K05 assurance architecture
Critical Datacenter Assurance Case
Direct answer
The K05 case argues that a named facility can preserve approved safety and mission functions under defined stress only when authority, consequences, separation, identity, autonomy, physical protection, power, cooling, recovery, and evidence are all supported and no material defeater is hidden.
Top claim
A named critical datacenter can preserve approved safety and mission functions under defined cyber, physical, electromagnetic, power, cooling, autonomy, and recovery stressors without transferring authority to an autonomous system.
Public, non-classified reference pattern. A facility must replace every generic assumption with site evidence, license conditions, actual topology, competent authority, and current test results.
AC-K05-C01
Authority and mission boundary is explicit
Claim. Every automated protection action and any external mission support is traceable to a competent authority, named asset scope, allowed effects, prohibited outcomes, duration, stop conditions, and review route.
Argument. Speed is useful only after authority and consequence boundaries are established; technical access must not create its own mandate.
Evidence required
- signed authority record
- asset and identity scope
- allowed-action matrix
- prohibited outcomes
- deconfliction record
- expiry and revocation evidence
- review and appeal path
Defeaters
- missing authority
- expired approval
- ambiguous asset ownership
- unresolved jurisdiction
- action outside approved effect envelope
Hazards
- unauthorized access
- third-party impact
- mission conflict
- unreviewed escalation
Recovery objectives
- automatic action stop on authority failure
- preserve signed decision state
- restore least-privilege baseline
Site tailoring
- operator and licensee roles
- government mission authority
- third-party service boundaries
- jurisdiction and contract
AC-K05-C02
High-consequence events are identified and bounded
Claim. The facility identifies the cyber-enabled physical and mission consequences that must be prevented, their initiating pathways, critical functions, and independent protections.
Argument. Consequence-driven engineering focuses scarce assurance effort on outcomes that can defeat safety, continuity, or mission objectives even after perimeter compromise.
Evidence required
- HCE register
- system-of-systems dependency model
- critical-function list
- attack-path abstractions
- independent protection inventory
- hazard acceptance records
Defeaters
- unmodeled dependency
- unknown external service
- new plant configuration
- hidden network bridge
- protection sharing a common failure mode
Hazards
- radiological consequence
- loss of heat removal
- unsafe load rejection
- cooling loss
- loss of essential compute
- corrupted restoration
Recovery objectives
- prevent HCE progression
- reach approved safe state
- retain essential telemetry
- recover critical function within site target
Site tailoring
- reactor design
- electrical one-line
- cooling architecture
- compute mission priorities
- fuel and logistics
AC-K05-C03
Deterministic separation protects safety functions
Claim. Safety-significant and critical OT functions cannot be commanded from lower-trust datacenter or external networks through an unverified software path.
Argument. Physical or independently assured boundaries reduce dependence on the correctness of compromised enterprise software and autonomous models.
Evidence required
- network and data-flow diagrams
- hardware boundary inventory
- one-way-flow tests where used
- independent interlock tests
- configuration hashes
- change-control evidence
Defeaters
- bidirectional maintenance path
- shared management plane
- unapproved remote access
- boundary bypass
- common timing or identity dependency
Hazards
- IT-to-OT pivot
- unauthorized control command
- loss of deterministic behavior
- hidden common-mode failure
Recovery objectives
- isolate affected trust zone
- preserve safety function
- restore verified boundary configuration
Site tailoring
- license basis
- data historian flow
- vendor maintenance
- emergency communications
- support-system dependencies
AC-K05-C04
Identity, firmware, and management planes remain trustworthy
Claim. Privileged identities, workload identities, signing keys, BMCs, firmware, update systems, model artifacts, and management networks are separately protected and continuously evidenced.
Argument. A compromised management plane can bypass controls in the host workload and persist below ordinary endpoint visibility.
Evidence required
- asset and firmware inventory
- secure-boot and attestation evidence
- key status
- BMC isolation tests
- signed update provenance
- privileged-session logs
- SBOM and vulnerability status
Defeaters
- unknown firmware
- default credentials
- shared administrative identity
- unverified update
- attestation failure
- unmonitored BMC egress
Hazards
- ring-minus-three persistence
- cluster-wide destructive control
- supply-chain compromise
- identity replay
Recovery objectives
- revoke affected identities
- quarantine management segment
- restore signed firmware
- re-attest before service return
Site tailoring
- hardware vendor
- BMC implementation
- HSM and key custody
- maintenance contractor
- air-gapped update process
AC-K05-C05
Autonomous defense is bounded, causal, and reversible
Claim. Autonomous defenders act only through pre-authorized internal actions whose physical consequence, confidence threshold, rollback, evidence, and safe-state behavior have been tested.
Argument. Machine-speed containment can reduce loss only when false-positive effects cannot exceed the threat being controlled.
Evidence required
- allowed-action policy
- causal dependency model
- threshold and uncertainty records
- rollback tests
- false-positive consequence analysis
- model and data provenance
- decision receipts
Defeaters
- unbounded tool access
- unknown physical consequence
- model drift
- poisoned telemetry
- rollback failure
- conflicting agent state
Hazards
- self-inflicted outage
- unsafe OT isolation
- cascading agent failure
- evidence loss
Recovery objectives
- stop action on uncertainty
- restore last known-good state
- retain incident chronology
- escalate unresolved state
Site tailoring
- action tier
- protected process
- latency requirement
- operator authority
- maintenance state
AC-K05-C06
Sensor and model disagreement cannot directly control force
Claim. Physical-security autonomy separates sensing, classification, access denial, non-destructive protection, authorized responder routing, and any force-enabled response into independently governed layers.
