Cybersecurity Strategy

The cybersecurity strategy is a plan of action to maximize an organization’s computer network security and resiliency. The strategy is a required acquisition program document (per DoD Instruction 5000.02 and Clinger-Cohen Act) that details how a program will ensure that an Information Technology system can protect and defend itself from a cyber attack. The Program Office created and maintained the strategy and appended it to the Program Protection Plan (PPP). It’s required for all Acquisition Category (ACAT) level programs.

Definition: The Cybersecurity Strategy is a tool for Program Managers, Authorizing Officials (AO) or Authorizing Official Designated Representatives (AODR), and relevant review and approval authorities to plan for, identify, assess, mitigate, and manage risks as systems mature.

What is Cybersecurity

Cybersecurity falls under Information Operations (IO) and is used to protect and defend information and information systems. It’s the practice of keeping digital attacks from taking down important systems and sensitive information. They are meant to protect networked systems and applications from threats from inside or outside an organization.

Definition: “Cybersecurity is the prevention of damage to, protection of, and restoration of computers, electronic communications systems, electronic communications services, wire communication, and electronic communication, including information contained therein, to ensure its availability, integrity, authentication, confidentiality, and nonrepudiation”. DoD Instruction 8500.0

Cybersecurity Strategy Goal

The cybersecurity strategy aims to make a computer network resilient to cyber-attacks.

Cybersecurity Strategy Development

The Program Manager (PM) develops the Cybersecurity Strategy as early as possible and continually updates and maintains it to mature at a rate commensurate with the program. The Cybersecurity Strategy reflects the program’s long-term approach to and implementation of cybersecurity throughout the program lifecycle. Beginning at Milestone A, the PM will submit the Cybersecurity Strategy to the cognizant Component Chief Information Officer (CIO) for review and approval before milestone decisions or contract awards.

Guide: Cybersecurity Strategy Outline and Guidance – 24 Jun 21

Steps to Developing a Cybersecurity Strategy

There are seven steps associated with the development of a Cybersecurity Strategy.

Step 1: Determine organizationally Cyber Goals
Step 2: Determine what risk the organization faces and what’s critical to protect.
Step 3: Develop risk matrix and integrate with Risk Management Framework (RMF)
Step 4: Develop protective monitoring
Step 5: Establish a management approach
Step 6: Develop an action plan of incidents
Step 7: Review schedule for Continuous Improvement

Cybersecurity Strategy Outline: [1]

Introduction
Sources of Cybersecurity Requirements
Management Approach
Technical Approach
Implementation Progress
Operations and Sustainment
Policy and Guidance
Points of Contact(s)
Other Considerations
Signature Page

Cybersecurity Strategy Principals [1]

Program Offices should use the following principles to ensure the document is useful as a plan and working document for the program, and to support cybersecurity and acquisition review and
approval functions. These principles form the basis of CIO evaluation criteria in review of Cybersecurity Strategies:

Evidence of comprehensive analysis, including System Security Engineering (SSE), Trusted Systems and Networks (TSN) Analysis, and system survivability, supporting the planning and
implementation of cybersecurity on the system, including the intended CONOPS, operating environment and tempo, understanding of expected level of threat leading to the determination of adequate system cybersecurity implementation and achievement of desired operational outcomes.
Evidence of traceability between security controls and the baselines (functional, allocated, and product), and understanding of the balance between risks and requirements trades.
Consideration of cybersecurity in relation to the interdependency of this system with the system of systems in which it is intended to operate; the degree to which the capability depends on cybersecurity to perform its key functions and missions.
Planning for cybersecurity testing and evaluation throughout the acquisition lifecycle, including testing of security controls in accordance with the RMF; ensuring cybersecurity requirements are testable and measurable.
Evidence and understanding of ongoing risk management, including residual risks stemming from the failure to mitigate identified cybersecurity risks and vulnerabilities.

Cybersecurity Strategy Regulations

REGULATORY: for all other programs containing IT, including NSS. The Cybersecurity Strategy is an appendix to the Program Protection Plan (PPP). A draft update is due for the Development RFP Release and is approved at Milestone B. May include the approved DoD Risk Management Framework Security Plan for urgent needs. The DoD CIO is the approval authority for Acquisition Category (ACAT) ID and all ACAT IA programs; the Component CIO is the approval authority for all other ACATs. [2]

Cybersecurity Strategy Focus Areas

A cybersecurity strategy should focus on the key areas below to be comprehensive. These areas are:

Computer Systems
System Development
Critical infrastructure
Network security
Application security
Cloud security
Policy
Training
Continuous Improvement

AcqLinks and References:

Updated: 11/25/2022

Rank: G14.6

Intelligence & Security