SPK-05

Cyber-Surety Joint Rules Kernel

In December 2024, the Department of Defense rewrote the rules for nuclear weapon safety. For the first time, the Fourth Nuclear Surety Standard explicitly requires prevention of unauthorized actions "by physical or digital means." Cybersecurity is no longer an IT compliance checkbox — it is a nuclear surety requirement demanding the same rigor as two-person control and stronglink architecture. But cybersecurity demands agility. Surety demands stability. No computational framework exists to prove they don't conflict.

[Zenodo DOI: 10.5281/zenodo.18933128]

CSJ-K architecture diagram: SURETY_CORE and CYBER_AGILE envelopes separated by data diodes, with CSJ-MATRIX mapping surety invariants to cyber attributes
0

The Regulatory Pivot — December 2024

On December 17, 2024, the Department of Defense reissued DoDI 3150.02, "DoD Nuclear Weapon Systems Surety Program".[1] The four surety standards now read:

StandardRequirement
NSI-1Prevent nuclear weapons involved in accidents or incidents from producing a nuclear yield
NSI-2Prevent deliberate unauthorized pre-arming, arming, launching, or releasing — except upon execution of emergency war orders
NSI-3Prevent inadvertent pre-arming, arming, launching, or releasing in all normal and credible abnormal environments
NSI-4Prevent unauthorized access or unauthorized actions, by physical or digital means, that may result in loss or unauthorized use of a nuclear weapon
What changed: The instruction defines "digital means" as methods of logical access to information technology, operational technology, and interfaces — including hardware, firmware, and software. It mandates integrating cybersecurity and supply chain risk management into the surety program, and assigns the DoD CIO specific responsibility for developing cybersecurity policy for nuclear weapon systems — implying generic enterprise IT standards are insufficient.[1]

This creates a constraint surface that did not formally exist before December 2024. Every cyber control applied to Sentinel must be proven compatible with nuclear surety invariants. Every surety design choice must be evaluated for impact on cyber maintainability. The instruction mandates integration but provides no methodology for proving it.[1]

1

The Update Paradox

The fundamental tension between cybersecurity and nuclear surety is structural, not procedural.

Cyber Imperative

RMF mandates continuous monitoring

Zero-day response in days or hours

Unpatched systems violate ATO

Demand: Agility

CONFLICT
Surety Imperative

DAFI 91-101 requires configuration control[4]

DAFMAN 91-119 governs safety-critical software[3]

Changes trigger months of NSCCA

Demand: Stability

The paradox: You cannot patch the system without triggering safety review (months). You cannot leave the system unpatched without violating Authorization to Operate (cyber risk). The system is either vulnerable to attack OR operating in uncertified configuration.

CSJ-K's resolution: Explicit bifurcation. Divide the weapon system into FROZEN surfaces (stronglinks, PAL, CMS — change requires full NSCCA) and AGILE surfaces (networks, displays, analytics — patch rapidly with pre-approved non-interference proofs). The paradox dissolves when you stop treating the entire system as a single change-management unit.
2

Nuclear Safety Architecture — What Must Be Protected

Nuclear weapon safety is implemented through four physical themes that have been engineered into weapons for decades. CSJ-K maps cyber requirements directly to these mechanisms — not to abstract "safety controllers."[7]

MechanismFunctionCyber Relevance
Stronglink (Intent)Blocks arming until valid human-authorized Unique Signal receivedDigital signal path integrity; PAL code authentication
Stronglink (Trajectory)Blocks arming until environmental sensors confirm valid flight pathSensor data integrity; anti-spoofing
WeaklinkFails safe under abnormal environment before stronglink compromiseNo direct cyber interface; protected by isolation
Exclusion RegionPhysical barrier around detonatorsDefines SURETY_CORE boundary; no external digital paths
PALCryptographic lock preventing unauthorized armingKey management; CMS interface; authentication

Source: Nuclear Matters Handbook, Chapter 8[7]

The Code Management System (CMS) — PAL key infrastructure

The Code Management System is the PAL code logistics infrastructure developed by Sandia National Laboratories and produced at the NNSA Kansas City Plant. Initially operational November 30, 2001; fully deployed by spring 2004. It comprises 14 custom products (9 software, 5 hardware), including a specialized cryptographic processor — a secure metal-cased device containing three cryptographic chips.[18]

CMS is the authoritative PAL key management boundary. Any component interfacing with CMS for PAL code distribution is part of SURETY_CORE and cannot be modified without full recertification.

