1. UNCLASSIFIED The Open Group 01/07/10 Page-1 Kick-off Meeting for The Open Group Acquisition Cyber Security Initiative Ms. Kristen Baldwin Director, Systems Analysis Office of the Director, Defense Research and Engineering Directorate for Systems Engineering January 7, 2010

2. UNCLASSIFIED The Open Group 01/07/10 Page-2 Systems Engineering Mission Execute substantive technical engagement throughout the acquisition life cycle with major and selected acquisition efforts across DoD to apply best Systems Engineering practices to: –Help program managers identify and mitigate risks –Shape technical planning and management –Provide insight to OSD stakeholders –Identify systemic issues for resolution above the program level

3. UNCLASSIFIED The Open Group 01/07/10 Page-3 Defense Research & Engineering Director, Defense Research and Engineering (DDR&E) Honorable Zachary J. Lemnios Director, Research Dr. David Honey Director, Systems Engineering Mr. Stephen Welby Director, Rapid Fielding Mr. Earl Wyatt Director, Developmental Test & Evaluation (DT&E) Mr. Chris DiPetto (A) Undersecretary of Defense for Acquisition, Technology and Logistics Honorable Ashton B. Carter

4. UNCLASSIFIED The Open Group 01/07/10 Page-4 System Complexity Analysis Red Teaming Modeling & Simulation Coordination Office Development Planning SE for Systems of Systems Program Protection/Acquisition Cyber Security SE Research Center Program Support Reviews Systems Engineering Plans Program Technical Auditing OIPT/DAB/DSAB Support DAES Database Analysis and Support Performance Measurement Systemic Root Cause Analysis Mission Assurance Nicholas Torelli Major Program Support James Thompson Systems Analysis Kristen Baldwin Systems and Software Engineering Policy, Guidance, Standards System Safety Reliability, Availability, Maintainability Quality, Manufacturing, Producibility Human Systems Integration (HSI) Technical Workforce Development Organizational Capability Assessment (WSARA) Responsible to provide technical support, systems engineering oversight, program development and mission assurance certification to USD(AT&L) in support of planned and ongoing acquisition programs Director, Systems Engineering Steve Welby Terry Jaggers, Principal Deputy Director, Systems Engineering

5. UNCLASSIFIED The Open Group 01/07/10 Page-5 DDR&E Imperatives 1. Accelerate delivery of technical capabilities to win the current fight –SE Focus: Support the current fight, manage risk with discipline 2. Prepare for an uncertain future –SE Focus: Grow engineering capabilities to address emerging challenges 3. Reduce the cost, acquisition time and risk of our Major Defense Acquisition Programs –SE Focus: Champion Systems Engineering as a tool to improve acquisition quality 4. Develop World Class Science, Technology, Engineering and Mathematics capabilities for the DoD and the Nation –SE Focus: Develop future technical leaders across the acquisition enterprise

6. UNCLASSIFIED The Open Group 01/07/10 Page-6 SE Initiatives for Imperative 1 Leverage “lighter-weight” tailored Systems Engineering process for urgent needs, rapid fielding and technology insertion –Identify best practices for managing risk in providing tailored Systems Engineering capabilities to rapid fielding initiatives − Government needs to better understand industry experience and plans regarding streamlined/tailored Systems Engineering processes –Identify policy and guidance impediments to “light-weight” risk-tailored Systems Engineering –Can lessons learned from rapid fielding initiatives be applied to streamline and accelerate traditional DoD acquisitions? Director, Systems Engineering Focus: Support the current fight, manage risk with discipline

7. UNCLASSIFIED The Open Group 01/07/10 Page-7 SE Initiatives for Imperative 2 Develop Systems Engineering techniques to formally specify and measure adaptability/flexibility/adjustability of defense systems to operate in new and unknown environments/missions Develop new approaches to address emerging Systems Engineering competencies in complex systems, large scale software, and trusted and secured systems Identify tools and practices to support architecture level assessment of emerging capabilities in systems-of-systems initiatives Identify opportunities to leverage Model-based engineering practices to improve systems engineering productivity and completeness –Do existing policies, guidance and contracting mechanisms hinder model-based collaboration? Reinvigorate exploration and exploitation of Modeling and Simulation Systems Engineering enablers to assess and mitigate acquisition program risks Director, Systems Engineering Focus: Grow engineering capabilities to address emerging challenges

8. UNCLASSIFIED The Open Group 01/07/10 Page-8 8 8 New Threats to DoD Acquisition Threats: Nation-state, terrorist, criminal, rogue developer who: –Gain control of systems through supply chain opportunities –Exploit vulnerabilities remotely Vulnerabilities: All systems, networks, applications –Intentionally implanted logic (e.g., back doors, logic bombs, spyware) –Unintentional vulnerabilities maliciously exploited (e.g., poor quality or fragile code) Consequences: Stolen critical technology; corruption, denial of critical warfighting functionality, or loss of information Then Standalone systems >>> Some software functions >>> Known supply base >>> Now Networked systems Software-intensive Prime Integrator, hundreds of suppliers Today’s acquisition environment drives the increased emphasis on Program Protection:

9. UNCLASSIFIED The Open Group 01/07/10 Page-9 Multifaceted Approach to Program Protection Requests for Proposals (RFP) DoDI DoDM 5200.39 DoDI DoDM 5200.39 Program Protection Plan (PPP) 9 Map to CPI being protected & location in Use to contract for security in SCRM Key Practices SCRM Key Practices Requires Other countermeasures (INFOSEC, IA, ITAR, FMS, etc.) Best Practices Systems Security Engineering (risk mitigation) Systems Security Engineering (risk mitigation) Specific tools and practices (e.g. Malicious code checks, software assurance techniques) DoDM 5200.39 Requires use of Supply Chain Risk Management (SCRM) and System Security Engineering Best Practice Countermeasures to protect Critical Program Information (CPI)  

10. UNCLASSIFIED The Open Group 01/07/10 Page-10 System Security Engineering is Required to Cost Effectively Design-In CPI Protection 10

11. UNCLASSIFIED The Open Group 01/07/10 Page-11 Vision of Success The requirement for assurance is allocated among the right systems and their critical components Awareness of supply chain risks Systems are designed and sustained at a known level of assurance Commercial sector shares ownership and builds assured products Technology investment transforms the ability to detect and mitigate system vulnerabilities Prioritization Supplier Assurance Engineering- In-Depth Industry Outreach Technology Investment Assured Systems

12. UNCLASSIFIED The Open Group 01/07/10 Page-12 Systems Engineering: Critical to Program Success Innovation, Speed and Agility