CUI_Guide_ARCOS_1.0.pdf

Distribution A: Approved for Public Release: distribution unlimited

Controlled Unclassified Information Guide

Automated Rapid Certification Of Software

Program Manager: Dr. Raymond Richards

Program Security Officer: Ms. Denice Holden

Date: June 10, 2019

Version: 1.0

1 Background The goal of the Automated Rapid Certification Of Software (ARCOS) program is to automate the evaluation of software assurance evidence to enable certifiers to determine rapidly that system risk is acceptable. ARCOS will use two approaches to accelerate software certification.

First, automatic generation of evidence-backed assurance case arguments software meets its certification criteria. Second, principled composition of assurance, allowing modular certification evaluations. Achieving this goal requires research breakthroughs in:

• The generation of assurance evidence, that will result in high-confidence evaluations for both legacy and newly developed software.

• Curation of large amounts of disparate assurance evidence to facilitate the mining of the evidence to substantiate assurance arguments.

• Generation of assurance arguments for certification criteria.

• Validation of assurance arguments, including assessing the confidence in the argument.

2 Purpose This guide identifies those aspects of the program that performers must handle as Controlled Technical Information (CTI). In addition, each performer must determine and assert the export controls (either Export Administration Regulations or International Traffic in Arms Regulations) relevant to their project, and communicate that assertion to their contracting agent and to the DARPA Program Manager.

Questions concerning the content and interpretation of this guide and/or recommendations for changes due to current conditions, progress made in program research, scientific technological developments, advances in state of the art, or other factors should be directed to the DARPA Program Manager. All users of this guide are encouraged to assist in improving its currency and adequacy.

3 Definition of Controlled Technical Information for the Program DOD considers “technical information” to be technical data or computer software, as those terms are defined in Defense Federal Acquisition Regulation Supplement clause 252.227-7013, "Rights in Technical Data - Noncommercial Items" (48 CFR 252.227-7013). Examples of technical information include research and engineering data, engineering drawings, and associated lists, specifications, standards, process sheets, manuals, technical reports, technical orders, catalog-item identifications, data sets, studies and analyses and related information, and computer software code. Note that such technical information may or may not be controlled (i.e., CTI), depending on whether it has military or space application.

Controlled Technical Information (CTI) is defined as technical information with military or space application that is subject to controls on its access, use, reproduction, modification, performance, display, release, disclosure, or dissemination. The term CTI does not include information that is lawfully publicly available without restrictions.

For the ARCOS Program, DARPA considers that all documentation, system outputs, test results and work products related to the application of any program-developed algorithm, technique, or capability to a militarily relevant platform to be minimum CTI. Such detailed technical information could reveal sensitive or even classified capabilities and/or vulnerabilities of that military platform.

4 Safeguarding & Marking CTI The Contractor shall not release CTI to anyone outside the Contractor’s organization or to a Foreign National, regardless of medium (e.g. file, tape, and document), pertaining to any part of this contract or any program related to this contract, unless DARPA has provided prior written approval. Please submit requests for release of CTI to both the ARCOS Program Manager and Program Security Officer.

Contractor information systems shall be subject to the security requirements in National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171. “Protecting Controlled Unclassified Information in Nonfederal Information Systems and Organizations”. DARPA can provide guidance on how to implement 800-171 controls.

CTI is to be marked “DISTRIBUTION C. Distribution authorized to U.S. Government agencies and their contractor; Critical Technology; December 2017. Other requests for this document shall be referred to DARPA, I2O.”, in accordance with Department of Defense Instruction 5230.24, "Distribution Statements on Technical Documents."

Material that does not contain CUI does not require marking. The lack of distribution statement does not automatically approve the information for public release. DARPA unclassified information must be reviewed for public release IAW with the performer’s contract.

5 Aspects of the Program that Will Not Generate CTI DARPA considers that the algorithms developed on this program will constitute advances to the state of the art and are not CTI when realized in source code or executable formats, or when documented in written reports. The outputs and work products resulting from application of algorithms to non-militarily relevant target platforms are not considered CTI. In this context, the term algorithm is defined as the representation of a sequence of abstract logical and/or mathematical operations performed on data. Any algorithm that must be trained on or configured with respect to particular sets of data to achieve its intended functionality is not CTI in its pre-trained form, but instances of that algorithm that have been trained on or configured by CTI data must be treated as CTI. For example, the algorithms required to train and run a neural network are not considered CTI, but the resulting neural network would be CTI if it were trained on a CTI dataset.

The following work products by Technical Area (TA) are not CTI:

TA1 Evidence Generation

• All assurance evidence and ancillary data derived from software and associated data that contain no information derived from CTI sources.

• All tool configuration data derived from sources not already deemed CTI.

TA2 Evidence Curation

• Evidence that is curated by the application of TA 2 tools to assurance evidence and design data that cannot be reasonably attributed to any data not already deemed CTI.

• All tool configuration data derived from sources that do not include CTI or cannot reasonably be attributed to any data derived from CTI sources.

TA3 Assurance Generation

• Generated assurance case arguments derived from software, assurance evidence, and other data that contain no information derived from CTI sources.

• All tool configuration data derived from sources not derived from CTI sources.

TA4 Quantitative Assessment

• Testbed data derived from sources that contain no information derived from CTI sources.

• Evidence or assurance cases selected for quantitative evaluation not derived from CTI sources.

6 Publication All performers must follow the publication guidelines outlined in their contract. Performers requiring pre-publication review must submit any request through DARPA’s DISTAR Process.

6 Publication