Department of Defense INSTRUCTION

DoDI 5000.02, January 7, 2015
At the highest risk level, the lead OTA will execute a full OT&E in accordance with the
DOT&E-approved OTP. For intermediate risks, the lead OTA will coordinate with the
responsible developmental testing organization to observe and execute some integrated
developmental testing/operational testing in accordance with a DOT&E-approved OTP.
(3) DOT&E will require an operational test or OA for every Limited Deployment in any
acquisition model. The scope of the OT&E or OA will be guided by the risk of capability being
fielded or deployed.
(4) IOT&E is required for every increment, in any acquisition model (except as noted for
urgent operational needs). IOT&E will normally occur prior to the Full Deployment Decision.
IOT&E will be guided by an updated assessment of the operational risks in the capabilities and
system interactions that have not been successfully evaluated in previous operational testing.
8. CYBERSECURITY
a. Beginning at Milestone A, the TEMP will document a strategy and resources for
cybersecurity T&E. At a minimum, software in all systems will be assessed for vulnerabilities.
Mission critical systems or mission critical functions and components will also require
penetration testing from an emulated threat in an operationally realistic environment during
OT&E.
b. Beginning at Milestone B, appropriate measures will be included in the TEMP and used to
evaluate operational capability to protect, detect, react, and restore to sustain continuity of
operation. The TEMP will document the threats to be used, which should be selected based on
the best current information available from the intelligence community.
c. The Program Manager, T&E subject matter experts, and applicable certification
stakeholders will assist the user in writing testable measures for cybersecurity and
interoperability.
d. The Program Manager and OTA will conduct periodic cybersecurity risk assessments to
determine the appropriate Blue/Green/Red Team, and operational impact test events in alignment
with the overall test strategy for evaluating the program for real world effects. Defense business
systems will undergo Theft/Fraud operational impact testing.
9. LFT&E. 10 U.S.C. 2366 (Reference (g) (h)) mandates the LFT&E and formal LFT&E
reporting for all covered systems, as determined by DOT&E, including Accelerated
Acquisitions, survivability improvement, and kit programs to address urgent needs. DOT&E
will require approval of LFT&E strategies and LFT&E test plans (including survivability test
plans) for covered systems as defined in section 2366. The DOT&E will determine the quantity
of test articles procured for all LFT&E test events for any system under DOT&E LFT&E
oversight.
Change 2, 02/02/2017 118
ENCLOSURE 5