1. Criticality and Risk in DODAF 2
DoD CIO Architecture and Interoperability Directorate
September 2013
DISTRIBUTION STATEMENT A. Approved for public release; distribution is unlimited.
UNCLASSIFIED

2. Topics Background and Requirements Source Definitions
How to Implement in DODAF 2 2
September 2013
UNCLASSIFIED

3. Background and Requirements
September 2013
UNCLASSIFIED

4. IER Criticality Criticality was IER attribute since 1990's
Was in C4RDP and CJCSI C
In DoDAF 1.0:
September 2013
UNCLASSIFIED

5. DoDAF 1.x / CADM Definitions
The attribute InformationCriticalityCode is formally defined as “The code that represents the seriousness of the benefit that the information exchange element provides to the objective of the action being taken for a specific information exchange requirement assurance.”
Critical—Criticality assessment of the information being exchanged in relationship to the mission; supported in CADM v1.5 through ObjectByReference with CategoryCode = INFORMATION-EXCHANGE-REQUIREMENT-ASSURANCE.
The attribute InformationCriticalityCode 23 is specified in CADM v1.5 via ObjectByReferenceCharacterization (see Volume III for details). The (DoD approved) values of this code are the following:
1 = Category 1 Mission Critical (Force C2)—Critical and high-level information (e.g., emergency action message and commander’s guidance)
2 = Category 2 Mission Critical (Mission Operations)—Required in support to operations (e.g., joint task force contingency plans and operations plan)
3 = Category 3 Mission Critical (Core Functions)—Ongoing information exchanges (e.g., configuration and guidance information and restricted frequency list)
4 = Mission critical [not otherwise specified]
5 = Mission support—Logistics, transportation, medical (e.g., gallons of petroleum-oil-lubrication scheduled for delivery)
6 = Administrative—Personnel, pay, training, etc. (e.g., change in allotment)
September 2013
UNCLASSIFIED

6. DoDAF Working Group Activity in this Area
Is related to Risk
DM2 Change Request # 315. Trust and Risk.
315
Trust and Risk
Address Trust and Risk. Risk = probability of outcomes (disposition). Trust = probability of an Agreement being kept.
20-Mar-09
Ellis
Sandia
DM2
Rule H M
Defer
See if there's a rqmt -- CMG, Wayson
UNCLASSIFIED
September 2013

7. Source Definitions
September 2013
UNCLASSIFIED

8. Risk Definitions IEC 61508:2010 MIL STD 882E NIST WIKIPEDIA
Combination of the probability of occurrence of harm and the severity of that harm
MIL STD 882E
Mishap Risk. An expression of the impact and possibility of a mishap in terms of potential mishap severity and probability of occurrence.
NIST
The net mission/business impact considering (1) the likelihood that a particular threat source will exploit, or trigger, a particular information system vulnerability and (2) the resulting impact if this should occur.
WIKIPEDIA
Risk is the potential of loss (an undesirable outcome, however not necessarily so) resulting from a given action, activity and/or inaction. The notion implies that a choice having an influence on the outcome sometimes exists (or existed). Potential losses themselves may also be called "risks". Any human endeavor carries some risk, but some are much riskier than others.
September 2013
UNCLASSIFIED

9. Criticality Definitions
DICTIONARY.COM
of decisive importance with respect to the outcome; crucial
of essential importance
GOOGLE.COM
Critical measures are selected measures that best demonstrate success/failure of the mission.
WIKIPEDIA
Criticality index is mainly used in risk analysis. The Criticality Index of an activity (task) can be expressed as a ratio (between 0 and 1) but is more often expressed as a percentage. During a ( e.g. Monte Carlo) simulation tasks can join or leave the critical path for any given iteration. The Criticality Index expresses how often a particular task was on the Critical Path during the analysis. Tasks with a high Criticality Index are more likely to cause delay to the project as they are more likely to be on the Critical Path. If a task does not exist for some iterations (e.g. it is probabilistic) then it is marked as not being critical.
September 2013
UNCLASSIFIED

10. How to Implement in DODAF 2
September 2013
UNCLASSIFIED

11. DM2 Overview
In DM2, Criticality is a Measure of a Resource or Activity needed to achieve a desired Resource state.
It is related to Risk which is an outcome (Resource state) that is less desired than other outcomes (shown through MeasureOfDesire) and also the probability of that outcome .
In the CV’s this can be associated to the intermediate outcomes (desired effects) that lead up to the Capability desired effects
Critical to the achievement of a Capability’s desired effects
In the OV-3, this can be associated to the performance (Measures) of Activities by a operational Performer
Critical to the success of the Mission or Task
In the SV/SvcV-6, this can associated to the performance (Measures) of System (or Service) Functions by a System or Service
Critical to performance of the System or Service
In PV’s, this can be associated to the performance (Measures) of the set of Activities that make up a Project realizing desired Project outcomes (Resource states).
Critical to the success of the Project
Criticality and other Measures can apply to the same Resource state to relate them.
How critical something is, to how desirable or probable that Resource state is. 11
September 2013
UNCLASSIFIED

12. Example: Criticality Diagram for Capabilities
How critical is the part to the whole?
What effects are desired?
How desired are they?
What’s the probability of a Resource being in some state?
For example:
Legend:
BES — Budget Estimate Submission
COCOM — Combatant Commander
CPA — Chairman’s Program Assessment
DAWG — Deputies Advisory Working Group
FYDP — Future Years Defense Program
MBI — Major Budget Issues Program ManagerPB — President’s Budget
PEO/PM — Program Executive Officer/Program Manager 
POM — Program Objectives Memorandum
RMDs — Resource Management Decisions
September 2013

13. A consumed Resource can can be critical to production of some other Resource
The Criticality measure could apply to a Resource needed by an Activity or to the need for a Performer to perform an Activity.
The relationship to outcomes (desired effects) is otherwise similar to previous.
If that Performer is a System or Service, then the Activity is called a System or Service Function.
September 2013
UNCLASSIFIED

14. Fit For Purpose
Fit For Purpose PES allows you to exchange Criticality data by creating a Criticality Measure XML element and placing your data as subtypes of that:
<IdeasEnvelope OriginatingNationISO3166TwoLetterCode="String" ism:ownerProducer="NMTOKEN" ism:classification="U" xsi:schemaLocation=" xmlns:xsi=" xmlns:ism="urn:us:gov:ic:ism:v2" xmlns:ideas=" xmlns:dm2=" xmlns="     <IdeasData XMLTagsBoundToNamingScheme="DM2Names" ontologyVersion="2.01" ontology="DM2">              <NamingScheme ideas:FoundationCategory="NamingScheme" id="ns1">             <ideas:Name namingScheme="n0" id="n0" exemplarText="DM2Names"/>         </NamingScheme>         <Measure ideas:FoundationCategory="IndividualType" id="m1">             <ideas:Name exemplarText="Criticality (the Class)" namingScheme="ns1" id="n1"/>         </Measure>         <superSubtype ideas:FoundationCategory="superSubtype" id="ss1" tuplePlace1="m1“ tuplePlace2="m2"/>                      <Measure ideas:FoundationCategory="IndividualType" id="m2">             <ideas:Name exemplarText="Actual Criticality Data" namingScheme="ns1" id="n2"/>         </Measure>                  </IdeasData>          </IdeasEnvelope> 14
September 2013
UNCLASSIFIED

15. Summary
Extending from Measures and associations relating Measures allows modeling of Criticality that is related to:
Desired Effect measures
How much they are desired
The risk (probability) that they won’t be achieved