BRADLEY WILSON, THOMAS GOUGHNOUR, MEGAN MCKERNAN, ANDREW KARODE, DEVIN TIERNEY, MARK V. ARENA, MICHAEL J. D. VERMEER, HANSELL PEREZ, ALEXIS LEVEDAHL A Cost Estimating Framework for U.S. Marine Corps Joint Cyber WeaponsCORPORATIONResearch Report RR-A1124-1 Cover.indd All Pages 1/25/23 11:25 AMFor more information on this publication, visit www.rand.org/t/RRA1124-1 . About RAND The RAND Corporation is a research organization that develops solutions to public policy challenges to help make communities throughout the world safer and more secure, healthier and more prosperous. RAND is nonprofit, nonpartisan, and committed to the public interest. To learn more about RAND, visit www.rand.org. Research Integrity Our mission to help improve policy and decisionmaking through research and analysis is enabled through our core values of quality and objectivity and our unwavering commitment to the highest level of integrity and ethical behavior. To help ensure our research and analysis are rigorous, objective, and nonpartisan, we subject our research publications to a robust and exacting quality-assurance process; avoid both the appearance and reality of financial and other conflicts of interest through staff training, project screening, and a policy of mandatory disclosure; and pursue transparency in our research engagements through our commitment to the open publication of our research findings and recommendations, disclosure of the source of funding of published research, and policies to ensure intellectual independence. For more information, visit www.rand.org/about/principles. RAND’s publications do not necessarily reflect the opinions of its research clients and sponsors.Published by the RAND Corporation, Santa Monica, Calif. © 2023 RAND Corporation is a registered trademark. Library of Congress Cataloging-in-Publication Data is available for this publication. ISBN: 978-1-9774-1020-7 Cover composite design: Carol Ponce; adapted from images by Nexusby/Adobe Stock, Ilya/Adobe Stock, Amgun/Getty Images. Limited Print and Electronic Distribution Rights This publication and trademark(s) contained herein are protected by law. This representation of RAND intellectual property is provided for noncommercial use only. Unauthorized posting of this publication online is prohibited; linking directly to its webpage on rand.org is encouraged. Permission is required from RAND to reproduce, or reuse in another form, any of its research products for commercial purposes. For information on reprint and reuse permissions, please visit www.rand.org/pubs/permissions.iiiAbout This Report In support of U.S. Marine Corps Systems Command, RAND Corporation researchers assessed the Marine Corps offensive cyber operations acquisition life cycle and identified ways to improve the transparency of decisionmaking related to cyber weapon acquisition. The resulting recommendations focus on improving understanding of the tradespace of cost, schedule, operational capability, and risk to help the new Joint Cyber Weapons (JCW) pro-gram support and sustain the Marine Corps’ cyber needs. The research brought together data on operational capability, schedule, and risk into a cost-estimating framework with five classes of inputs and three types of outputs. The frame-work captured demand for exploits, various types of cyber weapons, the target environment (e.g., desktop or mobile systems), vulnerability decay rates, adversary defense capabilities, weapon cost, and how acquisitions are phased in and out of service over time. The analysis also involved quantifying vulnerability life spans and simulating the cost-estimating frame-work to better capture uncertainty. This report presents the findings and recommendations, along with a RAND-developed cost-estimating framework that considered cost, schedule, operational capability, and uncer-tainty for the JCW acquisitions. The research reported here was completed in June 2022 and underwent security review with the spons