The Department of Defense has started implementing a five-phase construct that seeks to provide real-time cyber defense at operational speed and ensure that U.S. warfighters maintain technological superiority against evolving cyberthreats.
5 Phases of DOD’s Cybersecurity Risk Management Construct
DOD said Wednesday the Cybersecurity Risk Management Construct, or CSRMC, consists of five phases aligned to system development and operations: design, build, test, onboard and operations.
The design phase, for instance, aims to ensure resilience of system architecture by embedding security at the outset.
“This construct represents a cultural fundamental shift in how the Department approaches cybersecurity,” said Katie Arrington, a Wash100 awardee who currently performs the duties of the DOD chief information officer.
CSRMC’s 10 Strategic Tenets
According to the department, 10 strategic tenets underpin the construct: automation; critical controls; continuous monitoring and ATO; DevSecOps; cyber survivability; training; enterprise services and inheritance; operationalization; reciprocity; and cybersecurity assessments.
“With automation, continuous monitoring, and resilience at its core, the CSRMC empowers the DoW to defend against today’s adversaries while preparing for tomorrow’s challenges,” said Arrington.
