: February 6 Exhibit R, RDT&E Budget Item Justification: PB : Research,, Test & Evaluation, / BA 5: System & Demonstration (SDD) COST ($ in Millions) FY 5 FY 6 R Program Element (Number/Name) PE 65A / Defensive CYBER Tool FY 8 FY 9 FY To FY Complete Program Element 6.585 7.8.8 8.78 98. EV5: Defensi 6.585 7.8.8 8.78 98. Note This program element is a continuation of efforts funded in FY 6 in PE, project 9. A. Mission Description and Budget Item Justification The Defensive Cyber Tool group of programs designs, builds, and tests the advanced Cyber tools and infrastructure that enables active defense of the network from Tactical Command Posts up through Post Camps and Station Home Station Mission Command. This capability will enable integration of the Cyber Mission Force with the Regional and Local Cyber Network Defense elements. These tools will provide cutting edge hardware and software, integrated with existing infrastructure and tools to facilitate Active Defensive Cyber operations. Cyber Tool will include Big Data Analytics solutions to enable the ability to correlate and analyze the massive amount of data coming across the network and provide timely situational awareness. It will also include development, integration, and testing of Defensive Cyber Tool and Infrastructure that will facilitate pushing Cyber sensor data to the Big Data analytics as well as support remote access to prevent or react to a Cyber incident. The Cyber Tool includes test and assessment of emerging Commercial Cyber tools for inclusion in the Defensive Cyber Operations Infrastructure. This tool development will include enhancements and testing of existing systems by enabling such capabilities as Public Key Infrastructure and enhancing mission assurance profiles of existing software that will heighten the Defensive Cyber posture. This Program Element will support the Defensive Cyber Operations Infrastructure (DCOI) program starting in FY7 to integrate and deliver key hardware and software that enables the Cyber Mission Forces to protect, search and discover, maneuver and engage, and mitigate and respond to enemy cyberspace operations. DCOI will allow near realtime employment of defensive measures that will allow friendly cyber forces to maintain advantage. DCOI will consist of a combination of hardware computing infrastructure along with advanced software fielded to units from Service Component Commands down to Brigade Combat Team level. DCOI directly supports US Cyber Command Integrated ity List # Produce Advanced Cyberspace Infrastructure and #5 defensive forces to execute passive and active defense operations at netspeed. PE 65A: Defensive CYBER Tool Page of R Line #9 5
: February 6 Exhibit R, RDT&E Budget Item Justification: PB : Research,, Test & Evaluation, / BA 5: System & Demonstration (SDD) FY 5 B. Program Change Summary ($ in Millions) Previous President's Budget Current President's Budget Adjustments Congressional General Reductions Congressional Directed Reductions Congressional Rescissions Congressional Adds Congressional Directed Transfers Reprogrammings SBIR/STTR Transfer Adjustments to Budget R Program Element (Number/Name) PE 65A / Defensive CYBER Tool FY 6 Change Summary Explanation Funds previously executed in PE, Project 9. PE 65A: Defensive CYBER Tool Page of R Line #9 5
: February 6 Exhibit RA, RDT&E Project Justification: PB / 5 COST ($ in Millions) R Program Element (Number/Name) PE 65A / Defensive CYBER Tool FY 5 EV5: Defensi Quantity of RDT&E Articles FY 6 FY 8 6.585 FY 9 FY 7.8.8 To FY Complete 8.78 98. Note Defensive Cyberspace Operations (DCO) Big Data Pilot (PEO EIS, Product Director Enterprise ServicesCYBER) Defensive Cyberspace Operations Infrastructure (DCOI)Tactical PEO CT Defensive Cyberspace Operations Infrastructure (DCOI) Enterprise PEO CT Infrastructure Communications and Capabilities Defense Cyber Operations (PEO EIS, Project Manager Installation Information Infrastructure Communications and Capabilities (ICDCO) Cyber Protection Team Support (DCO Platforms) (PEO EIS, PM ICDCO) A. Mission Description and Budget Item Justification The Defensive Cyber Tool group of programs designs, builds, and tests the advanced Cyber tools and infrastructure than enables active defense of the network from Tactical Command Posts through Post Camps and Station and Home Station Mission Command. This capability will enable integration of the Cyber Mission Force with the Regional and Local Cyber Network Defense elements. These tools will provide cutting edge hardware and software, integrated with existing infrastructure and tools to facilitate Active Defensive Cyber operations. Cyber Tool will include Big Data Analytics solutions to enable the ability to correlate and analyze the massive amount of data coming across the network and provide timely situational awareness. It will also include