Argument. No single model or sensor should convert uncertain perception into destructive action, and technical confidence does not create legal authority.
Evidence required
- multi-sensor confidence record
- sensor-health evidence
- disagreement policy
- access-control tests
- authorized responder interface
- force-authority record where applicable
- runtime assurance tests
Defeaters
- single-sensor dependency
- unknown object class
- compromised clock
- adversarial input
- missing authority
- unsafe collateral envelope
Hazards
- misclassification
- harm to authorized personnel
- airspace interference
- fratricide
- unauthorized force
Recovery objectives
- degrade to tracking and delay
- notify authorized responder
- preserve sensor evidence
- disable suspect actuator path
Site tailoring
- site perimeter
- airspace environment
- public access
- authorized federal support
- local emergency response
AC-K05-C07
Power, cooling, and timing failures do not defeat protected functions
Claim. The facility can detect corrupted or unavailable power, cooling, environmental, and timing data; reject unsafe commands; and transition to approved operating states without relying on the compromised channel.
Argument. Cybersecurity is incomplete when digital manipulation can drive an otherwise valid physical command into an unsafe state.
Evidence required
- physical plausibility models
- independent sensors
- load-rejection tests
- islanding and resynchronization tests
- cooling-failure tests
- timing holdover evidence
- safe-state procedures
Defeaters
- single timing source
- physics-unaware anomaly model
- untested load step
- shared cooling control
- unavailable manual or independent fallback
Hazards
- false relay trip
- grid instability
- thermal excursion
- coolant loss
- compute damage
Recovery objectives
- maintain safety and essential cooling
- stabilize electrical state
- restore trusted time
- rejoin service through verified sequence
Site tailoring
- grid topology
- reactor and turbine response
- UPS and storage
- cooling technology
- critical workload tiers
AC-K05-C08
Recovery is clean, evidenced, and repeatable
Claim. Critical services can be restored from independently protected, provenance-verified states while preserving evidence and preventing reinfection or unsafe configuration reintroduction.
Argument. Availability under attack depends on prepared restoration, not only detection or backup existence.
Evidence required
- recovery architecture
- immutable or protected backups
- gold-image hashes
- clean-room procedure
- restore rehearsal results
- dependency order
- post-restore attestation
- incident ledger
Defeaters
- backup shares compromise
- unknown dependency order
- stale credentials
- unverified image
- evidence overwritten
- unsafe OT restart
Hazards
- reinfection
- loss of forensic continuity
- unsafe process restart
- prolonged mission loss
Recovery objectives
- restore safety first
- recover essential control and cooling
- recover mission compute by priority
- re-establish evidence continuity
Site tailoring
- RTO/RPO by function
- licensing constraints
- fuel and staffing
- external service dependencies
- data classification
AC-K05-C09
Evidence supports readiness without overclaiming
Claim. Every public or procurement readiness state is traceable to exact releases, tests, defects, deployment identity, authority, incidents, uptime, restoration, and independent-verification status.
Argument. Architecture, code, a signature, or a successful demonstration proves only a bounded property; evidence must match the claim being made.
Evidence required
- release hash
- SBOM
- test coverage
- defect and waiver records
- deployment record
- uptime window
- incident history
- independent verification
- last observation
Defeaters
- missing artifact
- stale verification
- unresolved critical defect
- unknown deployment identity
- unavailable incident log
- marketing statement exceeds evidence
Hazards
- false procurement confidence
- unsafe deployment
- unreviewed residual risk
- loss of public trust
Recovery objectives
- downgrade readiness automatically
- publish correction
- suspend affected claim
- restore evidence chain
Site tailoring
- mission assurance level
- customer acceptance criteria
- regulatory recordkeeping
- classified evidence boundary
AC-K05-C10
Authorized external effects remain separate from facility defense
Claim. External cyber surveillance or effects support is never triggered solely by a facility defensive model and proceeds only through a separately approved mission package, federal or other competent authority, deconfliction, effect constraints, and post-operation accountability.
Argument. Internal defense and external state action have different authorities, target risks, third-party effects, and escalation consequences.
Evidence required
- mission package
- written approval and direction
- target adjudication
- deconfliction evidence
- critical-outcome assessment
- abort and minimization procedures
- execution and effects report
Defeaters
- private self-authorization
- uncertain target ownership
- unresolved third-party infrastructure
- missing state authority
- critical-outcome risk
- scope expansion
Hazards
- sovereignty violation
- collateral system damage
- intelligence conflict
- escalation
- state responsibility
Recovery objectives
- cease outside parameters
- minimize unintended access
- notify authority
- preserve evidence
- conduct post-operation review
Site tailoring
- mission sponsor
- target class
- jurisdiction
- allied equities
- classified annex
Complete machine-readable case
Assurance case · Claim collection · Control catalog · Evaluation range