Cybersecurity Integration Activity YES NO Reference Comments / Remarks Materiel Development Decision (MDD) DoDI 5000.02 Information Systems Security Manager (ISSM) appointed and qualifications of system security engineer(s) ensured DoDI 8510.01 Security Plan initiated DoDI 8510.01; See RMF Knowledge Service for template System categorized (identify potential impact levels due to the loss of confidentiality, integrity, and availability) to support Initial Capabilities Document (ICD) development DoDI 8510.01; CNSSI 1253 ISSM and System Security Engineer (SSE) assessed cybersecurity risk per criteria in Analysis of Alternatives (AoA) study plan and cybersecurity capability requirements from the ICD DoDI 5000.02 Sponsor and Joint Staff developed preferred cybersecurity risk solutions DoDI 5000.02 Chief Engineer (CE), ISSM, User Representative (UR), Sponsor, CIO and SSE identified applicable cybersecurity enterprise architectures in the system conceptual design DoDI 8510.01; DoDI 5000.02 Security control baseline and overlays selected and tailoring begun DoDI 8510.01; CNSSI 1253 CE and SSE ensured that the initial security controls baseline traces to the preliminary system performance specifications that comprise the preliminary functional baseline DoDI 8510.01 Initial Trusted Systems and Networks (TSN) Analysis conducted: CE and SSE conducted TSN Analysis focused at mission level, including Criticality Analysis (CA) to identify critical functions, Threat Assessment (TA), Vulnerability Assessment (VA), TSN Risk Assessment, and countermeasure selection DoDI 5200.44; DoDI 5000.02 Initial Cybersecurity Risk Assessment completed: CE and ISSM conducted cybersecurity risk assessment using the mission context as described in the ICD with DoDI 8510.01
Cybersecurity Integration Activity YES NO Reference Comments / Remarks System functional baseline evaluated to satisfy the draft CDD’s cybersecurity requirements; functional requirements and verification methods support achievement of performance requirements in the SFR; and that functional requirements and verification methods support the initial EMD RFP development CJCSI 3170.01H Test and Evaluation Master Plan (TEMP) aligned with the Security Assessment Plan, Systems Engineering Plan (SEP), PPP, Cybersecurity Strategy, System Threat Assessment Report (STAR), and Acquisition Strategy DoDI 5000.02 SCA developed the Security Assessment Plan. Security Assessment Plan aligned with the TEMP, SEP, PPP, Cybersecurity Strategy, and acquisition strategy DoDI 8510.01 SEP and PPP updated and aligned with the TEMP, Security Assessment Plan, and acquisition strategy DoDI 5000.02 EMD RFP developed including cybersecurity language, and acquisition strategy updated and aligned with the TEMP, Security Assessment Plan, and SEP DoDI 5000.02 Developmental RFP Release Reference: DoDI 5000.02 Allocated baseline defined (including cybersecurity considerations) DoDI 5000.02 Preliminary Design Review (PDR) DoDI 5000.02 Cybersecurity Strategy submitted to AO DoDI 5000.02 Milestone B – Security Plan and Cybersecurity Strategy submitted to CIO Reference: DoDI 5000.02 Milestone B Exit Criteria Approved DoDI 5000.02 Cybersecurity requirements mapped and allocated to the hardware and software design for the system as part of the overall system development process to support test and evaluation planning DoDI 5000.02 Attack surface characterized and assessment begun for cybersecurity planning and performing component and system integration testing DoDI 5000.2 (DAG Chapter 9) Critical Design Review (CDR) entrance criteria met for cybersecurity baseline design and all cybersecurity requirements reflected in the product baseline including the design DoDI 5000.02 (DAG Chapter 4) CDR DoDI 5000.02 TSN analysis updated and focused on functions, including CA to identify critical functions, TA, VA, TSN Risk DoDI 5200.44 DoDI 5000.02