development, integration, and testing of Defensive Cyber Tools and Infrastructure that will facilitate pushing Cyber sensor data to the Big Data analytics as well as support remote access to prevent or react to a Cyber incident. The Cyber Tool includes test and assessment of emerging Commercial Cyber tools for inclusion in the Defensive Cyber Operations Infrastructure. This tool development will include enhancements and testing of existing systems by enabling such capabilities as Public Key Infrastructure and enhancing mission assurance profiles of existing software that will heighten the Defensive Cyber posture. This Program Element will support the DCOI program starting in FY7 to integrate and deliver key hardware and software that enables the Cyber Mission Forces to protect, search and discover, maneuver and engage, and mitigate and respond to enemy cyberspace operations. DCOI will allow near realtime employment of defensive measures that will allow friendly cyber forces to maintain advantage. DCOI will consist of a combination of hardware computing infrastructure along with advanced software fielded to units from Service Component Commands down to Brigade Combat Team level. DCOI directly supports US Cyber Command Integrated ity List # Produce Advanced Cyberspace Infrastructure and #5 defensive forces to execute passive and active defense operations at netspeed. The DCO program provides initial capabilities to Cyber Protection Teams. Team enable passive and active cyberspace defensive operations to preserve friendly cyberspace capabilities, and protect data, networks, netcentric capabilities, and other designated systems. DCO consists of four critical capabilities:. DCOI Enterprise: the hardware and software baseline for remote cyber maneuver based on the Defense Advanced Research Projects Agency (DARPA) Plan X. Cyber Protection Team (CPT) Support (now called DCO Platforms): tools reside inside DCOI. Web Vulnerability: Scanning software baseline to secure key cyber terrain and protect DoD websites PE 65A: Defensive CYBER Tool Page of R Line #9 5
: February 6 Exhibit RA, RDT&E Project Justification: PB / 5 R Program Element (Number/Name) PE 65A / Defensive CYBER Tool. Big Data Analytics: analytics that leverage Defense Information Security Agency (DISA) Acropolis analytics (PEO CT) B. Accomplishments/Planned Programs ($ in Millions) Title: The Defensive Cyberspace Operations (DCO) Tactical Infrastructure (PEO CT) FY 5 FY 6 7.7 6.97 5. Description: DCOI program integrates and delivers key hardware and software that enables the Cyber Mission Forces to protect, search and discover, maneuver and engage, and mitigate and respond to enemy cyberspace operations. Plans: FY7 initiates the Engineering Design and for Network Operations software in support of the Defensive Cyber Operations Infrastructure (DCOI) Information Systems Initial Capabilities Document (IS ICD) which further integrates existing capability and extends that capability down to the Battalion Level. This funding initializes the program and funds the development effort for the first build cycle. FY7 also funds initial delivery of architecture products that help drive subsequent builds. DCOI testing will include developmental events conducted on lab configurations and networks followed by an Operational Evaluation using Soldiers and live equipment. Title: The Defensive Cyberspace Operations (DCO) Big Data Pilot (PEO EIS, PD ESCYBER) Description: FY7 initiates Big Data Pilot which provides an advanced analytics capability capable of ingesting structured, semistructured, and unstructured data from multiple data sources (e.g., Joint Regional Security Stacks (JRSS), intrusion detection systems, intrusion prevention systems, network device log files, trouble tickets, firewalls, proxies, web and applications server log files, etc) and proves situational awareness of cyberspace battlefield. It provides the computer network defense provider with common analytic platform which informs and reduces risk associated with future material solutions and forms a blueprint for future Big Data Analytics. Big Data (analysisofall DoD Information Network sensor data) provides two optimized and accredited cluster deployed in support of JRSS and Defense Research and Engineering Network (DREN) with a tools suite accessible to Cyber Mission Forces via secure remote access. Plans: FY7 initiates Big Data Pilot cyber funding encompasses design and development that is focused on getting the core platform to threshold capability and certified. Equipment would be purchased for the first instances located at of the JRSS locations with installation in FY8 after type certification is completed. Title: Defensive Cyberspace Operations Infrastructure (DCOI) Enterprise (PEO EIS, PM ICDCO) Description: DCOI Engineering Design,, and Software maintenance of standardized cloud infrastructure software to include deployment and build platforms for three primary environmental configurations (garrison, deployable and tactical). Additionally, providing advanced hypervisor, cloud deployment, security and integration and development. PE 65A: Defensive CYBER Tool Page of R Line #9 5
