Defence & Security — AR Assessment Protocol

Foreword. This Assessment Protocol determines the Defence & Security Application Rating (AR) letter for a robot model in a declared application class. It scores a pool of criteria — the nine sector criteria of Clause 6 (DEF-1…DEF-9, 100 points) plus the named intrinsic criteria of Clause 5, each scored once under its own standard and counted here — and expresses the earned points as a percentage of the applicable pool, which maps to a letter C < B < A < AA < AAA (AAA best) by the bands of VRS-GEN-006 §4. Every criterion is bounded by an evidence tier — Unverified, Verified, Certified — so the best attainable letter rises with substantiation, not assertion. This edition supersedes the re-weighted-mean model of the 0.x drafts: no weighting, no separate grade bands, no separate modifiers — the tier limits follow from the per-criterion ceilings of Clause 6. Critical scope boundary: weapons functions are categorically out of VRS scope (VRS-DEF-001 Clause 1). A platform whose weapons function cannot be bounded is not rated; DEF-1 scores whether that exclusion boundary is verifiable. A Defence & Security AR is an opinion above the compliance floor, not a certification, and nothing here implies that any real robot holds a Veyrum rating (ratings are not published). Requirements use “shall”; recommendations use “should”.

1 Scope

1.1 This Protocol defines, for the Defence & Security sector Application Rating: the determination method (Clause 4); the contributing intrinsic criteria drawn into the pool (Clause 5); the nine sector criteria DEF-1…DEF-9 with their point ladders and tier ceilings (Clause 6); the letter bands, pool ceilings and class applicability (Clause 7); the evidence admissible at each tier (Clause 8); underwriting and credit use (Clause 9); result recording (Clause 10); and the assessor checklist (Clause 11). A worked example is at Annex A.

1.2 The AR shall be issued per application class. The defence and security application classes are ground UGV (logistics/ISR), EOD/CBRN (overlaps HAZ), base/perimeter security and maritime security USV, per VRS-DEF-001 §4. Sector applicability, the sector hazard taxonomy and the anchor regime are defined in VRS-DEF-001 and are not restated here.

1.3 Weapons functions are excluded absolutely. VRS issues no opinion on targeting, engagement or lethality (VRS-DEF-001 Clause 1). Where a platform carries a weapons function, the assessment shall cover only its non-weapons dimensions and shall carve the weapons function out; where the boundary between weapons and non-weapons functions cannot be established, the model is outside scope and no letter is issued. Whether that exclusion boundary is verifiable is itself scored as DEF-1 (Clause 6.1).

1.4 The AR shall be assessed at one of three tiers — Unverified, Verified, Certified. Each criterion states the maximum points reachable at each tier (Clause 6); the AR tier is the tier whose evidence bar the assessed evidence meets and shall not exceed the model’s Intrinsic Rating tier (VRS-GEN-006 §7). The underlying point aggregation and the letter bands are defined in VRS-GEN-005/006 and are not restated here.

2 Normative references

• VRS-DEF-001, Defence & Security — Sector Standard — applicability, application classes, the non-weapons hazard taxonomy (H1–H6), the restricted-evidence module (Annex B) and the anchor regime.
• VRS-GEN-005, Intrinsic Rating — Methodology — point aggregation, tiers and the company-wide fallback rule (§6).
• VRS-GEN-006, Application Rating — Scheme — the letter bands, the applicable-pool percentage and the tier rule.
• VRS-GEN-009, Robot Risk Passport and Registry Schema — the record that carries the AR result.
• VRS-GEN-012, Evidence Grades and Data Requirements — evidence kinds, admissibility and the tier evidence bars.
• VRS-GEN-101 … VRS-GEN-106, IR Category Standards — the intrinsic criteria contributed under Clause 5.
• ISO 10218-1:2025 / ISO 10218-2:2025 — industrial robot safety (robot; integration) — own-force safety anchor for platforms operating among personnel.
• IEC 62443-4-2:2019 — technical security requirements for IACS components; IEC 62443-4-1:2018 — secure product development lifecycle.
• IEC 62443-3-3:2013 / IEC 62443-3-2:2020 — system security levels and zone/conduit scoping — the fleet control/update-plane accumulation anchor (Clause 9).
• MIL-STD-461H:2026 — control of electromagnetic interference — contested-environment EMI/EMC anchor.
• MIL-STD-810H:2019 — environmental engineering test methods — theatre-qualification anchor.
• ISO 14224:2016 — reliability and maintenance data.
• NIST SP 800-88 Rev. 2:2025 — media sanitization / cryptographic erase — capture/compromise anchor.
• Data twin: VRS-DEF-501 (generated from this Protocol, never hand-edited).

