The Department of Defense (DoD) has introduced a new five-phased framework, known as the Cybersecurity Risk Management Construct (CSRMC), designed to overhaul its approach to assessing cyber risks on its networks, replacing the previous, outdated risk management system.
Addressing Gaps in Previous System
According to a statement from the department, the old Risk Management Framework relied too heavily on static checklists and manual processes, failing to adequately address operational needs and cyber survivability requirements. These shortcomings left defense systems susceptible to sophisticated adversaries and slowed the deployment of secure capabilities.
„The previous Risk Management Framework was overly reliant on static checklists and manual processes that failed to account for operational needs and cyber survivability requirements. These limitations left defense systems vulnerable to sophisticated adversaries and slowed the delivery of secure capabilities to the field,” the DoD stated.
Dynamic, Automated, and Continuous Risk Management
The CSRMC aims to rectify these issues by transitioning from „snapshot in time” assessments to dynamic, automated, and continuous risk management, enabling cyber defense at the speed necessary for modern warfare.
The new framework involves a five-phase lifecycle aligned with system development and operations, supported by ten foundational tenets.
The Five-Phased Lifecycle
The CSRMC’s five-phased lifecycle includes:
- Design Phase: Embedding security from the outset, ensuring resilience is built into system architectures.
- Build Phase: Implementing secure designs as systems achieve Initial Operating Capability.
- Test Phase: Conducting comprehensive validation and stress testing before achieving Full Operating Capability.
- Onboard Phase: Activating automated continuous monitoring upon deployment to maintain system visibility.
- Operations Phase: Utilizing real-time dashboards and alerting mechanisms for immediate threat detection and rapid response.
Ten Core Principles
Among the ten core principles, the DoD highlighted:
- Automation: Driving efficiency in cybersecurity processes.
- Continuous Monitoring and Authority to Operate: Enabling real-time situational awareness.
- DevSecOps: Supporting secure and agile development practices.
- Cyber Survivability: Ensuring operations can continue in contested environments.
- Cybersecurity Assessment: Integrating threat-informed testing to validate security measures.
A Cultural Shift in Cybersecurity
„This construct represents a fundamental cultural shift in how the Department approaches cybersecurity,” stated Katie Arrington, who is performing the duties of the DoD chief information officer.
Arrington emphasized that „With automation, continuous monitoring, and resilience at its core, the CSRMC empowers the DoW [Department of War] to defend against today’s adversaries while preparing for tomorrow’s challenges,” using the Trump administration’s new moniker for the DoD.
