DID FinderBack
Source
DI-MGMT-82141A

Naval Aviation Cybersecurity Test Procedures/Descriptions

This DID establishes the format and content for Naval Aviation Cybersecurity Test Procedures/Descriptions (CSTP/CSTD), the data product resulting from work described in the contract statement of work.

Approval DateJune 2, 2022
AMSC NumberN10322
Preparing ActivityAS
Project NumberMGMT-2022-015
OPR—
DTIC Applicable—
GIDEP Applicable—
Limitation—
Applicable Forms—
Approval Limitation—
Form Version—
DID Formatfree_text
963C CompliantYes
DISTRIBUTION STATEMENT A: Approved for public release; distribution is unlimited.
Supersedes
DI-MGMT-82141
Related
—

Description & Purpose

—

Application & Interrelationship

—

Use & Relationship

This Data Item Description (DID) contains the format and content for the Cybersecurity Test Procedures/Descriptions (CSTP/CSTD).

This DID contains the format, content, and intended use information for the data product resulting from the work task described in the contract statement of work (SOW).

This DID supersedes DI-MGMT-82141.

Preparation Instructions

1Referenced documentsThe applicable issue of the documents cited herein, including their approval dates and dates of any applicable amendments, notices, and revisions, shall be as specified in the contract.
2FormatContractor format is acceptable.
3ContentThe CSTP/CSTD will contain the following sections:
3.1Test preparationsThis paragraph will identify a test by project-unique identifier, will provide a brief description, and will be divided into the following subparagraphs. When the information required duplicates information previously specified for another test, that information may be referenced rather than repeated. This section will be divided into the following paragraphs. Safety precautions, marked by WARNING or CAUTION, and security and privacy considerations will be included as applicable.
3.1.1Hardware preparationThis paragraph will describe the procedures necessary to prepare the hardware for the test. Reference may be made to published operating manuals for these procedures. The following will be provided, as applicable:
3.1.1.1The specific hardware to be used, identified by name and, if applicable, number.
3.1.1.2Any switch settings and cabling necessary to connect the hardware.
3.1.1.3One or more diagrams to show hardware, interconnecting control, and data paths.
3.1.1.4Step-by-step instructions for placing the hardware in a state of readiness.
3.1.2Software preparationThis paragraph will describe the procedures necessary to prepare the item(s) under test and any related software, including data, for the test. Reference may be made to published software manuals for these procedures. The following information will be provided, as applicable:
3.1.2.1The specific software to be used in the test.
3.1.2.2The storage medium of the item(s) under test (e.g., magnetic tape, CD).
3.1.2.2.1The storage medium of any related software (e.g., simulators, test drivers, databases).
3.1.2.2.2Instructions for loading the software, including required sequence.
3.1.2.2.3Instructions for software initialization common to more than one test case.
3.1.2.2.4Other pre-test preparationsThis paragraph will describe any other pre-test personnel actions, preparations, or procedures necessary to perform the test.
3.2Test descriptionsThis section will be divided into the following paragraphs. Safety precautions, marked by WARNING or CAUTION, and security and privacy considerations will be included as applicable.
3.2.1This paragraph will identify a test case by project-unique identifier, state its purpose, and provide a brief description.The following subparagraphs will provide a detailed description of the test case.
3.2.1.1Requirements addressedThis paragraph will identify the CSCI or system requirements addressed by the test case.
3.2.1.1.1Prerequisite conditionsThis paragraph will identify any prerequisite conditions that must be established prior to performing the test case. The following considerations will be discussed, as applicable:
3.2.1.1.1.1Hardware and software configuration.
3.2.1.1.1.2Flags, initial breakpoints, pointers, control parameters, or initial data to be set/reset prior to test commencement.
3.2.1.1.1.3Preset hardware conditions or electrical states necessary to run the test case.
3.2.1.1.1.4Initial conditions to be used in making measurements.
3.2.1.1.1.5Conditioning of the simulated environment.
3.2.1.1.1.6Other special conditions peculiar to the test case.
3.3Test inputsThis paragraph will describe the test inputs necessary for the test case. The following will be provided, as applicable:
3.3.1Name, purpose, and description (e.g., range of values, accuracy) of each test input.
3.3.1.1Source of the test input and the method to be used for selecting the test input.
3.3.1.1.1Whether the test input is real or simulated.
3.3.1.1.2Time or event sequence of test input.
3.3.1.1.3The manner in which the input data will be controlled to:
3.3.1.1.4Test the item(s) with a minimum/reasonable number of data types and values
3.3.1.1.5Exercise the item(s) with a range of valid data types and values that test for overload, saturation, and other "worst case" effects.