3

The Dual Envelope — Frozen vs. Agile

CSJ-K divides the entire Sentinel weapon system into two envelopes separated by hardware data diodes — optical devices where the transmitter is physically incapable of receiving light.[32]

SURETY_CORE (Frozen)

▸ Stronglinks (intent + trajectory)

▸ PAL hardware + CMS interfaces

▸ Weaklinks, ESDs, exclusion region

▸ Type-1 cryptographic modules

▸ NC3 command endpoints

▸ W87-1/Mk21A digital bus interface

Class 2 changes only · NSCCA mandatory

DATA
DIODE
(one-way)
CYBER_AGILE (Mutable)

▸ CLS fiber network routing

▸ SIEM and security analytics

▸ LCC displays and planning tools

▸ DevSecOps pipelines

▸ Network monitoring

▸ Training and simulation

Class 0/1 changes · Rapid patching OK

The governing rule: No AGILE change may increase SURETY_CORE reachability. Formally: RSURETY(t + Δ) ⊆ RSURETY(t). The data diode enforces this physically — telemetry flows out, nothing flows back.

Cross Domain Solutions at the cyber-surety boundary must be NCDSMO-baselined, Raise the Bar compliant with RAIN principles: Redundant, Always Invoked, Independent, Non-bypassable. All CDS must fail to CLOSED (no data pass-through) under HEMP, cyber stress, and internal faults.[21]
4

The Joint Satisfiability Matrix — Proving Compatibility

CSJ-MATRIX v2.1 maps every Nuclear Surety Invariant against every cyber attribute. Each cell must have a binding rule, a verification method, and a mission-risk scenario trace. No cell may remain in TENSION_OPEN status at closure.

C1: NSI-2 × Integrity / Prevent (Stronglink-Intent + PAL)
REINFORCING

Scenario: LCC issues arming/launch command without valid two-person authorization

Rule R-2.1-v2: Every digital signal contributing to PAL code acceptance must originate under two-person, multi-factor, split-knowledge cryptographic control. Verified inside the exclusion region as producing a Unique Signal pattern with Paccidental ≪ 10⁻⁶.

Verification: Formal proof, NSCCA, penetration test

C3: NSI-3 × Availability / Adapt (CLS Network)
TENSION_RESOLVED

Scenario: Automated CLS self-healing reroutes traffic creating unintended control path

Rule R-3.4-v2: Adaptive routing must not increase SURETY_CORE reachability from any AGILE node. Default failure mode: "inhibit launch" — never "keep operating at all costs."

Resolution: Availability desires adaptivity; non-interference proof keeps surety intact. Adaptation constrained to AGILE surfaces only.

C4: NSI-4 × Confidentiality / Prevent (Physical Security)
REINFORCING

Scenario: Sensor data exfiltration reveals weapon location, readiness posture, or fault status

Rule R-4.1-v2: Any sensor data exported from weapons or LCC facilities to lower-classification environments must pass through unidirectional gateways with strict field-level filtering. Data diodes must be NCDSMO-baselined, RTB-compliant with RAIN principles. Receiving networks are semi-core: no user-driven code execution, no further transit to enterprise IT except via controlled boundary with content filtering. Maintenance ports physically lockable and logically disabled in normal modes.[21]

Verification: Test, inspection

16 primary cells (4 NSI × 4 cyber attributes) · Expandable to 24 with physical mechanism refinement · Zero TENSION_OPEN permitted at closure

The matrix consumes outputs from mission-based cyber risk assessment frameworks. URAMS (developed by Dr. William D. Bryant at MTSI) is one such framework, integrating STPA-Sec to generate risk scenarios.[23] Other approaches include Cyber Table Tops and MRAP-C. The matrix structure is methodology-agnostic.

