGI-M PPP implementation

• Report EGI-M PPP status at team reviews and immediately after any incidents

The ESSWG was implemented to assist EGI-M leadership in understanding how current and future threats affect the development and acquisition of system capabilities. AFLCMC/WNY PNT PO coordinates with SMC Intelligence (SMC/IN) in order to bridge the gap between intelligence products and risk management decisions. The goal is to provide insight for program leadership to practically implement intelligence information into acquisition risk management decisions to ensure EGI-M systems capabilities meet warfighter needs.

AFLCMC/WNY PNT PO coordinates EGI-M threat products, including Integrated Threat Assessments (ITAs), System Threat Assessment Reports (STARs), etc., required for each Milestone Decision (MD). SMC/IN, National Air and Space Intelligence Center (NASIC), Air Force Office of Special Investigations (AFOSI), and other Intelligence Community (IC) organizations that support EGI-M are key stakeholders in the ESSWG.

The ESSWG is made up of the following members:

• Program Manager

• Lead Engineer

• Contractor Development Team

• Logistics Manager

• Financial Manager

• Contracting Manager

• Test Manager

• Systems Program Office (SPO) (A&AS Support)

• Industry Partners

• Cybersecurity Representatives (Government & Contractor)

• System Security Engineering Team (Government & Contractor)

• Counterintelligence/AFOSI (as needed)

• Intelligence Community (as needed)

• Communications Security (COMSEC) Manager

• Services (Navy, Army, and Coast Guard – as needed)

• Platforms (as needed)

• GPS Directorate (GPSD) Representative (as needed)

• Air Force Materiel Command (AFMC) Representative (as needed)

Table 5 lists all candidate CPI and critical functions and components (including inherited and organic) mapped to the security disciplines of the countermeasures being applied. The detail supporting this summary assessment (including the threats and vulnerabilities the selected countermeasures apply to) is planned for and documented in subsequent sections.

Table 5 Candidate CPI & CC Countermeasure Protection Summary

3.0. Critical Program Information and Critical Components

3.1. Identification Methodology

The EGI-M SE and PPL with inputs from the prime contractors will evaluate the EGI-M program for CPI. The methodology used to identify CPI is in accordance with DoDI 5200.39 and DoDI 5000.02. A thorough decomposition of the system is necessary with a focus on advanced technology or unique application to ensure all components and subsystems containing CPI are evaluated on their own merit. All components and subsystems are evaluated by using the CPI Identification Survey and Decision Aid (see Government Reference Documents). The EGI-M SE and PPL with inputs from the prime contractors will determine the appropriate level of decomposition in order to evaluate for CPI. The SE and PPL with inputs from the prime contractors will make recommendations to the EGI-M PM on what items will be CPIs.

3.1.1. CPI Identification and Criticality Analysis Participants

The SE and PPL with inputs from the prime contractors will review established DoD CPIs for

GPS.

The CPI identification and Criticality Analysis (CA) team will consist of:

• EGI-M Program Manager

• EGI-M Systems Engineer

• Government and Contractor Subject Matter Experts (SMEs)

# Protected Item (Inherited and Organic)

Countermeasures 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15

Ca nd id at e C

PI

See Appendix F1 Responsible POC Lead:

P M

C L

P M

S E

P M

P P L

P M

P P L

P P L

C L

C L

S w A

SCRM S

E SCRM

PM, CL, AT, SwA, SCRM, PPL, SE

KEY

General CMs Research and Technology Protection CMs Trusted Systems Design CMs Key X = Implemented I = Denotes protection already implemented if CPI is inherited P = Planned

1 Personnel Security 2 Physical Security 3 Operations Security 4 Industrial Security 5 Training Information

Security

6 Transportation Mgmt 7 System Security Engineering (SSE)

8 Cybersecurity 9 Communication Security 10 Software Assurance 11 Supplier Assurance 12 System Security Engineering (SSE) 13 Inventory

Note 1: Details of CPI and CC are listed in Appendix F

3.1.2. Process for Identifying CPI and CC

CPI and CC will be developed by the Security Working Group using the “United States Air Force Process Guide for CPI and CC Identification”, version 1.0a, dated April 2016. The EGI-M CPI and CC Identification Processes are illustrated below in Figure 2 and Figure 3, respectively.