3 Terms and definitions

Terms per VRS-GEN-001 (aligned to ISO 8373:2021) and VRS-DEF-001. Locally:

• pool — the set of criteria whose points determine the AR letter: the nine sector criteria of Clause 6 together with the contributing intrinsic criteria of Clause 5.
• applicable pool — the pool for a given application class after criteria not applicable to that class are removed from both the earned points and the pool range (Clause 4; VRS-GEN-006 §6).
• contributor — an intrinsic criterion scored once under its own IR category standard and counted again in the sector pool at the same points (Clause 5).
• tier — the evidence stringency at which a criterion is assessed: Unverified (public evidence only), Verified (manufacturer evidence pack examined), Certified (behaviour witnessed).
• ceiling — the maximum points a criterion awards at a given tier; points earned are held at the ceiling of the assessed tier.
• evidence bar — the minimum evidence a criterion requires before any points are awarded; below it the criterion scores 0.
• company-wide fallback — the substitute points a criterion allows from manufacturer-wide evidence when model-specific evidence is unavailable (VRS-GEN-005 §6).
• contested environment — operation under deliberate adversarial interference (jamming, spoofing, cyber intrusion, or physical attack on the platform or its links).
• capture/compromise — loss of the physical asset, its data, or its embedded technology to an adversary; the sector-specific recoverability and technology-transfer loss driver.
• restricted evidence — classified or export-controlled evidence whose content the registry cannot hold or independently verify; handled per VRS-DEF-001 Annex B.
• theatre exposure — operating time accrued in a declared deployment environment, in op-hours, recorded for the field-record criteria and for underwriting, not as a scoring input.

4 Method of assessment

4.1 The Defence & Security AR shall be determined as a percentage of the applicable pool and mapped to a letter by the bands of VRS-GEN-006 §4 (Clause 7.1). The pool is the nine sector criteria of Clause 6 (DEF-1…DEF-9, 100 points) together with the contributing intrinsic criteria of Clause 5, each scored once under its own standard and counted here at the same points. For an application class the assessor shall add the points earned across the applicable criteria and divide by the sum of the point ranges of those same criteria; a criterion not applicable to the class (Clause 6 Applicability row; VRS-GEN-006 §6) shall be removed from both the earned points and the pool range. No weighting is applied — each criterion’s point range sizes its own importance — and no separate modifiers operate on the letter: the tier limits follow from the per-criterion ceilings of Clause 6 (Clause 7.2; VRS-GEN-006 §8).

4.2 Evidence shall be attributable to the declared application class of the assessed envelope — ground UGV (logistics/ISR), EOD/CBRN, base/perimeter security, or maritime security USV (Clause 1.2; VRS-DEF-001 §4) — and to operation under the acquiring force’s operating procedures; the AR letter covers only the assessed classes.

4.3 Letters shall be issued per application class where evidence diverges materially between classes; the displayed sector letter shall be the lowest issued class letter. A class for which no letter can be issued shall be displayed as not covered, and the assessed envelope shall contract to the classes the evidence covers.

4.4 Evidence obtained outside a declared application class and its operating context shall be inadmissible as support for that class (VRS-DEF-001 §4.3); the letter shall not be extended to roles never observed under the declared operating procedures.