: February 6 Exhibit RA, RDT&E Project Justification: PB / 5 R Program Element (Number/Name) PE 65A / Defensive CYBER Tool B. Accomplishments/Planned Programs ($ in Millions) FY 5 FY 6 Plans: FY7 provides advanced security of infrastructure software for government managed purposes. Government unique cloud environment and management for infrastructure software facilitating collaboration and enhanced security to protect the abstraction layer of the infrastructure. Also begin Cyberspace Mission Command / Battle management Platform (Plan X) efforts. The foundational mission command platform for the conduct of cyberspace operations based on the transition of advanced technologies from the DARPA Foundational Cyberwarfare Program (Plan X). The platform includes battlespace awareness (SA), mission planning, course of action development, wargamming and execution capabilities. The platform will be developed in a continuous delivery methodology utilizing DevOpslike paradigms to ensure continued integration of new technological advances. Lastly, DevOps development for a centralized collaboration environment and repository including test and continuous delivery components. Facilitating license management, compilation and hosting of new platforms, centralized deployment/integration/ hosting of products, synchronization of software tools developed by cyber forces; including tool development chain with integrated test capability and deployment by cyber mission effectiveness (existing DCO systems to be managed within Log Collector & Qtip). Title: Cyber Protection Team Support (DCO Platforms) (PEO EIS, PM ICDCO).85 Description: FY7 initiates the DCOI Engineering Design,, and Software maintenance of standardized cloud infrastructure software to include deployment and build platforms for three primary environmental configurations (garrison, deployable and tactical). Additionally, providing advanced hypervisor, cloud deployment, security and integration and development. Plans: The capability that provide advanced security of infrastructure software for government managed purposes. Government unique cloud environment and management for infrastructure software facilitating collaboration and enhanced security to protect the abstraction layer of the infrastructure. Also begin Cyberspace Mission Command / Battle management Platform (Plan X) efforts. The foundational mission command platform for the conduct of cyberspace operations based on the transition of advanced technologies from the DARPA Foundational Cyberwarfare Program (Plan X). The platform includes battlespace awareness (SA), mission planning, course of action development, wargamming and execution capabilities. The platform will be developed in a continuous delivery methodology utilizing DevOpslike paradigms to ensure continued integration of new technological advances. Lastly, DevOps development for a centralized collaboration environment and repository including test and continuous delivery components. Facilitating license management, compilation and hosting of new platforms, centralized deployment/integration/ hosting of products, synchronization of software tools developed by cyber forces; including tool development chain with integrated PE 65A: Defensive CYBER Tool Page 5 of R Line #9 5
: February 6 Exhibit RA, RDT&E Project Justification: PB / 5 R Program Element (Number/Name) PE 65A / Defensive CYBER Tool B. Accomplishments/Planned Programs ($ in Millions) test capability and deployment by cyber mission effectiveness (existing DCO systems to be managed within Log Collector & Qtip). Accomplishments/Planned Programs Subtotals FY 5 FY 6 C. Other Program Funding Summary ($ in Millions) N/A Remarks D. Acquisition Strategy The Defensive Cyber Tool line will support multiple Information System Requirement Packages that result in multiple programs. The will conduct a Materiel Decisions in late FY6 based upon the Defensive Cyberspace Operations Infrastructure (DCOI), Big Data Analytics, and Cyber Protect Team Tools Requirements Packages to initiate these programs. The DCOI Tactical program is expected to be an Acquisition Category III program using the Department of Defense Instruction 5. Model : Incrementally Deployed Software Intensive approach. The DCOI capability will primarily use commercial off the shelf (or slightly modified commercial off the shelf) hardware and software integrated with components of the Warfighter Information Network Tactical and Mission Command programs. The functionality of DCOI will integrate with the Command Post Computing