Figure 2 Critical Protection Item Identification

Figure 3 Critical Component Identification

As discussed in Section 1.0 Introduction – Purpose and Update Plan, and Section 5.3.4 Supply Chain Risk Management, this PPP applies to all government, contractor, and subcontractor organizations involved in the EGI-M development, acquisition, operational activities, and sustainment/modifications. The focus of this PPP is from a program perspective and is applicable to all EGI-M subsystems throughout the entire acquisition life cycle.

EGI-M contractors will be required to address vulnerabilities specific to logic bearing components as part of their criticality analyses; include software assurance in a vulnerability assessment, and track suppliers through all tiers of component supply chains.

EGI-M contractors will be required to ensure that SCRM program protection concerns are addressed for all their related efforts on the EGI-M program.

3.2. Inherited CPI and CC

Table 6 identifies any inherited CPI or CC with associating information. The approach to identifying and managing program protection risks is to align protection of inherited CPI and CCs and address the risk of possible loss or compromise for the same or similar CPI and CCs, evaluate and/or accept the risk, or mitigate the risk by the affected entities. The PPL will answer questions about the inherited system(s) and coordinate with the inherited Program Point of Contact (POC) to ensure horizontal protection. Inherited CPI/CC identified as the program develops will be populated into Table 6.

Table 6 Inherited CPI and CC Inherited Critical

Item Parent Program Original Use Planned Use Variation in CMs?

Inherited Program POC

CP

I See Appendix F1

Cr iti ca l

Co m po ne nt s See Appendix F1

3.3. Organic CPI and CC

Table 7 identifies candidate organic CPI and CCs and summarizes the effects or consequences if compromised. It tracks adds/changes/deletions throughout program lifecycle, physical location of CPI or CC, and whether a Program Protection Implementation Plan (PPIP) is in place and traceable to mission-level documents.

Table 7 Candidate Organic CPI and CC Assessment Date(s): Will be conducted in Phase I or the Technology Maturation and Risk Reduction

Candidate CPI/CC Consequence of Compromise (Notes 1 & 4)

Status/ Date &

Justification for Status Change

Traceable CTEs, KPPs, etc.

Export Control

Areas (Note 3)

Physical Location (Note 2)

System Location

PPIP Exists?

(Note 5)

CPI

See Appendix F6

Critical Components See Appendix F6

Note 1: Consequence of compromise for selection as CPI is based on impact if loss of element would:

1) Reduce U.S. Technological Advantage

2) Shorten Combat Life Expectance of System

3) Mission Degradation

4) Alter Program Direction

Note 2: CPI may be present at one or more of the following locations:

1) Northrop Grumman Woodland Hills, CA

2) Northrop Grumman Salt Lake City, UT

3) Honeywell International, Inc. Clearwater, FL

4) Honeywell Redmond, WA

5) Continental United States (CONUS) locations

6) Outside the Continental United States (OCONUS) locations

Note 3: Export Control References:

1) Military Critical Technologies List (MCTL): 2009

2) Missile Technology Control Regime

3) CFR International Traffic in Arms Regulations (ITAR): Part 120.10 Technical Data.

Note 4: System Impact - Protection Failure Criticality Levels

Level I – Total Mission Failure - (Catastrophic) Function/component failure is a failure that results in total compromise of mission capability. May cause death, weapon system loss or current/future mission loss.

Level II – Significant/Unacceptable Degradation - (Critical) Function/component failure is a failure that results in unacceptable compromise of mission capability or significant mission degradation. May cause severe injury, major property damage, or major system damage/compromise which results in mission termination or significant degradation.

Level III – Partial/Acceptable Degradation - (Major) Function/component failure is a failure that results in partial compromise of mission capability or partial mission degradation. May cause minor injury and/or property/system damage/compromise which results in delay, loss of availability or mission degradation.

Level IV – Negligible - (Minor) Function/component failure is a failure that results in little or no compromise of mission capability. No injury, property or system damage, but results in unscheduled maintenance or repair.

Note 5: The EGI-M CPI assessment will be conducted in Phase I, Technology Maturation and Risk Reduction (TMRR). The CPI assessment was not in scope for the Pre-Phase I effort.

