Thalorin
Capabilities

Complex weapon systems demand authorization approaches that commercial GRC platforms were never designed to support.

Abstract gradient
CSRMC
Full transition support
CSE
Endorsement tracking
SoS
System-of-systems auth

Interconnected Architectures, Fragmented Authorization

Modern weapon systems are not discrete components but interconnected architectures spanning sensors, networks, processing elements, effectors, and human interfaces. A fifth generation fighter aircraft integrates mission computers, datalinks, electronic warfare suites, targeting systems, and logistics support equipment into a system that must operate cohesively—while each component may have been developed by different contractors under different program offices with different authorization requirements.

Commercial GRC platforms designed for enterprise IT environments cannot address these requirements.

Weapon systems must demonstrate cyber survivability—the ability to continue performing mission functions despite adversary cyber operations. They must navigate authorization boundaries that span multiple interconnected components. They must address OTOT: Operational Technology and ICSICS: Industrial Control Systems where availability and safety take precedence over confidentiality. They must support DevSecOps pipelines that move software from unclassified development through classified operational deployment.

5
CSRMC Phases
Replacing RMF
10
CSE Attributes
Survivability
3+
Classification Levels
Pipeline
Authorization Boundaries
System-of-Systems

CSRMC Framework Transforms Authorization Approach

The Cybersecurity Risk Management Conceptual Framework, effective September 24, 2025, replaces the Risk Management Framework as the Department of Defense's approach to system authorization. This transition represents more than nomenclature change.

CSRMC introduces a five phase, ten tenet approach that fundamentally restructures how programs pursue authorization. This structure differs substantially from RMF's six step process, requiring organizations to reconceptualize their authorization workflows rather than simply relabeling existing activities.

Framework Transition
RMF
6 Steps
CSRMC
5 Phases · 10 Tenets
Effective Sept 24, 2025
Five CSRMC Phases
1
Identify

Asset discovery & risk assessment

2
Protect

Safeguards & security controls

3
Detect

Anomaly & event monitoring

4
Respond

Incident handling & mitigation

5
Recover

Restoration & lessons learned

10
Survivability Attributes
Joint Staff CSE Implementation Guide
January 2017

Ten Cyber Survivability Attributes Define Weapon System Security

The Cyber Survivability EndorsementCSE: Cyber Survivability Endorsement process evaluates weapon systems against ten attributes that determine whether systems can accomplish their missions despite adversary cyber operations. These attributes, defined in the January 2017 CSE Implementation Guide from the Joint Staff, establish requirements that extend beyond traditional cybersecurity into operational resilience.

CSE evaluation occurs at milestone reviews during acquisition, with endorsement required before systems can proceed through the acquisition lifecycle. Programs that cannot demonstrate cyber survivability face schedule delays while deficiencies are remediated.

All Ten CSE Attributes
01Prevent Unauthorized Access
02Prevent Unauthorized Changes
03Detect Malicious Activity
04Limit Damage from Attacks
05Restore System Functionality
06Ensure Trusted Communications
07Maintain Situational Awareness
08Protect Critical Functions
09Ensure Supply Chain Integrity
10Maintain Lifecycle Integrity

Authorization Boundaries Span Multiple Interconnected Components

Complex weapon systems create authorization challenges that single-system frameworks cannot accommodate. Each component may have its own authorization boundary, its own authorizing official, and its own compliance documentation—yet the system functions as an integrated whole.

System-Level
Weapon System Authorization
Radar Systems
Contractor A
Authorized
C2 Elements
Contractor B
Authorized
Missile Systems
Contractor C
Authorized
Network Infra
Contractor D
Authorized

Authorization Synchronization

Component authorizations expire at different times, requiring constant coordination across programs

Interface Security

Security properties must be maintained across interfaces between separately authorized components

Aggregation Problem

System authorization cannot be more current than its oldest component authorization

Operational Technology Demands Different Security Priorities

Weapon systems frequently incorporate operational technology and industrial control systems that operate under fundamentally different security assumptions than enterprise information technology. Flight control systems, propulsion management, power distribution, and similar components prioritize availability and safety above the confidentiality and integrity priorities that dominate IT security frameworks.

A flight control system that becomes unavailable due to security controls has failed its primary mission regardless of how well it protects data confidentiality.

IT-Focused Tools Fail OT Contexts
  • ×Flag configurations OT systems require
  • ×Alert on normal OT operational patterns
  • ×Recommend patches that compromise safety certification
Security Priority Comparison
Traditional IT Security
1
Confidentiality
2
Integrity
3
Availability
OT/Weapon System Security
1
Availability
2
Safety
3
Integrity

Classification Level Promotion Lacks Compliance Automation

Modern weapon system software development increasingly follows DevSecOps practices that enable rapid iteration and continuous delivery. Development typically occurs in unclassified environments where developer tools, cloud resources, and collaboration capabilities are most accessible. Integration testing may occur at higher classification levels. Operational deployment targets classified networks where weapon systems execute their missions.

This development model requires moving software artifacts from unclassified development environments through classified operational deployment—a process that must maintain security properties and compliance documentation throughout.

Software Artifact Promotion Path
Unclassified
Development
Secret
Integration
Top Secret
Operational
!
Compliance gap: No automation exists for classification level promotion. Manual review processes become bottlenecks in otherwise automated DevSecOps pipelines.
Authorization Model Comparison
Traditional ATO
Months of documentation → Point-in-time assessment
Continuous ATO
Ongoing monitoring → Authorization currency

Continuous Authorization Enables Operational Agility

Traditional authorization approaches that require months of documentation followed by point-in-time assessment cannot support weapon system development and sustainment tempos. Threat environments evolve continuously, requiring security adaptations that static authorizations impede.

The continuous Authorization to OperatecATO: Continuous Authorization to Operate model provides authorization currency through ongoing monitoring rather than periodic reassessment. Systems demonstrate security posture continuously, deviations are detected and addressed promptly, and authorization remains current as long as security properties are maintained.

IT source integration
OT source integration
Authorization analytics
Evidence streams

Purpose-Built for Weapon Systems Complexity

Programs that attempt to force weapon systems compliance into IT-focused frameworks encounter friction at every turn. Thalorin provides capabilities that address the actual challenges defense acquisition programs face.

01

CSRMC Transition Support

Five-phase, ten-tenet workflow templates with RMF migration pathways and threat-informed assessment capabilities

02

CSE Evidence Management

Ten-attribute tracking with milestone review package generation and survivability gap identification

03

System-of-Systems Authorization

Hierarchical compliance structures maintaining component and system level visibility across authorization boundaries

04

OT/ICS Compliance Adaptation

Framework requirements calibrated to operational technology security priorities with availability-focused monitoring

05

Classification Promotion Workflows

DevSecOps pipeline integration tracking software artifacts through classification boundaries with security verification

06

Continuous Authorization Support

Monitoring integration across IT and OT components enabling cATO currency for weapon systems

Key Regulatory References
CSRMCSept 2025
CSE GuideJan 2017
DTM 25-003Jul 2025
CMMC FinalOct 2024

Purpose-built for weapon systems complexity.

Evaluate how Thalorin supports your weapon system program's compliance requirements across CSRMC transition, CSE endorsement, and continuous authorization. Schedule a demonstration focused on your system architecture and acquisition timeline.