Enhancing Warfighter Awareness of Cyber Risks
The Department of Defense is in the process of creating new cybersecurity assessment tools, known as “scorecards,” designed to evaluate the cyber resilience of weapons systems across combatant commands. This initiative aims to give servicemembers clearer insight into potential vulnerabilities and the mission impacts of cyber threats.
Bridging the Gap in Cyber Risk Understanding
David McKeown, acting as the DoD’s deputy CIO for cyber and chief information security officer, explained that these “warfighter scorecards” will improve commanders’ awareness of their systems’ weaknesses. “Right now, assessments exist, but they’re not as comprehensive as a scorecard,” he said during the Potomac Officer’s Club Cyber Summit. The goal is to enable commanders to better understand the risks they’re incurring and how these risks could affect mission success.
Beyond Current Assessments: Focusing on Mission Impact
McKeown emphasized that existing evaluations do not sufficiently measure how cybersecurity vulnerabilities impact operational objectives. “They [COCOMs] need to know the risks across all those systems,” he noted. The new scorecards will incorporate mission impact analysis, helping warfighters understand the real-world consequences of cyber compromises.
Improving Communication of Cyber Risks to Warfighters
Currently, the department invests heavily in identifying vulnerabilities through programs like the Strategic Cybersecurity Program, which assesses critical infrastructure and system weaknesses. However, McKeown pointed out that these efforts are not effectively communicated to the warfighters responsible for operational decision-making. “We don’t do a good job of exposing that risk information,” he said, indicating a need for better dissemination of critical cybersecurity insights.
Integrating Cyber Vulnerability Testing into War Games
The planned scorecards will allow warfighters in various COCOMs to conduct practical tests on their systems. Results highlighting areas of high risk—particularly “red” zones—will be shared with the warfighters. Armed with this data, servicemembers will participate in war games designed to simulate cyber threats, practicing how to operate effectively if specific components are compromised.
Mission Decomposition and Resilience Practice
McKeown highlighted the concept of “mission decomposition,” where warfighters analyze how removing cyber-dependent building blocks from a system impacts overall operation. “They need to understand how they fit together,” he explained. This process will help them develop strategies for continuing mission execution in scenarios where cyber attacks disable parts of their systems.
Ongoing Development and Future Implementation
The department is still in the development phase of the scorecards, working within offices dedicated to cybersecurity, acquisition, and sustainment. Once completed, these tools will serve as critical resources to improve cyber resilience training and operational planning across the U.S. military.
In sum, the initiative represents a significant step toward integrating cybersecurity awareness directly into warfighter operations, ensuring that cyber vulnerabilities are understood, mitigated, and incorporated into mission planning.
