Cybersecurity Figure of Merit

Abstract

This paper addresses the lack of a consistent, widely accepted means of measuring current and future cyber risk to mission resulting from acquisition or operational weaknesses in cybersecurity within an Information Technology based Program of Record through the concept of a Cybersecurity Figure of Merit (CFOM). The objective is to develop a transparent mathematical framework of weighted qualitative and quantitative metrics that expresses the relative effectiveness of an Information Technology based Program of Record in terms of the completeness and sufficiency of its cybersecurity properties throughout its lifecycle. CFOM can be used to address acquisition readiness for the Milestone Decision Authority as well as impacts of budget decisions on the cybersecurity wholeness of a given program.