Attachment 0012 - Cybersecurity Requirements for DoW Automation.pdf

Cybersecurity Requirements for DoW Automation & Robotics Projects

Contractors seeking to bid on Department of War (DoW) automation and robotics projects must demonstrate compliance with a stringent set of interlocking cybersecurity standards. At a minimum, this includes adherence to DFARS 252.204-7012, implementation of all 110 controls in NIST SP 800-171, and preparation for the appropriate Cybersecurity Maturity Model Certification (CMMC) level.

Furthermore, contractors must secure their entire supply chain, prioritize products from the DoDIN Approved Products List (APL), and prepare to meet emerging requirements such as providing a Software Bill of Materials (SBOM) and designing for Zero Trust architecture. Compliance is not optional and is a critical factor for contract award.

Core Compliance Frameworks

These frameworks represent the foundational cybersecurity requirements for any contractor working with the DoW.

Framework Description

DFARS

252.204-7012

Defense Federal Acquisition Regulation Supplement mandates that contractors protect "Covered Defense Information" (CDI) and report cyber incidents within 72 hours. For automation and robotics, this means any data related to the design, operation, or maintenance of these systems must be secured according to these standards.

NIST SP 800-

53 Rev. 5

Security and Privacy Controls for Information Systems and

Organizations: This publication is the foundational catalog of security and privacy controls for all federal information systems. It provides a comprehensive library of controls from which specific security baselines are established.

NIST SP 800-

DFARS 252.204-7012 requires the implementation of the security controls outlined in NIST SP 800-171. This publication details 110 security controls for protecting CUI in non-federal systems. It is important to note that these 110 controls are derived directly from the more comprehensive NIST SP 800-53 moderate baseline.

CMMC

DFARS

252.204-

The Cybersecurity Maturity Model Certification program verifies a contractor's implementation of cybersecurity standards through a tiered model. Contractors must achieve a specific CMMC level, often requiring a third-party assessment, to be awarded a contract.

DoDIN APL The Department of Defense Information Network (DoDIN) Approved

Products List is a consolidated list of products that have passed rigorous cybersecurity and interoperability certifications. Contractors should prioritize using products from this list to ensure they meet DoD standards.

Operational Technology & Facility Security

Due to the nature of this project, specific requirements for Operational Technology (OT), Industrial Control Networks (ICN), and Facility-Related Control Systems (FRCS) are in effect.

Requirement Description

NIST SP 800-

82 Rev. 3

Guide to Operational Technology (OT) Security: Adherence to the principles within NIST SP 800-82 is paramount. This guide provides specific directions on securing OT systems, such as ICNs, robotics, and automation. Contractors must demonstrate how their system design aligns with the defense-in-depth strategies and OT-specific risk management principles detailed in this publication.

UFC 4-010-06 Cybersecurity of Facility-Related Control Systems: Compliance with this Unified Facilities Criteria (UFC) is mandatory for the design and implementation of all FRCS (e.g., HVAC, power, access control).

This UFC requires the integration of the RMF from the project's inception, ensuring that cybersecurity is a foundational part of the facility design, not an afterthought.

Additional Authoritative Requirements

Beyond the core frameworks, contractors must be aware of other significant requirements that govern the security of their systems and software.

Requirement Description

Risk Management

Framework (RMF)

The DoW has transitioned to a dynamic risk management construct managed through the Enterprise Mission Assurance

Support Service (eMASS) tool. This five-phased lifecycle

(Design, Build, Test, Onboard, Operations) embeds security from the start and emphasizes continuous, automated risk management.

Bill of Materials

(BOM)

Driven by Executive Orders, the DoW increasingly requires contractors to provide a hardware and software BOM, which is a detailed inventory of all hardware and software components and their supply chain relationships. This is critical for identifying and managing vulnerabilities within the software supply chain.

FedRAMP If a contractor's solution involves cloud-based services for storing or processing CUI, that Cloud Service Provider (CSP) must have, at minimum, a FedRAMP Moderate authorization or its equivalent.

DoW Zero Trust

Strategy

The DoW is actively transitioning to a Zero Trust (ZT) security model. Proposed designs for this facility must incorporate ZT principles, including robust identity and access management and micro-segmentation, to ensure the system is secure and aligned with the DoW's future direction.

Supply Chain Security

A significant area of focus is the security of the supply chain. Contractors are responsible for ensuring that their subcontractors also comply with these cybersecurity requirements. This "flow-down" of requirements is a critical aspect of DFARS and

CMMC. The security of the entire supply chain is paramount, especially in automation and robotics, where components can come from various sources.

Recommendations for Bidding Contractors

• Conduct a Gap Analysis: Assess your current cybersecurity posture against NIST

SP 800-171 to identify any gaps.

• Develop a System Security Plan (SSP): This document outlines how security controls are implemented.

• Prepare for CMMC: Begin preparing for CMMC certification, as it will become a go/no-go criterion for many DoW contracts.

• Prioritize Approved Products: Whenever possible, use products from the DoDIN

APL and FedRAMP-authorized cloud services.

• Secure the Supply Chain: Verify that all subcontractors are following these cybersecurity requirements and are prepared to provide an SBOM when required.

• Design for OT & Zero Trust: Ensure your technical solution is purpose-built for the unique demands of OT/ICN security and aligns with the DoW's Zero Trust strategy.