Senior officials spoke about the four goals of the Defense Department's 2024 Defense Industrial Base Cybersecurity Strategy, adding that the strategy comes at a time when adversaries are specifically targeting DIB contractors.
The strategy, released today, aims to create a stronger, more "cyber-secure" defense industrial base through a centralized approach that builds a framework that can remain on the cutting edge of innovation, while securing the defense ecosystem in cyberspace.
“The Department, in coordination with the DIB, seeks to build upon and improve the combination of regulations, policies, requirements, programs, services, pilots, communities of interest, public-private cooperatives and interagency efforts to achieve a more cyber-secure and resilient DIB,” the strategy states.
The strategy also emphasized the harm that DIB contractors currently face from foreign threats, particularly adversaries skilled at hacking and cyberattacks.
“DIB companies, both large and small, are at risk of malicious cyber activities conducted by foreign adversaries, such as Russia, China, Iran and North Korea, in addition to nonstate actors such as violent extremist organizations and transnational criminal organizations,” the strategy said.
David McKeown, deputy chief information officer for cybersecurity and chief information security officer, told reporters today that “our adversaries understand the strategic value in targeting the DIB.”
McKeown said working with the DIB can bolster security and safety, sheltering DIB contractors from foreign actors attempting to threaten the DIB, and noted the security strategy works to achieve that same goal.
“The DIB cyber security strategy aims to strengthen collaboration with the DIB and provide strategic guidance for new initiatives to achieve the vision of a secure defense industrial base,” McKeown said.
The strategy, which is aligned with the 2022 National Defense Strategy and the 2020 National Defense Authorization Act mandated the creation of, spans from fiscal year 2024 to FY-27 and includes four major goals to counteract the threat of adversaries and protect DIB contractor information.
The first goal is to bolster the Defense Department's governance structure to improve DIB cybersecurity.
“Securing the DIB requires support and collaboration from a large community of stakeholders,” Stacy Bostjanick, chief DIB cybersecurity and deputy CIO for cybersecurity, told reporters today. “From FY-24 through '27, the department will work with the DIB, DOD stakeholders, and interagencies to build a governance framework for maintaining a secure subcontractor CS environment.”
The second goal is to enhance the DIB’s cybersecurity posture.
“The department will evaluate DIB compliance with DOD CS requirements, improve threat sharing, identify DIB CS vulnerabilities and improve recovery from malicious cyber activity,” Bostjanick said.
Bostjanick also noted free services to help with this will be available through the voluntary DIB cybersecurity program and DOD’s Cyber Crime Center (DC3).
To ensure that DOD security and cyber requirements are being met while realigning DIB’s cybersecurity posture, the Cybersecurity Maturity Model Certification program, which is a framework of compliance standards established by the National Institute of Standards and Technology, will be used in the future to verify capabilities.
The CMMC program will allow “self-assessment for some requirements, leveraging independent assessments on DIB companies that will receive [controlled unclassified information] associated with the Department’s programs, conducting assessments on the subset of DIB companies that will receive CUI associated with the Department’s most critical and sensitive programs and technologies and reinforcing cooperation between the Department and industry in addressing evolving cyber threats,” the strategy said.
The strategy noted that to meet “contract eligibility requirements,” results from the CMMC program and from DOD High and Medium assessments have to be posted in the Supplier Performance Risk System.
The third goal is to ensure that critical DIB capabilities remain resilient in cyber-contested environments.
“Scrum maturation and policy coordination is crucial to mitigate risk in multi-tier supply chain and provide clear and consistent guidelines for industry,” Bostjanick said.
The fourth and final goal is to strengthen DIB cybersecurity collaboration.
“[National Security Agency Cybersecurity Collaboration Center] will maintain bi-directional cooperatives across multiple core technology sectors and empower the DIB in its fight against cyber threats,” Bostjanick said. “The department also seeks to engage with the DIB SEC to expand cyber incident information sharing and bolster collaboration in identifying key issues of mutual interest.”
The 2023 DOD Cyber Strategy required the development of “a comprehensive approach for the identification, protection, detection, response and recovery of critical DIB elements, thereby ensuring the reliability and integrity of critical weapons systems and production nodes.”
This strategy aims to fulfill that requirement, while also creating a centralized framework where the Department can coordinate with the DIB to ensure cybersecurity for defense suppliers and producers.
“Our adversaries will not rest in their campaigns to seek information about U.S. capabilities; look for shortcuts to advanced technology; and counter, kill or clone our warfighting capabilities,” the strategy said. “The Department of Defense, in coordination with the DIB, must remain resilient against these attacks and succeed through teamwork while defending the nation.”