Belgian Defence is increasingly relying on software, both in terms of pure software applications as well as in the form of cyber-physical systems.

When this software suffers from defects, vulnerabilities and weaknesses, attackers might exploit its inherent vulnerabilities and tamper with mission critical systems or exfiltrate sensitive information. In order to mitigate this risk and ensure that software is dependable and trustworthy, certification and accreditation activities have traditionally been integrated into the software lifecycle. Software assurance through certification and accreditation suffers from the fact that these processes are extremely resource and time consuming. A structured and to a large extent automated/agile approach that takes into account software updates must therefore be developed. The ARCOS initiative shows that US Defence is rapidly evolving towards higher levels of cybersecurity maturity, which implies a more thorough assessment of all the software and systems that are approved to operate inside one of the classified or unclassified networks within military organisations.