Cyber Fault tolerant Attack Recovery (CFAR) | Apply Online

Cyber Fault Tolerant Attack Recovery (CFAR) - DARPA BAA 14-64: FAQs

What is the CFAR opportunity?

Cyber Fault Tolerant Attack Recovery (CFAR) is a DARPA Broad Agency Announcement (BAA 14-64) run through DARPA's Information Innovation Office (I2O). It focuses on fundamentally new approaches for keeping computing systems operating correctly even while they are under cyber attack.

What is the main goal of CFAR?

The goal is to enable computing systems to remain correct and functional through compromise by emphasizing rapid attack detection and rapid restoration of correct operation, rather than relying primarily on preventing every intrusion.

What does DARPA mean by "heterogeneous, cyber fault tolerant computation"?

In this context, it means using diversity across computing elements (such as different architectures, components, or execution environments) so a system can detect when something has been compromised and recover quickly. The diversity is intended to make compromise easier to spot and easier to route around or remediate.

What kinds of technical approaches does CFAR emphasize?

The technical emphasis is on rapid detection of cyber attacks and rapid restoration of correct operation. The program targets concepts that allow systems to continue functioning through compromise, detect anomalies or malicious manipulation quickly, isolate affected components, route around them, and restore trustworthy execution with minimal downtime.

Is CFAR focused on preventing intrusions or operating through intrusions?

CFAR is aimed at resilience when an attacker has already gained a foothold. The focus is on detecting compromise quickly and restoring correct behavior quickly, rather than assuming perfect prevention.

How does DARPA describe the expected level of innovation?

DARPA explicitly signals a preference for revolutionary advances over evolutionary improvements. The solicitation is framed as high-risk, high-payoff research intended to demonstrate genuinely novel concepts that could change what resilient computing looks like.

Are incremental improvements or best-practice extensions encouraged?

No. Proposals that mainly refine existing best practices, slightly improve current tools, or extend standard security methods without a major conceptual leap are explicitly discouraged or excluded based on the summary provided.

What kind of research outcomes is DARPA looking for?

The opportunity calls for work that pushes beyond incremental cybersecurity hardening and instead demonstrates new concepts that could lead to new science, devices, or system-level designs that measurably improve resilience during attack and after compromise.

What is the CFDA number associated with this opportunity?

The opportunity is listed under CFDA 12.910 (Research and Technology Development).

How much funding was anticipated for CFAR?

The estimated total funding listed for the solicitation is $52,000,000.

What types of award instruments were available?

The solicitation allowed multiple award mechanisms, including cooperative agreements, other procurement contracts, and grants. This suggests DARPA expected to fund a mix of performers and project structures depending on the technical scope and the level of government involvement needed.

Is cost sharing or matching required?

No cost sharing or matching requirement is stated in the provided summary information.

Who was eligible to apply?

Eligibility is described as unrestricted, meaning it was broadly open to a wide range of entity types, subject to any specific clarifications contained in the full announcement.

Was the eligibility section updated after the initial posting?

Yes. Amendment 0001 was issued to revise Section D, "Other Eligibility Requirements," with changes highlighted in the amendment document. Applicants were expected to review the amendment to confirm they met the updated requirements.

What should applicants do in response to Amendment 0001?

Based on the summary, applicants were expected to consult Amendment 0001 and ensure their organization and proposed team structure aligned with the revised Section D eligibility requirements before submitting a proposal.

When was the opportunity posted?

The posting timeline shows it was posted on September 29, 2014, with a creation date of October 2, 2014.

What was the proposal deadline?

The proposal deadline was November 19, 2014 at 12:00 pm Eastern Time.

When was the opportunity archived?

The archive date was December 19, 2014.

How long was the submission window?

From the posted date (September 29, 2014) to the deadline (November 19, 2014), the window was roughly seven weeks, which the summary notes is typical for DARPA BAAs where teams are expected to mobilize quickly and present a clear technical vision and execution plan.

Which DARPA office managed the program?

The program is run through DARPA's Information Innovation Office (I2O).

What is the official solicitation identifier?

The opportunity is identified as DARPA Broad Agency Announcement (BAA) 14-64.

Who is the point of contact for trouble obtaining the announcement?

The solicitation provides a point of contact for applicants who had trouble obtaining the full announcement electronically: Dr. John Everett, I2O Program Manager and BAA Coordinator.

What should an applicant emphasize to align with CFAR's intent?

Based on the provided description, applicants should emphasize genuinely novel, high-risk/high-payoff approaches that use heterogeneous computation to detect compromise and restore correct operation quickly, with a clear argument for why the work represents a step-change beyond the state of the art rather than a small improvement to existing cybersecurity methods.