The workshop illustrates the Information System Security Manager’s (ISSM’s) roles and responsibilities in the application of cybersecurity risk management and synchronization of the Risk Management Framework (RMF) with the defense acquisition lifecycle processes outlined in DoDI 5000.02. This workshop is also tailorable for the Defense Business Systems (DBS) Business Capability Acquisition Cycle (BCAC) outlined in DoDI 5000.75. Lectures are combined with exercises to include a capstone exercise where students will apply ISSM activities to a real or hypothetical DoD acquisition program.
The objective of this workshop includes the ability to: Analyze the ISSM’s roles and responsibilities across the acquisition lifecycle. Enabling Learning Objective (ELO) 1: Describe the ISSM’s roles and responsibilities. Discuss how cybersecurity requirements and the RMF integrate with overarching DoD policies (DoDI 5000.02 / DoDI 5000.75). Illustrate cybersecurity incorporation into the Risk, Issue, and Opportunity (RIO) management process. Recognize the benefits of early/proactive integration of cybersecurity T&E with traditional T&E. Identify annual security review/reporting requirements. Analyze cyber-attack vectors—“Think like an adversary”. Explain software assurance “Best Practices” for a DoD acquisition program. Describe hardware protection measures. Apply ISSM activities to a real or hypothetical DoD acquisition program.