UNCLASSIFIED – AUTHORISED FOR PUBLIC RELEASE 1 UNCLASSIFIED – AUTHORISED FOR PUBLIC RELEASE Identifying Cyber Defence Challenges in Acquisition: A Soft-Systems Approach

The UK Ministry of Defence (MOD) is embracing cyber as both a capability and operational environment. Military systems are, by necessity, increasingly digitally-enabled and interconnected and subsequently more vulnerable to cyber attack. MOD requires the confidence that cyber defence risks are appropriately managed in the acquisition of new systems, and applies the principles of Information Assurance (IA) to ensure the integrity, availability and confidentially of its information systems. This paper describes the approach to, and findings of, an independent review of MOD’s IA process from a cyber defence perspective. The customer requirement for a high-level, stakeholder-informed review of policy and procedure was met through the application of soft methods. Elements of the Appreciative Inquiry Method (AIM) and Soft Systems Methodology (SSM) were employed to engage stakeholders across organisational boundaries, and at various levels of influence, to explore the problem space. The review identified that, whilst the principles of the IA process are generally sound, its implementation is ineffective in managing cyber defence risks. Follow-on work will begin to address the most critical issues through a coherent, cross-Government approach