Cyber Resiliency and Cybersecurity Policy

Mission— Cyber Resiliency & Cybersecurity Policy

The Cyber Resiliency & Cybersecurity Policy program supports the efforts of the Office of the Under Secretary of Defense, Acquisition and Sustainment (OUSD A&S), focusing on the defense of the Department’s critical mission weapon systems and supporting DoD Installation Critical Infrastructure (ICI)and supporting Commercial Critical Infrastructure (CCI)from cyber attack, protecting the Department’s sensitive unclassified information residing within the Defense Industrial Base (DIB) sector and supply chain , and capability portfolio management for Joint Cyber Capabilities used by the Cyber Mission Force. This program funds the following critical efforts: 1) Cybersecurity for Weapon Systems and Critical Infrastructure: Conduct Capability Portfolio Management and lead the Department’s Strategic Cybersecurity Program (SCP) to continue critical weapon systems and ICI cybersecurity assessments and mitigations and cyber harden priority Department of Defense (DoD) missions. Office of Assistant Secretary of Defense for Acquisition (ASD(A))/Cyber Warfare Directorate (CWD) Cyber Resiliency efforts are aligned with the following initiatives: Assess: - Conduct mission level cyber risk assessments for priority Defense Missions in support of Combatant Commands (CCMDs). Conduct enhanced mission level cyber risk assessments/wargames for the Missile Defense Mission in support of Golden Dome for America. Conduct supporting table top exercises (TTXs). - Conduct Cyber Risk Assessments for ICI and CCI in support of CCMDs and asset owners. - Conduct Integrated Sensing Monitoring Experiments (ISMX)and Sensing and Monitoring Pilots to assess the performance of Cybersecurity Sensing and Monitoring capabilities for WS and ICI. Inventory / Prioritize: - Develop, sustain, and employ the Cyber Risk Mitigation Tool (CRMT), an Enterprise-wide decision support tool for tracking and prioritizing cyber vulnerability assessments and mitigations. Develop CCMD specific cyber risk scorecards/risk matrices. - Prioritize and advocate for Cyber Risk Mitigations based upon mission analysis conducted by program offices, the National Security Agency (NSA), Deep Cyber Resiliency Assessment teams, USCYBERCOM (USCC), and other cybersecurity professionals. Mitigate: - Advocate and oversee funding for priority ICI and commercial critical infrastructure (CCI) supporting Golden Dome for America based on a prioritized list of assets. - Conduct SCP POAM periodic updates with Services and Agencies for prioritized DoD weapon systems. Enhance Governance: Conduct 4-Star Level Integrated Acquisition Portfolio Reviews (IAPRs) that address cybersecurity / cyber hardening / cyber defense for priority DoD missions. 2) Weapon System Cyber Security – CCI Cybersecurity // Cybersecurity Supply Chain Risk Management (C-SCRM): In collaboration with the Department of Defense Chief Information Office (DoD CIO), conduct the C-SCRM in support of FY2019 NDAA Section 889, and Title 10 USC Section 3252 and Section 4713 . Partner with other DoD organizations and the DIB / CCI sectors to demonstrate / assess cost-effective and scalable cybersecurity services that augment and/or enhance existing commercial capabilities and services. Focus on identifying options and assessing the efficacy of cybersecurity services for small-to-medium sized DIB / CCI companies that are critical to the DoD supply chain but lack sufficient cybersecurity capabilities to protect CUI , data integrity, and availability of DIB supply chain. 3) Capability Portfolio Management for Cyberspace Operations: Conduct Capability Portfolio Management of the Joint Cyber Capabilities employed by Cyber Mission Force in collaboration with USCYBERCOM. Improve cyber lethality of the capabilities of Joint Cyber Warfighting Architecture (JWCA) supporting offensive and defensive cyberspace operations and improve the readiness of the Cyber Operations Forces to operate in a cyber-contested environment including the ability to Defend the Homeland and key capabilities such as Golden Dome. Work across the Department to reform acquisition processes and accelerate the adoption of modern software practices to deliver warfighting capability at the speed of need.