Note 6: Details of CPI and CC are listed in Appendix F

4.0. Horizontal Protection

Horizontal protection analysis is the process that determines if critical defense technologies, to include CPI, associated with more than one research, development, and acquisition program, are protected to the same degree by all involved DoD activities (DoDI 5200.39). DoD horizontal protection requires that all those who develop, process or store the same or similar CPI use the same or equally effective:

• Classification standards

• Export Control guidelines

• Foreign disclosure arrangements

• System Security Engineering (SSE) protections

• Cybersecurity standards

• Physical security standards

Horizontal protection is necessary to ensure that an investment made by one program to protect CPI is not diminished due to another program exposing the same CPI or a similar technology to a greater risk. The goal of the adjudication process is an agreement on a common risk mitigation level among affected programs for the same CPI or similar technologies, not a common protection requirement.

The PPL is responsible for horizontal protection and will coordinate with inherited system(s) to ensure horizontal protection. Refer to Table 6 for other programs or weapons systems having CPI similar to this Program. The PPL will also align protection of horizontal CPI to address the risk of possible loss or compromise for the same or similar CPI with more than one program, were evaluated and risk accepted, or mitigated by the affected entities. If there are issues/disagreements about protection of horizontal CPI, then formulation of a DoD level Horizontal Protection Adjudication Group would be recommended for resolution. After identification of CPI via the CPI Identification Process, the Project Management Office (PMO) will create and/or update its record in the Acquisition Security Database (ASDB). Refer to Table 8 for the mandated horizontal protection information.

Table 8 Horizontal Protection Information Date of Last ASDB Update: System is down Date of Next ASDB Update: N/A

CPI Other Programs with Same or Similar CPI Pending Adjudications of CPI? (Y/N) See Appendix F1

5.0. Threats, Vulnerabilities, and Countermeasures

DoD systems are exposed to threats of malicious insertion and tampering throughout the development and supply of critical components. The CPI Identification Process and Criticality Analysis (CA) provide a foundation for assessing and prioritizing threats to the system, vulnerabilities to those threats, and countermeasures for mitigating those vulnerabilities. The results of the CA, vulnerability assessment (VA), and threat assessment (TA) are brought together to perform a risk analysis. The results of the analysis are presented in a risk cube. In the risk cube, the consequence factor is determined from the CA levels and the Likelihood Factor is determined from the VA and TA. Possible countermeasures are evaluated to determine if the risk can be lowered to an acceptable level. Possible countermeasures are also constrained by implementation cost. Because threats, vulnerabilities, and countermeasures are constantly evolving, these processes must be applied iteratively throughout the acquisition lifecycle of the system. Details on threats, vulnerabilities, and countermeasures are highlighted in the remainder of this section.

The following CPI elements are covered by consequence of compromise, justification for status with date, format, traceable requirement, physical location, exports control areas, and PPIP status in Table 7. The vulnerability is the systems’ or components’ susceptibility to the threat in a given environment. Due to the numerous CONUS and OCONUS locations, and multiple DoD branches using the system -- it would be difficult to capture in this format. End item security and protection at operating locations is accomplished via protective measures afforded to the operational asset (aircraft).

Table 9 identifies threats, vulnerabilities and countermeasures to CPI and critical functions/components and will be updated over time as the information is identified, early in the program. Absent a current threat assessment, the program conducted a preliminary analysis of the system from an adversary perspective to obtain the information identified in Sections 5.1-5.3.

The numbers in the threat and vulnerabilities tables will correspond to the numbered rows in the threat Table 11 and vulnerability Table 12.

Table 9 Summary of CPI Threat, Vulnerabilities, and Countermeasures CPI/CC (and CC supplier)

Section 2.2 Threats

Section 5.1 (Note 1)

Vulnerabilities Section 5.2

Countermeasures Section 5.3

CPI

See Appendix F2

Critical Components See Appendix F2

Note 1: Threat legend Code – Reflects collection mode or intelligence collection platforms.

(Source: Intelligence Threat Handbook). Refer to Table 11 for threat definition.

Note 2: Details of CPI and CC are listed in Appendix F.

