FEDERAL CYBERSECURITY RESEARCH AND DEVELOPMENT STRATEGIC PLAN (2019) tightening risk management cycle, information sharing and coordination among decision makers becomes increasingly crucial. Therefore, to improve the overall ability of systems to respond, R&D activities should improve the capacity of systems, enterprises, and critical infrastructure to adapt, counter, recover, and adjust in the three ways described below: Provide dynamic assessment. Measure key properties and attributes of system components and assess potential damage amidst evolving threat methodologies and system requirements, thereby enabling response and recovery to a known good state. Include adaptive response. Provide methods to adjust to actual, emerging, and anticipated disruptions, so that mission and organizational needs can continue to be met while unintended consequences and adversary returns-on-investment are minimized. These methods will support risk trade-offs in homogeneous enterprise systems in the near term and in integrated heterogeneous cyberphysical systems in the medium term. In the long term, they will enable integrated resilient architectures that are optimized for the ability to absorb shocks and speed recovery to a known secure operable state. R&D is needed to prevent adversaries from exploiting autonomous functions and the machine learning that underlies them. Coordinate at multiple scales. Provide methods to manage risks at multiple scales (e.g., component, device, system, systems of systems, enterprise, or international coalition) and enable comprehensive and collective responses to specific types of malicious cyber activities, such as distributed denial-ofservice attacks. These methods support the collection of threat intelligence in the near term, coordination of defensive activities in the medium term, and negotiation and orchestration of collective defenses in the long term. – 10 –