3.3.1.1.6Exercise the item(s) with invalid data types and values to test for appropriate handling of irregular inputs.
3.3.1.1.7Permit retesting, if necessary.
3.3.1.2Identify required Government furnish information (GFI) and Government furnished equipment required to conduct and complete the test.
3.3.1.3Expected test resultsThis paragraph will identify all expected test results for the test case. Both intermediate and final test results will be provided, as applicable.
3.3.1.4Criteria for evaluating resultsThis paragraph will identify the criteria to be used for evaluating the intermediate and final results of the test case. For each test result, the following information will be provided, as applicable:
3.3.1.4.1Minimum number of combinations or alternatives of input and output conditions that constitute an acceptable test result.
3.3.1.4.2Maximum/minimum allowable test duration, in terms of time or number of events.
3.3.1.4.3Maximum number of deviations or failures that may occur.
3.3.1.4.4Allowable tolerances of errors.
3.3.1.4.5Conditions under which the result is inconclusive and re-testing is to be performed.
3.3.1.4.6Conditions under which the outputs are to be interpreted as indicating irregularities in input test data, in the test database/data files, or in test procedures.
3.3.1.4.7Allowable indications of the control, status, and results of the test and the readiness for the next test case.
3.3.1.4.8Additional criteria not mentioned above.
3.4Test procedureThis paragraph will define the test procedure for the test case. The test procedure will be defined as a series of individually numbered steps listed sequentially in the order in which the steps are to be performed. For convenience in document maintenance, the test procedures may be included as an appendix and referenced in this paragraph. The appropriate level of detail in each test procedure depends on the type of Cybersecurity testing being performed and the hardware/software configuration. The appropriate level of detail is the level at which it is useful to specify expected results and compare them to actual results. The following will be provided for each test procedure, as applicable:
3.4.1Test operator actions and equipment operation required for each step, including commands, as applicable, to:
3.4.1.1Initiate the test case and apply test inputs.
3.4.1.1.1Inspect test conditions.
3.4.1.1.2Perform interim evaluations of test results.
3.4.1.1.3Record data.
3.4.1.1.4Halt or interrupt the test case.
3.4.1.1.5Request data dumps or other aids, if needed.
3.4.1.1.6Modify the database/data files.
3.4.1.1.7Number of repetitions required.
3.4.1.1.8Apply alternate modes as required by the test case.
3.4.1.1.9Terminate the test case.
3.4.1.1.10Expected result and evaluation criteria for each step.
3.4.1.1.11If the test case addresses multiple requirements, identification of which test procedure step(s) address which requirements.
3.4.1.1.12Actions to follow in the event of a failure or deviation, such as:
3.4.1.1.13Recording of critical data from indicators for reference purposes.
3.4.1.1.14Halting or pausing time-sensitive test-support software and test apparatus.
3.4.1.1.15Collection of system and operator records of test results.
3.4.1.1.16Procedures to sanitize and restore the system following the test.
3.4.2Procedures to be used to reduce and analyze test results to accomplish the following, as applicable:
3.4.2.1Detect whether a security failure has occurred.
3.4.2.2Identify media and location of data produced by the test case.
3.4.2.3Evaluate output as a basis for continuation of test sequence.
3.4.2.4Evaluate test output against required output.
3.4.3Assumptions and constraintsThis paragraph will identify any assumptions made and constraints or limitations imposed in the description of the test case due to system or test conditions, such as limitations on timing, interfaces, equipment, personnel, and database/data files. If waivers or exceptions to specified limits and parameters are approved, they will be identified and this paragraph will address their effects and impacts upon the test case.
3.4.4Requirements traceabilityThis paragraph will contain:
3.4.4.1Traceability from each test case in this CSTD to the system security requirements it addresses.If a test case addresses multiple requirements, traceability from each set of test procedure steps to the requirement(s) addressed.
3.4.4.2Traceability from each system or requirement covered by this CSTD to the test case(s) that address it.
3.4.4.3If a test case addresses multiple requirements, the traceability will indicate the particular test procedure steps that address each requirement.
4AppendixesAppendixes may be used to provide information published separately for convenience in document maintenance (e.g., charts, classified data). As applicable, each appendix will be referenced in the main body of the document where the data would normally have been provided. Appendixes may be bound as separate documents for ease in handling.

References

—
Schema v3.0Community-maintained · Verify against ASSIST
Community-maintained — not an official government database.
Verify against ASSIST·GitHub·About·Disclaimer