5.1. Threats

The PPL is responsible for requesting and receiving threat products when CPI and critical functions/components are identified. ACLMC/WNY PNT PO is responsible for validating threat products on an annual basis from the AFOSI. The Counterintelligence (CI) and intelligence threat products will be requested for the program when CPI and critical functions/components are identified and used to identify vulnerabilities and countermeasures selected to mitigate risks of compromise. Threat products will be reviewed and/or updated prior to the next SETR or as the threat changes or is better understood.

After each CA evaluation and determination of CPI and CCs, the Positioning, Navigation, and Timing - Program Office (PNT-PO) will submit Defense Intelligence Agency (DIA) threat assessment requests for suppliers of critical components based upon specific supply chain threats and CI threat information. DIA threat assessments provide specific and timely threat characterization of the identified suppliers to inform program management, and are used by PMs to document supply chain risk and assist in selecting supplier or architecture alternatives and developing appropriate mitigations for supply chain risks. Based on the results of the DIA analysis, the PNT-PO PPL will brief the results to the PM and the ESSWG so that they may evaluate the risk to the system and apply SCRM countermeasures as appropriate, up to and including selecting a different set of suppliers or contractors that pose a low risk for exposure to intentional or unintentional supply chain subversion or counterfeit.

While the GPS STAR is coordinated by SMC/IN, an internal support organization, AFOSI is the outside agency that supplies the GPS ITA. Support from AFOSI, to include development of the ITA, is outlined in Appendix B, Counterintelligence Support Plan (CISP).

The Intelligence Operations (IO) Capstone provides a comprehensive perspective on the threats confronting DoD programs which depend upon information technology and systems. It does not address all potential adversaries but does focus on six countries of concern, as well as non-state actors, which serve as examples of the potential scope and severity of threat capabilities in the operational environments where information systems may be employed.

Table 10 identifies the threat products the Program used to identify foreign collection, battlefield loss and supply chain exploit threats to the Program and system. Table 11 identifies the threats the Program derived from the assessed threat products.

Table 10 Threat Product References

Title of Program-Specific or Other Threat Products Used for PPP Threat Analysis Classification Document

Date Organization(s) Producing the

Product

Reference/ Link to Product

Formal Threat Reports Counterintelligence Support Plan (CISP) S/NF TBD AFOSI RAFB See Note 1 Integrated Threat Assessment (ITA) S TBD AFOSI RAFB See Note 1 Program Protection Implementation Plan (PPIP) for Northrup Grumman (NGC) & Honeywell U TBD NGC & Honeywell

Vulnerability Study Final Report, EGI-M Development Program for NGC & Honeywell S TBD NGC & Honeywell

Systems Security Engineering (SSE) Plan for EGI- M program for NGC & Honeywell

S (PPP

Appendix) TBD NGC & Honeywell

Cybersecurity Security Assessment Report (SAR) for EGI-M program for NGC & Honeywell S TBD NGC & Honeywell

Supply Chain Threat Assessments

Other Threat Documents

Note 1: To request access to classified products, contact AFOSI/Det 105 at DSN 468-2141.

Threat products descriptions are as follows:

Counterintelligence Support Plan (CISP) - Coordinated action plan for CI support to protect research and technology at specific DoD research, development, test, and evaluation facilities and acquisition programs. The plan addresses key aspects of the installation, the activity or program, and the nature of the CI activities to be employed. A separate plan may be prepared for each DoD contractor or academic institution where CPI are involved.

Integrated Threat Assessment (ITA) - Assessment to support intelligent risk taking through the provision of supporting services, which are responsible for the risk information requirements identification, collection planning and management, processing, integration, analysis and dissemination of security relevant data and knowledge products to support centralized and decentralized decision making on safety and security matters.

Program Protection Implementation Plan (PPIP) for NGC & Honeywell - Use Systems Engineering as a holistic approach, which is an integrated, federated approach to merge current stakeholder processes into a unified, prioritize System Security process to protect program information by various methods and safeguards to include but not be limited to: SSE, Cyber Security, SCRM, Software Assurance, and Operational Security.

Vulnerability Study Final Report, EGI-M Development Program for NGC & Honeywell - Vulnerability analysis, also known as vulnerability assessment, is a process that defines, identifies, and classifies the security holes (vulnerabilities) in a system, computer, network, or communications infrastructure. In addition, vulnerability analysis can forecast the effectiveness of proposed countermeasures and evaluate their actual effectiveness after they are put into use.

