ANNEX

PROJECT DOCUMENT

1.   Background

The OPCW is required to maintain infrastructure that permits information sovereignty in a manner commensurate with privileged access classifications, appropriate handling routines and existing threats whilst remaining capable of defending against emerging risks. The OPCW continues to consistently face serious and emerging risks in relation to cyber-security and cyber-resilience. The OPCW is a target of highly skilled, resourced and motivated actors. These actors continue to attack the confidentiality and integrity of the OPCW’s information and infrastructure assets on a frequent basis. To respond to the concerns that recent cyber-attacks, current political considerations, and COVID-19 crisis underlined, and taking into account the unique requirements posed by the nature of the work of the OPCW to deliver on the mandate of the CWC, it is clear that essential investment in technical capabilities is necessary.

Under the OPCW’s Special Fund for CyberSecurity, Business Continuity, and Physical Infrastructure Security, the OPCW has designed its Cyber Security and Resilience and Information Assurance Programme (OPCW Programme) with 47 activities to address cyber security challenges that have been experienced in recent times. The OPCW Programme is aligned to best practice as promoted by entities such as the European Union Agency for Cyber Security (ENISA) or using concepts related to the European Directive on Security of Network and Information Systems (NIS) pertaining to Telecoms and Defence. Collectively the OPCW Programme covers the following thematic areas: classified and unclassified networks; policy and governance; detection and response; operations and maintenance; and telecommunications. Fundamentally the OPCW Programme is designed to enable OPCW to reduce opportunities for well-resourced and/or state-sponsored attackers to achieve their aims, and to mitigate risks from both external and insider threats from both a human and technical perspective. The Union support is structured as a Project of three activities that corresponds to two of the 47 OPCW Programme’s activities.

2.   Project Purpose

The overall purpose of the Project is to ensure that the OPCW Secretariat has the capacity to maintain appropriate level of cyber security and resilience in addressing recurrent and emerging cyber-security defence challenges at OPCW headquarters and auxiliary facilities, to enable delivery of OPCW’s mandate and effective implementation of the CWC.

3.   Objectives

4.   Results

Expected results the Project contributes to are as follows:

5.   Activities

5.1.   Activity 1 – Operationalisation of an enabling environment for on-going cyber security and resilience efforts within multi-site OPCW operations

This activity seeks to ensure an enabling environment for smooth roll out of OPCW business continuity planning as related to cyber security and resilience. This will be achieved through addressing infrastructure upgrades – re-architecture and/or archival for OPCW business continuity across multi-site operations. As well as further facilitating and enabling the integration of privileged access governance into the business continuity planning and response processes.

5.2.   Activity 2 – Designing of customized solution for on premise and cloud based systems integration and configuration with OPCW ICT systems and Privileged Access Management (PAM) solutions

This activity focuses on translating the enabling environment into a customized design for on premise and cloud based systems integration and configuration with OPCW ICT systems and PAM solutions. This is expected to increase the efficiency of ICT systems infrastructure and lead to the design of an integrated PAM system for critical assets that can deter, detect, and is in line with commensurate threat hunting capabilities.

5.3.   Activity 3 – Initiation and testing of PAM solutions

This activity builds upon the infrastructure implemented and the PAM solutions designed to take integration and configuration from theory towards practice. Systems have to be mapped, profiled, and embedded into existing systems while taking associated policy and human factors into consideration. After which thorough testing verifies and assures the robustness of the system (all new systems have strong authentication for users and devices, appropriate information classification and protection, and advanced data loss prevention) in implementation and over time, will enable the OPCW Secretariat to identify and address gaps to the extent possible.

6.   Duration

The total estimated duration of implementation funded through this project are expected to be incurred and concluded over a 24-month period.

7.   Beneficiaries

Beneficiaries from the project will be OPCW Technical Secretariat personnel, policy-making organs, subsidiary bodies and CWC stakeholders including States Parties.

8.   EU Visibility

The OPCW shall take all appropriate measures, within reasonable security considerations, to publicise the fact that this project has been funded by the Union.