Assessments and Evaluations Cyber Vulnerabilities

Mission — Assessments and Evaluations Cyber Vulnerabilities source

This funding line reduces the Army's risk to adversarial cyber intrusions or attacks that could compromise critical weapon/business systems and kill chains. Cyberspace Operational-Resilience Assessment - Platform (CORA-P) is the Army program to improve survivability across Army modernization efforts and maintain readiness of operational capabilities. CORA-P addresses Congressional requirements beginning with FY16 NDAA Section-1647, and through FY24 NDAA Section-1502, which directs the Services to identify and mitigate cyberspace vulnerabilities in critical weapon systems. Under CORA-P, the Army identifies and prioritizes capabilities most-relevant to National Defense Strategy priorities based on input from mission planning, JROC guidance, and sensitive threat intelligence. The Army then reviews the security posture of these critical components, develops remediation strategies, and facilitates delivery of fixes at mission-relevant speed. CORA-P is helping move the DoD from system-oriented compliance to system-of-systems resilience that addresses defensive gaps between individual components; this is necessary to prevent adversaries from denying critical kill chains. CORA-P ensures Army cyberspace remediation investments address areas of highest operational risk.

Mission — Cyber Vulnerabilities Assessments and Evaluations source

This funding line reduces the Army's risk to adversarial cyber intrusions or attacks that could compromise critical weapon systems and kill chains. Cyberspace Operational-Resilience Assessment - Platform (CORA-P) is the Army program to improve survivability across Army modernization efforts and maintain readiness of operational capabilities. CORA-P addresses the requirements of Section 1502 of the FY24 NDAA, which directed the Services to harmonize the identification and mitigation cyberspace vulnerabilities in critical weapon systems. Headquarters, Department of the Army initially established CORA-P to continue Section 1647 assessments, while expanding to include supply chain risk analysis and electromagnetic spectrum vulnerabilities. CORA-P has since shifted from executing new assessments to harmonizing defensive efforts across existing Army and DoD assessment programs (including the Strategic Cybersecurity Program). CORA-P now focuses on developing and delivering vulnerability remediations that result from these assessments as well as from sensitive threat intelligence and other potential indicators of compromise. Activities include improving the structure and visibility of vulnerability data to improve portfolio risk management, initiating remediation efforts for high-priority, crosscutting issues, and avoiding future risks by driving improvements earlier in materiel development for modernization programs. As part of CORA-P, the Army identifies and prioritizes capabilities most-relevant to National Defense Strategy priorities based on input from mission planning, JROC guidance, and sensitive threat intelligence. This also includes coordinating Army Cyber Command lead Crisis Action Teams, where specific vulnerabilities affect the Army weapon/business systems. A key aspect is integrating efforts across both HQDA and Army Commands to understand total risk exposure while avoiding duplication. The Army then reviews the security posture of these critical components, develops remediation strategies, and facilitates delivery of fixes at mission-relevant speed. This includes working with program offices, capability managers, and resource managers to develop realistic plans of action for manage risk across outyears, and then gaining Army Senior Leader approval as needed. CORA-P ensures Army cyberspace remediation investments address areas of highest operational risk. When applicable, this PE also provides for Red Team enhancement to support Combatant Command mission-level cyber vulnerability assessments.

Accomplishments & Planned Programs (2)