5

The Design-Freeze Contract — Change Classification

Every proposed change to CLS, NC3 interfaces, LCC systems, or warhead interfaces must pass through a mandatory front-end before it can proceed.

StepMechanismAuthority
1. NCISNuclear Certification Impact Statement submitted to AFNWCDAFI 63-125[5]
2. ClassificationClass 0 / 1 / 2 assigned based on NCIS determinationCSJ-K taxonomy
3. VerificationClass 2 → mandatory NSCCA by independent organizationDAFI 91-101[4]
ClassNameExampleRequired Actions
0Non-interferingNew dashboard reading diode telemetryNon-interference check; expedited approval
1Assurance-tighteningAdd IDS that can only increase inhibitionTargeted analysis; evidence reuse
2Assurance-alteringModify launch command processing codeFull NCIS; mandatory NSCCA[24]; recertification
What is NSCCA and why does it take months?

Nuclear Safety Cross-Check Analysis is governed by DAFMAN 91-119.[3] It must be performed by an independent verification organization — not the prime developer.[4] The Performance Work Statement describes it as "primarily an analysis of code and other evaluation" to ensure no violation of DoD nuclear surety standards.[24] It includes adversarial testing for trojans, logic bombs, and unintended interactions. Applied to ICBM software for both Minuteman III and Sentinel.

NSCCA is why Class 2 changes take months. CSJ-K does not accelerate this — it makes the requirement explicit and gates deployment on completion.

6

The Mixed Fleet Challenge — W87-0, W87-1, and MIRV

Sentinel will deploy with two different warhead types and confirmed multi-reentry-vehicle capability, creating interface complexity unprecedented in ICBM history.

PhaseWarheadInterfaceProtocol
Phase 1 (Initial)W87-0 / Mk21Analog/discreteSimple arming/inhibit lines
Phase 2 (2030s)W87-1 / Mk21A[25]Digital serialized busVersioned message set (FROZEN)
MIRV Confirmed: Senior officials confirmed in February 2026 that multiple independently-targetable reentry vehicle capability remains a Sentinel requirement.[8] A single missile may carry multiple RVs — potentially of mixed types during the W87-0 to W87-1 transition.

WARHEAD_IF_CONTRACT rules:

▸ The Post-Boost Vehicle must maintain independent interface sessions with each RV
▸ No cross-RV command mapping — a command for RV-1 must never reach RV-2
▸ Interface type (W87-0 vs W87-1) confirmed through hardware interrogation — not software flag
▸ Mis-configuration must trigger safe state, not wrong-protocol transmission

7

Concurrent Operations — Sentinel and Minuteman III

Minuteman III may operate into the 2050s[8] — an extended period where both weapon systems share geographic footprint and must be commanded from potentially shared infrastructure with strict logical separation.

ConstraintRequirement
Squadron IsolationTransition at squadron granularity (~50 missiles). No mixed flights.
Cable DeconflictionHICS copper and Sentinel fiber share easements. Construction deconfliction protocols required. "Backhoe fade" — construction cutting active nuclear command cables — must be prevented.
Ground Potential RiseSentinel's new grounding grids create GPR risk for legacy HICS. Isolation transformers and staged de-energization required.
Wing Command Post Air GapSeparate physical networks for MMIII vs Sentinel reporting chains. Cyber intrusion on Sentinel side cannot pivot to MMIII side.
8

Why This Matters — Historical Failures

Interface failures, configuration drift, and cyber vulnerabilities are not theoretical — they manifest in operational nuclear systems.

