Building Cyber Resilient Systems from Day 1

Good systems engineering equals good cybersecurity. For too long, cybersecurity functional and non-functional requirements have been addressed outside of standard systems engineering processes. We present an approach to address this historical gap by demonstrating an example of how to integrate cybersecurity requirements into systems engineering using Model Based Systems Engineering (MBSE) as the common digital thread. Leveraging the National Institute of Standards and Technology (NIST) Risk Management Framework (RMF) as the foundation for cybersecurity requirements, we align technical and non-technical security controls to functional architecture, processes, and procedures within a systems engineering model (SEM).We use MBSE to provide a comprehensive view of cybersecurity implementation across the system. We demonstrate multiple benefits to this approach: 1) Provide stakeholders insight to cybersecurity preparedness early in the system development lifecycle. 2) Identify gaps in implementing/allocating technical security controls to the functional system architecture. 3) Test system performance functionality along with the effectiveness of cybersecurity controls. 4) Use reference architectures to ensure the system aligns with current industry best practices. 5) Execute Agile processes and DevSecOps approach to ensure continuous development of strategic elements. 6) Allows new and legacy systems implement a Modular Open-Systems Approach (MOSA) offering total customization and agility.We demonstrate how properly documenting cybersecurity requirements using modern systems engineering tools enables engineers and operators to be better prepared to adapt and respond to future cyber threats.