DoD Microelectronics: Field Programmable Gate Array Level of Assurance 2 Best Practices

This document was developed in furtherance of NSA’s cybersecurity missions. This includes its responsibilities to identify and disseminate threats to National Security Systems, Department of Defense information systems, and the Defense Industrial Base, and to develop and issue cybersecurity specifications and mitigations.

In support of securing Field Programmable Gate Array (FPGA) based systems from adversary influence during the manufacturing process, this report outlines the categories of relevant threats and the best practices for mitigating them at Level of Assurance 2 (LoA2). LoA2 captures the threats most likely to be exercised against a DoD system based on their cost and high value of return. This level is defined as causing serious harm to U.S. personnel, property, or interests if the system fails.