Mission— Cyber Resiliency & Cybersecurity Policy

FY 2026 request for program element includes $14.220 million of discretionary and $25.000 million of mandatory (reconciliation) for a total of $39.220 million. The mandatory funds are for Golden Dome Cybersecurity (U). Further information for this reconciliation request is provided in section 20003 of the Reconciliation Exhibit. This PE supports the Department's initiatives to Revive the Warrior Ethos, Rebuild Our Military, and Reestablish Deterrence. The Cyber Resiliency & Cybersecurity Policy program supports the efforts of the Office of the Under Secretary of Defense, Acquisition and Sustainment (OUSD A&S), focusing on the defense of the Department’s critical mission weapon systems and supporting DoD Installation Critical Infrastructure (ICI)and supporting Commercial Critical Infrastructure (CCI)from cyber attack, protecting the Department’s sensitive unclassified information residing within the Defense Industrial Base (DIB) sector and supply chain , and capability portfolio management for Joint Cyber Capabilities used by the Cyber Mission Force. This program funds the following critical efforts: 1) Cybersecurity for Weapon Systems and Critical Infrastructure: Conduct Capability Portfolio Management and lead the Department’s Strategic Cybersecurity Program (SCP) to continue critical weapon systems and ICI cybersecurity assessments and mitigations and cyber harden priority Department of Defense (DoD) missions. Office of Assistant Secretary of Defense for Acquisition (ASD(A))/Cyber Warfare Directorate (CWD) Cyber Resiliency efforts are aligned with the following initiatives: Assess: - Conduct mission level cyber risk assessments for priority Defense Missions in support of Combatant Commands (CCMDs). Conduct enhanced mission level cyber risk assessments/wargames for the Missile Defense Mission in support of Golden Dome for America. Conduct supporting table top exercises (TTXs). - Conduct Cyber Risk Assessments for ICI and CCI in support of CCMDs and asset owners. - Conduct Integrated Sensing Monitoring Experiments (ISMX)and Sensing and Monitoring Pilots to assess the performance of Cybersecurity Sensing and Monitoring capabilities for WS and ICI. Inventory / Prioritize: - Develop, sustain, and employ the Cyber Risk Mitigation Tool (CRMT), an Enterprise-wide decision support tool for tracking and prioritizing cyber vulnerability assessments and mitigations. Develop CCMD specific cyber risk scorecards/risk matrices. - Prioritize and advocate for Cyber Risk Mitigations based upon mission analysis conducted by program offices, the National Security Agency (NSA), Deep Cyber Resiliency Assessment teams, USCYBERCOM (USCC), and other cybersecurity professionals. Mitigate: - Advocate and oversee funding for priority ICI and commercial critical infrastructure (CCI) supporting Golden Dome for America based on a prioritized list of assets. - Conduct SCP POAM periodic updates with Services and Agencies for prioritized DoD weapon systems. Enhance Governance: Conduct 4-Star Level Integrated Acquisition Portfolio Reviews (IAPRs) that address cybersecurity / cyber hardening / cyber defense for priority DoD missions. 2) Weapon System Cyber Security – CCI Cybersecurity // Cybersecurity Supply Chain Risk Management (C-SCRM): In collaboration with the Department of Defense Chief Information Office (DoD CIO), conduct the C-SCRM in support of FY2019 NDAA Section 889, and Title 10 USC Section 3252 and Section 4713 . Partner with other DoD organizations and the DIB / CCI sectors to demonstrate / assess cost-effective and scalable cybersecurity services that augment and/or enhance existing commercial capabilities and services. Focus on identifying options and assessing the efficacy of cybersecurity services for small-to-medium sized DIB / CCI companies that are critical to the DoD supply chain but lack sufficient cybersecurity capabilities to protect CUI , data integrity, and availability of DIB supply chain. 3) Capability Portfolio Management for Cyberspace Operations: Conduct Capability Portfolio Management of the Joint Cyber Capabilities employed by Cyber Mission Force in collaboration with USCYBERCOM. Improve cyber lethality of the capabilities of Joint Cyber Warfighting Architecture (JWCA) supporting offensive and defensive cyberspace operations and improve the readiness of the Cyber Operations Forces to operate in a cyber-contested environment including the ability to Defend the Homeland and key capabilities such as Golden Dome. Work across the Department to reform acquisition processes and accelerate the adoption of modern software practices to deliver warfighting capability at the speed of need.

Accomplishments & Planned Programs (1)