5 Contributing IR criteria

5.1 The sector pool consists of the sector criteria of Clause 6 and the following intrinsic criteria, scored once under their own standards and counted again here at the same points:

5.2 No other intrinsic criterion contributes. Points, ceilings and applicability of a contributing criterion are those of its own standard; where a contributing criterion is not applicable to the assessed application class it is removed from the pool for that class (VRS-GEN-006 §6).

6 Sector criteria

6.0 Summary. Points and tier ceilings per criterion; totals reproduce by addition.

6.1 DEF-1 Scope integrity — weapons-function exclusion verified (0–12)

6.2 DEF-2 Own-force and bystander protection at speed and load (0–14)

6.3 DEF-3 Contested-environment integrity (jamming, spoofing, interference) (0–14)

6.4 DEF-4 Environmental qualification (MIL-STD-810 or equivalent) (0–12)

6.5 DEF-5 Field maintainability by uniformed maintainers (0–12)

6.6 DEF-6 Capture and compromise resilience (0–14)

6.7 DEF-7 Cyber accreditation and vulnerability handling (0–10)

6.8 DEF-8 Programme continuity and export/security constraints (0–6)

6.9 DEF-9 Mission incident record (0–6)

7 Letter bands, tier ceilings and class applicability

7.1 Bands (VRS-GEN-006 §4). AAA ≥ 90 % · AA ≥ 75 % · A ≥ 60 % · B ≥ 45 % · C below 45 % of the applicable pool.

7.2 Pool ceilings. Sector criteria alone: Unverified 70/100 (70 %) · Verified 85/100 (85 %) · Certified 100. With the contributing criteria of Clause 5 the pool ceilings are as recorded in VRS-DEF-501; in both forms the best attainable letter is A at Unverified, AA at Verified and AAA at Certified (VRS-GEN-006 §8).

7.3 Application classes. ground UGV (logistics/ISR) · EOD/CBRN (overlaps HAZ) · base/perimeter security · maritime security USV. All criteria apply to all classes… A criterion whose Applicability row excludes the assessed class is removed from both the numerator and the denominator; the letter is issued per class and the displayed letter is the lowest (Clause 4).

7.4 No modifiers, caps or gates operate on the letter other than the ceilings of Clause 6 and the tier rule of VRS-GEN-006 §7.

8 Evidence by tier

8.1 Unverified. The assessor works only from evidence obtainable without the manufacturer’s cooperation: public product descriptions and attestations (DEF-1); published safety and environmental test data and certificates, including MIL-STD-461 and MIL-STD-810 public reports (DEF-2, DEF-3, DEF-4); public accreditation statements and PSIRT pages (DEF-6, DEF-7); public sustainment and export-control listings (DEF-8); and declassified or public mission-incident sources (DEF-9). Each criterion’s Unverified ceiling (Clause 6) is the most an honest reading of such evidence shall earn; the AR tier is Unverified.

8.2 Verified. The assessor additionally examines a manufacturer evidence pack and shall accept, by mapping, the conformity artefacts the manufacturer or acquiring force already holds: the ISO 10218-1:2025 / ISO 10218-2:2025 risk assessment and own-force validation evidence (DEF-2); the instrumented jam/spoof and EMI/EMC trial reports and the IEC 62443-4-2:2019 component security-level evaluation (DEF-3); the MIL-STD-810H:2019 qualification reports (DEF-4); the ISO 14224:2016 maintenance package and record (DEF-5); the security design, accreditation and NIST SP 800-88 Rev. 2:2025 media-sanitization / crypto-erase evidence (DEF-6); the cyber accreditation, PSIRT and patch records (DEF-7); the sustainment commitments and export-control disclosures (DEF-8); and the mission-incident register with redaction allowed (DEF-9). Adoption is therefore a mapping, not new testing. Verified ceilings apply only to criteria whose pack items are present and examined; the AR tier is Verified.

