The U.S. Army’s Communications-Electronics Command Software Engineering Center, or CECOM SEC, and the U.S. Military Academy at West Point have collaborated to evaluate the feasibility of the CECOM SEC-developed mapping between zero trust and the Pentagon’s Risk Management Framework, or RMF.
The Army said Thursday the testing sought to collect feedback on the mapping’s application.
Zero trust is a modern cybersecurity framework built on the “never trust, always verify” principle. RMF is a systematic structure that authorizes and manages risk in the Department of War’s systems.
Helping West Point Enhance Zero Trust Posture
According to the Army, the mapping developed by CECOM SEC helped USMA develop cybersecurity configurations, manage risk with a zero-trust mindset and prioritize zero-trust activities by focusing on relevant control correlation identifiers, or CCIs.
CCI is a unique identifier assigned to a specific security requirement and serves as a bridge between security control sets and compliance frameworks, enabling consistent mapping and tracking of individual security requirements across different standards.
CCIs are a key component of the Security Technical Implementation Guides and are maintained by the Defense Information Systems Agency.
The service branch said the approach provided West Point with a repeatable process for incorporating security concepts into established risk management practices and enabled the organization to determine its zero trust maturity while leveraging RMF compliance status.