Systems Security Engineering (SSE) Plan for EGI-M program for NGC & Honeywell - Plan implemented that will 1. Deter exploitation and countermeasure development that decrease our warfighting capabilities, 2. Prevent the augmentation or change in capabilities in a Direct Commercial Sale (DCS) or Foreign Military Sale (FMS) system, 3. Protect U.S. critical design knowledge and manufacturing processes, and 4. Slow reverse engineering and proliferation.

Cybersecurity Security Assessment Report (SAR) for EGI-M program for NGC & Honeywell - Based on the Cybersecurity strategy, the SAR contains the results from the Cybersecurity assessments and the effectiveness of the security controls implemented.

Table 11 Identified or Potential Threats T# Threat Description Consequence of threat realization 1 Human Intelligence

(HUMINT) Collection Covert intelligence-gathering by agents or others of information that can be collected from human sources.

Compromise, delay, disruption, or denial of U.S.

technology lead & GPS services or capabilities

2 Malicious Code Insertion of malware into the critical components that processes data.

Degraded or untrustworthy performance of GPS services or capabilities

3 Counterfeit Parts ASIC/FPGA, at a minimum. But also includes other electronic devices or components which processes or stores data.

Degraded or untrustworthy performance of GPS services or capabilities

4 Unauthorized Disclosure of Information and Technical Data

Disclosure of information that violates or is in conflict with DoD GPS security policy or Joint Staff operational doctrine on PNT services. Disclosure of technical data controlled under the Arms Export Control Act.

Compromise, delay, disruption, or denial of U.S.

technology lead & GPS services or capabilities

5 Unauthorized Modification or Forgery

Changes to H/W, S/W or data in violation technical specifications or drawing, DoD security policy or Joint Staff doctrine on PNT service.

Degraded or untrustworthy performance of GPS services or capabilities

6 Denial of Service Access to GPS resource, data or PNT service by the authorized user is denied on a permanent or temporary basis. Attacked

Compromise, delay, disruption, or denial of U.S.

considered effective even when access is momentarily delayed but adversely impacted time-critical operations.

technology lead & GPS services or capabilities

7 Inability to Restore Services

After the service is denied the inability to restore or recover the service.

Compromise, delay, disruption, or denial of U.S.

technology lead & GPS services or capabilities

8 Signals Intelligence

(SIGINT)

A category of intelligence comprising either individually or in combination all communications intelligence, electronic intelligence, and foreign instrumentation signals intelligence, --however transmitted.

Compromise of U.S.

technology lead & GPS services or capabilities

9 Communications Intelligence (COMINT)

Technical and intelligence information derived from the intercept of foreign communications by other than the intended recipients of those communications.

Compromise of U.S.

technology lead & GPS services or capabilities

10 Electronic Intelligence

(ELINT)

Includes the interception and analysis of non-communications transmissions.

Compromise, delay, disruption, or denial of U.S.

technology lead & GPS services or capabilities

11 Foreign Instrumentation Signals Intelligence

Signals for the transmission of data location or tracking information during tests or operations of foreign weapons systems.

Compromise of U.S.

technology lead & GPS services or capabilities

12 Imagery Intelligence Intelligence derived from the exploitation of collection by visual photography, infrared sensors, lasers, electro-optics, and radar sensors such as synthetic aperture radar wherein images of objects are reproduced optically or electronically on film, electronic display devices, or other media. This category also includes imagery gathered via satellites.

Compromise of U.S.

technology lead & GPS services or capabilities

13 Measurement and Signature Intelligence

Scientific and technical intelligence obtained by quantitative and qualitative analysis of data (metric, angle, spatial, wavelength, time dependence, modulation, plasma, and hydro magnetic). This data is derived from specific technical sensors for the purpose of identifying any distinctive features associated with the source, emitter, or sender. This facilitates subsequent identification and or measurement of the same.

Compromise of U.S.

technology lead & GPS services or capabilities

14 Open-Source Intelligence -

Information of potential intelligence value that is available to the general public.

