The objective of the project was to provide a Type Authorized solution for Risk Management Framework (RMF) (cybersecurity) accreditation of facility-related control systems that could not otherwise be accredited, either due to excessive costs or fundamental system vulnerabilities. Achieving an Authority to Operate (ATO) for these systems will allow the Department of War (DoW) to more easily develop and demonstrate energy and water savings technologies and also allow DoW to realize projected energy and water savings from systems already installed that are currently threatened with demolition or functional abandonment due to inability to meet cybersecurity requirements.

This project developed and applied a Type ATO for a control system agnostic secure enclave (CASE). The enclave incorporates both technical and procedural elements to achieve an “interim secure” state for facility-related control systems. A key enabling technology for the enclave is a security device based on commercial off-the-shelf hardware and software, which provides a virtual private network for the control system. This resulted in a low cost, drop-in solution for legacy and demonstration systems.

CASE was successfully demonstrated at the U.S. Army Corps of Engineers-Engineer Research and Development Center-Construction Engineering Research Laboratory’s Control System Test Lab and was submitted in July 2024 to the ATO workflow. The Type ATO for CASE is still pending with expected award time undetermined. The procurement cost of CASE in prototype quantities is below the goal of $500 and is expected to fall within $100 per device when produced in production quantities. CASE was not demonstrated at the North Carolina National Guard (NCNG) due to project delays.

CASE faced primarily logistical and administrative issues. There were several early delays in the project while the project team attempted to identify a demonstration site. This and further delays cause by the COVID-19 pandemic required CASE to undergo a technical update in 2022, which resulted in additional delays. Finally, CASE’s RMF progress was continuously delayed by bottlenecks in the ATO process. These delays resulted in an inability to demonstrate CASE with the NCNG before the conclusion of this effort. (Project Completion - 2025)