Environment to support Commanders from Brigade up to Component Command level. Execution of the DCOI program will be a combination of Government Labs (COMMUNICATIONSELECTRONICS RESEARCH, DEVELOPMENT AND ENGINEERING CENTER) and or support. The Defensive Cyberspace Operations (DCO) program provides initial capabilities that enable passive and active cyberspace defense operations to preserve friendly cyberspace capabilities and protect data, networks, netcentric capabilities, and other designated systems. Big Data Pilot provides an advanced analytics capability capable of ingesting structured, semistructured, and unstructured data from multiple data sources (e.g., Joint Regional Security Stacks (JRSS), intrusion detection systems, intrusion prevention systems, network device log files, trouble tickets,firewalls, proxies, web and applications server log files, etc) and proves situational awareness of cyberspace battlefield. It provides the computer network defense provider with common analytic platform which informs and reduces risk associated with future material solutions and forms a blueprint for future Big Data Analytics. Big Data (analysisofall DoD Information Network sensor data) provides two optimized and accredited cluster deployed in support of JRSS and Defense Research and Engineering Network (DREN) with a tools suite accessible to Cyber Mission Forces via secure remote access. The 's DCO activities is a construct of active cyberspace defense which provides synchronized, realtime capability to discover, detect, analyze, and mitigate threats and vulnerability to DoD networks and systems. E. Performance Metrics N/A PE 65A: Defensive CYBER Tool Page 6 of R Line #9 55
: February 6 Exhibit R, RDT&E Project Analysis: PB / 5 R Program Element (Number/Name) PE 65A / Defensive CYBER Tool Management Services ($ in Millions) Category Item Method & Type FY 5 Performing Activity & Location FY 6 To Complete Target Value of Defensive Cyber OperationsInfrastructure (DCOI) Tactical (PEO CT) C/TBD Aberdeen Proving Ground : MD.7.7.7 Big Data Pilot (PEO EIS, PD ES CYBER) TBD PD ES : Ft Belvoir, VA....86.86.86 Subtotal Product ($ in Millions) Category Item Method & Type FY 5 Performing Activity & Location FY 6 To Complete Target Value of Big Data Pilot (PEO EIS, PD ES CYBER) C/TBD Ft. Belvoir : VA 6.89 6.89 6.89 Defensive Cyberspace Operations Infrastructure (DCOI) Enterprise (PEO EIS, PM ICDCO) C/TBD ACCRI : IL 5. 5. 5. Defensive Cyber OperationsInfrastructure (DCOI) Tactical (PEO CT) C/TBD Aberdeen Proving Ground : MD.8.8.8 Cyber Protection Team (PEO EIS, PEO IC) C/TBD ACCRI : IL.85.85.85 9.99 9.99 9.99 Subtotal Test and Evaluation ($ in Millions) Category Item Defensive Cyber OperationsInfrastructure Method & Type C/TBD Performing Activity & Location Aberdeen Proving Ground : MD PE 65A: Defensive CYBER Tool FY 5 FY 6 Page 7 of.57 R Line #9.57 To Complete Target Value of.57 56
: February 6 Exhibit R, RDT&E Project Analysis: PB / 5 R Program Element (Number/Name) PE 65A / Defensive CYBER Tool Test and Evaluation ($ in Millions) Category Item (DCOI) Tactical (PEO CT) Method & Type FY 5 Performing Activity & Location Subtotal Project s FY 6 FY 5 FY 6.57.57 To Complete To Complete.57 Target Value of Target Value of Remarks PE 65A: Defensive CYBER Tool Page 8 of R Line #9 57
: February 6 Exhibit R, RDT&E Schedule Profile: PB / 5 PE 65A: Defensive CYBER Tool R Program Element (Number/Name) PE 65A / Defensive CYBER Tool Page 9 of R Line #9 58
: February 6 Exhibit R, RDT&E Schedule Profile: PB / 5 PE 65A: Defensive CYBER Tool R Program Element (Number/Name) PE 65A / Defensive CYBER Tool Page of R Line #9 59
: February 6 Exhibit RA, RDT&E Schedule Details: PB / 5 R Program Element (Number/Name) PE 65A / Defensive CYBER Tool Schedule Details Start Quarter Year 6 Quarter Year 6 DCOI Tactical Requirements Definition Package DCOI Tactical MDD DCOI Tactical Milestone C 8 8 DCOI Tactical Acquisition Decision Memorandum 8 8 DCOI Tactical 8 8 DCOI Tactical Build 8 9 DCOI Tactical al Test 8 8 DCOI Tactical Initial Operational Test 9 9 DCOI Tactical Full Rate Production DCOI Tactical Production DCO Data Mining and Cyber Analytics (DMCA) 8 8 DCO DMCA Materiel Decision DCO DMCA Milestone B DCO DMCA Acquisition Decision Memorandum DCO DMCA 8 8 DCO DMCA Build 8 9 DCO DMCA al Test 9 9 DCO DMCA Initial Operational Test 9 9 DCO DMCA Full Deployment DCO DMCA Production DCOI Enterprise GDI Cloud Infrastructure DCO IS ICD Approval Events End PE 65A: Defensive CYBER Tool Page of R Line #9 6
: February 6 Exhibit RA, RDT&E Schedule Details: PB / 5 R Program Element (Number/Name) PE 65A / Defensive CYBER Tool Start Quarter Year Quarter Year DCO Platforms (garrison, deployable and tactical) DCOI Enterprise MDD DCOI Enterprise (Plan X) Milestone C Plan X Transition From DARPA Events End PE 65A: Defensive CYBER Tool Page of R Line #9 6