Compromise, delay, disruption, or denial of U.S.

technology lead & GPS services or capabilities

5.2. Vulnerabilities

Table 12 summarizes potential vulnerabilities in the absence of a current threat assessment. The Program will identify new vulnerabilities (both system-level and in the development environment) to CPI and mission-critical functions and components through Information Assurance (IA) vulnerability assessments, DIA Threat Assessment Center (TAC) assessments and AFOSI threat assessments. The PPL, in coordination with the Lead SE (listed in Section 1.2), is responsible for doing this and vulnerabilities will be re-assessed and/or updated prior to the next SETR or as the threat changes or is better understood. Vulnerabilities to EGI-M are identified throughout the system lifecycle through a variety of means, including the Risk Management Framework (RMF) and traditional vulnerability assessments and threat and intelligence reporting. Once a new threat is identified, the SE and PPL, with inputs from the prime contractors, will assess the threat and determine if additional vulnerabilities need to be taken into consideration. Vulnerabilities will be reassessed at least once a year or when new vulnerabilities are identified. The SE and PPL, with inputs from the prime contractors, will determine appropriate mitigation for the vulnerability. Identified vulnerabilities to CPI will be mitigated and addressed in SSE documentation and vulnerabilities to mission-critical functions and components will be mitigated and addressed in the cybersecurity strategy and application of key practices identified in the DoD SCRM Pilot Program Implementation Guide.

Table 12 Potential CPI and CC Vulnerabilities V# CPI/Critical Components Identified Vulnerabilities 1 See Appendix D: System Security Engineering

(SSE) Plan an Appendix F1 See Table 10 Threat Products

Note 1: Details of CPI and CC are listed in Appendix F.

5.3. Countermeasures

Countermeasures will be selected to protect CPI and critical functions/components based on the threat and guidance from the AT Technical Warrant Holder, DoD SCRM Key Practices and Implementation Guide, National Security Agency (NSA) encryption guidance, software assurance techniques (Common Vulnerabilities and Exposures (CVE™), Common Attack Pattern Enumeration and Classification (CAPEC), Common Weakness Enumeration (CWE), testing), National Industrial Security Program Operating Manual (NISPOM) guidance and system security design considerations. The PPL identified in Section 1.2 is responsible for their implementation. Contracts supporting the acquisition program will incorporate protection requirements in the Request For Proposal (RFP) Contract Line Item Number (CLIN) or Data Item Description (DID) to ensure CPI and critical functions/components are protected in the development environment and on the system. Table 13 identifies the contracts containing the protection requirements for the EGI-M Program. Table 9 describes the implementation of each countermeasure used to protect CPI and critical functions and components. Table 5 indicates planned implementation and actual implementation as the PPP evolves. Table 15 addresses the implementation of the countermeasures in Section 5.3.1 – 5.3.5. Countermeasures to protect CPI and critical functions/components will be selected by the SE and PPL with inputs from the prime contractors.

Table 13 Protection Requirements Incorporation into Contracts Protection Requirements in Contracts Classification Data Item Description (DID) Program Protection Implementation Plan (PPIP) for NGC & Honeywell U DI-ADMN-81306

System Security Engineering (SSE) for EGI-M program for NGC & Honeywell

Secret (PP P appendix)

DI-MISC-80508B

DOD IA Cert and Accreditation Process (DIACAP) and RMF data deliverables for EGI-M program for NGC & Honeywell

S

DI-MGMT-82000

EGI-M Prime Item Development Specification FOUO DI-SESS-81877

5.3.1. System Security Engineering (SSE)

The EGI-M program will incorporate SSE into the acquisition process by reviewing the CA results and related system security artifacts at each SETR. System security is included in the system engineering trade space with other quality attributes. System security requirements for hardware, software and firmware are traceable through the relevant acquisition and development documents. The Lead SE is responsible for SSE. SSE goals of preventing misuse and malicious behavior, to include activities identified in the security requirements traceability matrix, security architecture, threats, vulnerabilities, risks and countermeasures analysis, computing environment assessments, security testing, disaster recovery, incident response plan/procedures and ports and protocols analysis are all linked in the Systems Engineering Plan (SEP). System security design considerations will be addressed by SEs who will evaluate security aspects in the design of the system, specifically the capability to deal robustly with possible sources of disruption.

The PPL will identify SSE requirements (if CPI identified) and is responsible for developing an SSE documentation. The SSE documentation will be completed by Milestone (MS) B.