REACT ICD Failure (1996): DoD IG Report 96-073 documented that the REACT Program Office used out-of-date Interface Control Documents for formal qualification testing. Hardware was designed to specifications that did not match actual signal characteristics. Corrective actions were taken during the audit.[13]
F.E. Warren Disruption (2010): On October 23, 2010, 50 Minuteman III missiles lost communication[14] for approximately 45–59 minutes — the largest known disruption of U.S. ICBM command-and-control in the post-Cold War era.[16] A faulty circuit board in an LCC computer emitted out-of-sequence communications, disrupting synchronized timing. The fail-safe design worked (missiles entered safe state), but the trigger was an internal hardware fault — not an attack.[15]
GAO-19-128 (2018): "Weapon Systems Cybersecurity: DOD Just Beginning to Grapple with Scale of Vulnerabilities" found that adversarial testers routinely exploited maintenance systems and diagnostic equipment to gain weapon system access, often through basic issues. Known vulnerabilities likely represent only a fraction of the total.[17]

These incidents demonstrate the pattern CSJ-K addresses: interface configuration errors, internal system failures producing denial-of-service against legitimate command, and systemic cyber vulnerabilities in weapon systems designed before digital threats were recognized.

9

Summary — The Constraint That Must Close

CSJ-K's closure condition is precise:

SI1.2_SATISFIED ⟺ ∀(NSI-k, CYB_ATTR) ∈ CSJ-MATRIX: STATUS ∈ {REINFORCING, TENSION_RESOLVED} ∧ BINDING_RULE ≠ NULL ∧ VERIF_METHOD ≠ NULL

In plain language: for every combination of nuclear surety invariant and cyber attribute, there must be a documented rule proving they don't conflict, a method for verifying it, and evidence that the verification was performed. No unresolved tensions. No assertions without derivation.

Without this closure, the Sentinel program can assert cyber-surety compatibility but cannot demonstrate it — replicating exactly the pattern of assertion-without-derivation that caused the original breach.[2]

All components use mature technologies. NCIS[5] is mandated. NSCCA[4] is operational. RTB CDS products[21] are available. No statutory changes required. The architecture must be established during the restructuring period — before the new baseline is approved without cyber-surety closure requirements.

Technology Readiness — Every component is buildable now
ComponentTechnologyTRL
CSJ-MATRIXStructured assurance cases, databases9
MBCRA IntegrationSTPA-Sec tooling, risk databases9
NSCCAEstablished DoD process (DAFMAN 91-119)9
NCISDAFI 63-125 mandated process9
NMR/Voting LogicFault-tolerant computing standard9
OMS/ContainerizationAir Force prototypes operational8
RTB CDSNCDSMO-certified products available9
Evidence LedgerAppend-only stores, hash chains9

No component requires research-grade algorithms or unprecedented capabilities. Seven of eight components are at TRL 9 — fielded and proven. OMS/containerization is at TRL 8 with Air Force prototypes operational.[28]

What CSJ-K Is — and Is Not

CSJ-K is not

Not a hazard analysis methodology. CSJ-K consumes outputs from established frameworks (MBCRA for mission risk, NSCCA for verification, NCIS for certification impact). It does not replace STPA-Sec or other hazard analysis methods.

Not a cost or schedule tool. Cost estimation is UC-BCK's domain (SPK-01); schedule milestones are SI-CK's domain (SPK-02).

Not a weapon system design. CSJ-K defines boundary conditions and joint rules. It does not design PAL implementations, launch control software, or NC3 message protocols.

Not a breach prevention system. CSJ-K cannot prevent cyber attacks, requirements changes, or funding instability. It ensures that whatever configuration is proposed has the structural properties required for valid verification.

CSJ-K cannot prevent

Cyber attacks exploiting unknown vulnerabilities. No framework can defend against threats it cannot model.

Requirements changes that invalidate certification basis. If the surety standards themselves change, the matrix must be re-evaluated.

Funding instability affecting NSCCA capacity. If independent verification organizations lack resources, Class 2 changes queue regardless of CSJ-K's classification speed.

Threat evolution beyond current MBCRA scenarios. The matrix is only as complete as the mission-risk scenarios that populate it.

CSJ-K makes incompatibilities visible before operational commitment. It does not claim to eliminate them.

Acceptance Criteria

CSJ-K must satisfy nine acceptance criteria for cyber-surety joint satisfiability closure. All remain unmet as of the current date.