8.3 Certified. The assessor witnesses the declared behaviour on the robot and its own console: the weapons-function configuration inspection (DEF-1); the own-force stop with targets at declared speed and load (DEF-2); GNSS-denied/jammed behaviour on a lab or range route (DEF-3); operation in a declared environmental condition on a sample (DEF-4); timed module swaps by uniformed maintainers (DEF-5); zeroisation and tamper response on the console (DEF-6); and a signed update with access controls (DEF-7). The documentary criteria (DEF-8, DEF-9) carry their Certified points from the Verified evidence. The AR tier is Certified.

8.4 Evidence bar. Each criterion states an evidence bar (Clause 6). Where the bar is not met the criterion shall score 0 — no evidence is 0 points, never a removal from the pool. A manufacturer self-declaration shall not earn points above the rung its independent corroboration supports.

8.5 Restricted evidence. Where a criterion rests on classified or export-controlled evidence, the registry shall hold an attestation (who verified, under what authority, against which criteria) in place of content (VRS-DEF-001 Annex B). Attestation-only evidence is admissible at the “documented” rung of the criterion it supports (VRS-GEN-012 admissibility) and shall not earn points above it; the restricted-evidence basis shall be recorded per Clause 10.

8.6 Company-wide fallback. Where a criterion offers a company-wide fallback (DEF-5, DEF-7, DEF-8, DEF-9) and model-specific evidence is unavailable, manufacturer-wide records shall earn the stated fallback points (VRS-GEN-005 §6); the substitution shall be recorded per Clause 10.

8.7 AR tier. The AR tier is the lowest tier among the criteria that determined the letter, and shall not exceed the model’s Intrinsic Rating tier (VRS-GEN-006 §7).

9 Underwriting and credit use

9.1 The letter is an opinion above the compliance floor, not a certification, and shall not be published or imply that any real robot holds a Veyrum rating. It makes no representation about the lawfulness of any deployment or about export lawfulness (VRS-DEF-001 Annex B.4).

9.2 The per-class letters and the recorded application classes are the underwriting hooks: the letter informs rate relativity, and the covered classes inform coverage scope, so that operation outside the assessed envelope is an exclusion or a condition rather than an implied covered risk. Two loss drivers shall be surfaced separately so an underwriter can weight them independently of the letter: the contested-environment / capture correlated-catastrophe driver (DEF-3, DEF-6, and the intrinsic cyber criteria of Clause 5), recording whether the model shares a fleet-wide control/update plane and whether that plane holds a system-level security evaluation (IEC 62443-3-3:2013, scoped per IEC 62443-3-2:2020), so a per-fleet accumulation cap can be set rather than pricing each unit independently; and the recoverability driver (DEF-5, DEF-6), because loss of an asset, its data or its embedded technology to an adversary is a recoverability event that does not diversify across a shared-plane fleet. Where a shared plane exists, the assessment shall record an accumulation denominator — the count of units within the shared IEC 62443-3-2:2020 zone/conduit — read from an artefact the manufacturer already produces; where the scoping does not enumerate the group, the denominator shall be recorded as null (not zero) and the correlated driver flagged as unbounded, never assumed to be a single unit.

9.3 For credit, the recoverability, residual-value and obsolescence drivers shall be readable from the recorded per-criterion points to inform LTV, residual curves and end-of-support assumptions: DEF-5 (field maintainability) and DEF-8 (programme continuity and sustainment horizon, in months) with the intrinsic serviceability and manufacturer-support criteria drawn into the pool (Clause 5) inform the obsolescence assumption. Recoverability (DEF-5, DEF-6) and sustainment horizon (DEF-8) shall be reported as separate fields and shall not be netted against each other.

