Operationalizing Cyber Survivability Through Requirements Decomposition: A Marine Corps Case Study

Abstract

United States Marine Corps (USMC) warfighting systems must operate reliably in contested cyber environments to bring their capabilities to bear to a future fight. To ensure mission-critical and safety-critical functions and components remain operational, these systems must be equipped to prevent, mitigate, recover from, and adapt to adverse cyber events: a concept known as cyber survivability. Joint Staff J6 defines 10 Cyber Survivability Attributes (CSAs) and provides guidance for requirements and resource sponsors early in the acquisition lifecycle. However, as programs progress through the acquisition lifecycle, there exists no additional guidance on how to derive, validate, and verify standardized and measurable system-level cyber survivability requirements. This lack of traceability between policy, security controls, and system engineering artifacts results in inconsistent implementation, redundant testing, and reduced ability to evaluate survivability. The Marine Corps Tactical Systems Support Activity’s (MCTSSA’s) Cyber Branch worked with various USMC Program Offices and other stakeholders to decompose cyber survivability requirements into tailored performance specifications, verification processes, and acceptance criteria. Through iterative application to multiple USMC Programs of Record, this design science research led to the service’s inaugural guidance on cyber survivability within the Warfighting Acquisition System: the USMC Cyber Survivability Requirements Guidebook.