AC-1
Every binding rule in CSJ-MATRIX traces to at least one mission-risk scenario from the adopted MBCRA framework.
● UNMET
AC-2
Every proposed change affecting CLS/NC3/LCC/WARHEAD_IF generates NCIS before classification.
● UNMET
AC-3
All Class 2 changes undergo NSCCA by independent contractor before deployment. Regression against NSI-1 through NSI-4.
● UNMET
AC-4
CSJ-MATRIX has no TENSION_OPEN cells when SI1.2 closure is claimed.
● UNMET
AC-5
CLS unambiguously identifies W87-0 vs W87-1 interface per RV through hardware interrogation. Mis-configuration triggers safe state.
● UNMET
AC-6
All CDS/guards at cyber-surety boundary fail to CLOSED under HEMP/EMI, cyber stress, and internal faults.
● UNMET
AC-7
Any CDS near SURETY_CORE is NCDSMO-baselined, RTB-compliant: Redundant, Always Invoked, Independent, Non-bypassable.
● UNMET
AC-8
CSE PMR-A Recover and Adapt map to explicit mechanisms: NMR voting + golden image (Recover), OMS + containerization (Adapt).
● UNMET
AC-9
Dual-system transition constraints specified: squadron isolation, cable deconfliction, GPR mitigation, Wing Command Post air gap.
● UNMET

Sources

  1. DoDI 3150.02, "DoD Nuclear Weapon Systems Surety Program," Dec 17, 2024. esd.whs.mil | Press Release
  2. DoD Sentinel Nunn-McCurdy Review, July 2024. defense.gov
  3. DAFMAN 91-119, Safety Design and Evaluation Criteria for Nuclear Weapon Systems Software. bits.de archive
  4. DAFI 91-101, Air Force Nuclear Weapons Surety Program, 2025. e-publishing.af.mil
  5. DAFI 63-125, Nuclear Certification Program. e-publishing.af.mil
  6. DI-NUOR-81888B, Nuclear Certification Impact Statement. dla.mil
  7. Nuclear Matters Handbook 2020, Ch 8. acq.osd.mil
  8. Air & Space Forces, "Sentinel ICBM Restructure," Feb 28, 2026. airandspaceforces.com
  9. Breaking Defense, "Sentinel ICBM to clear key review," Feb 2026. breakingdefense.com
  10. MITRE, Cyber Resiliency Framework / CSEIG. mitre.org
  11. RAND, "Graph Theoretic Algorithms for GBSD," 2021. rand.org
  12. RAND, "Digital Engineering Artifacts for Sentinel," 2024. rand.org
  13. DoD IG Report 96-073, REACT Configuration Audits, Feb 1996. media.defense.gov
  14. DVIDS, "No Significant Threat From Missile Communication Glitch," Oct 2010. dvidshub.net
  15. The Atlantic, "Failure Shuts Down Squadron of Nuclear Missiles," Oct 2010. theatlantic.com
  16. Arms Control Association, "Missile Incident," Oct 2010. armscontrol.org
  17. GAO-19-128, "Weapon Systems Cybersecurity," Oct 2018. gao.gov
  18. Sandia National Laboratories, "Code Management System," Jan 2002. sandia.gov
  19. Wikipedia, "Permissive Action Link." wikipedia.org
  20. NIST SP 800-53 Rev.5. csrc.nist.gov
  21. NSA/NCDSMO, Raise the Bar. nsa.gov
  22. NDIA, "Fundamentals of Cross Domain Solutions," 2024. ndia.dtic.mil
  23. INCOSE IS 2022, URAMS. conflr.com
  24. AFNWC NSCCA/NSATE PWS, 2020. imlive.s3.amazonaws.com
  25. LLNL, W87-1 Phase 6.3 Development Engineering. llnl.gov
  26. Defense News, "Sentinel nuclear missiles will need new silos," May 2025. defensenews.com
  27. AFGSC Sentinel Fact Sheet. afgsc.af.mil
  28. AFMC, Open Architecture Management Office, 2020. afmc.af.mil
  29. 10 CFR 73.54, NRC Cybersecurity. law.cornell.edu
  30. NIST SP 800-82, ICS Security. nist.gov
  31. Glasswall, "Raise the Bar Standards for CDS," 2024. glasswall.com
  32. Wikipedia, "Unidirectional network." wikipedia.org