10 Result recording

The rating record shall carry, per VRS-GEN-009: the displayed sector letter and the per-class letters with the class each was issued for; the per-criterion points earned across the sector criteria (Clause 6) and the contributing intrinsic criteria (Clause 5); the not-applicable set removed for each class and the resulting applicable-pool range; the contributing intrinsic criteria used; the AR tier; the edition (VRS 2026); the VRS-DEF-501 data-twin version; the mandatory weapons-functions exclusion statement (on every DEF record); the restricted-evidence basis state and the export-control classifications recorded as scope evidence (VRS-DEF-001 Annex B.4); and — where a shared control/update plane exists (Clause 9.2) — the accumulation-group size (or null). Recording flows to the Passport per VRS-GEN-009; no personal information shall be stored (VRS-GEN-012 §5.2).

11 Assessor checklist

An assessor with this Protocol and the evidence shall reach the same result by executing the following in order; no step admits an unrecorded judgement call, and any deviation shall be recorded with its basis:

• [ ] Application class(es) confirmed (ground UGV / EOD-CBRN / base-perimeter security / maritime security USV) (Clause 1.2; VRS-DEF-001 §4).
• [ ] Weapons-function boundary established and carved out; where it cannot be bounded, no letter is issued (Clause 1.3).
• [ ] Assessment tier fixed (Clause 8); the not-applicable set recorded per class and the applicable-pool range computed (Clause 4).
• [ ] Contributing intrinsic criteria drawn from their source standards at their own points and tiers (Clause 5).
• [ ] DEF-1 scope integrity — weapons-function exclusion verified; attestation present (evidence bar).
• [ ] DEF-2 own-force and bystander protection at speed and load scored; envelope declared (evidence bar).
• [ ] DEF-3 contested-environment integrity scored; link/positioning architecture declared (evidence bar).
• [ ] DEF-4 environmental qualification scored; theatre envelope declared (evidence bar).
• [ ] DEF-5 field maintainability scored; company-wide fallback recorded if used.
• [ ] DEF-6 capture and compromise resilience scored.
• [ ] DEF-7 cyber accreditation and vulnerability handling scored; company-wide fallback recorded if used.
• [ ] DEF-8 programme continuity and export/security constraints scored; company-wide fallback recorded if used.
• [ ] DEF-9 mission incident record scored; company-wide fallback recorded if used.
• [ ] Restricted evidence, if relied on, held at the “documented” rung and its basis recorded (Clause 8.5).
• [ ] Points added and divided by the applicable-pool range; letter read from the bands (Clause 7.1).
• [ ] Letters issued per class; the lowest displayed (Clause 4.3); each award held at its assessed-tier ceiling (Clause 6).
• [ ] Result recorded to the passport: per-criterion points, not-applicable set, contributors, tier, edition, twin version, weapons-functions exclusion statement, accumulation-group size or null (Clause 10).

Annex A (informative) — Worked example

FICTIONAL EXAMPLE — not a real product; illustrates mechanics only.

A fictional tracked ground robot, model code DEF-EX-01, is assessed for the ground UGV (logistics/ISR) application class at the Verified tier: a manufacturer evidence pack is examined and no behaviour is witnessed. The platform carries no weapons function; DEF-1 records the verified exclusion boundary. All nine sector criteria apply to every class, and the seventeen contributing intrinsic criteria of Clause 5 are drawn from their source standards at their own Verified points.

Sector criteria (Verified tier).

Contributing intrinsic criteria (Verified tier). Drawn at their own points, the seventeen criteria of Clause 5 have a combined range of 170 points and a Verified ceiling of 133; this model earns 127 of them (each at its Verified ceiling except the primary protective function SF-4, earning 9 of 11; the parts-availability criterion SV-5, earning 6 of 8; and the remote-access criterion CY-4, earning 5 of 7).

Letter. The applicable pool for the ground-UGV class is the sector range 100 plus the contributor range 170 = 270 points. Points earned = 81 (sector) + 127 (contributors) = 208. As a percentage of the pool, 208 ÷ 270 = 77.0 %, which falls in the AA band (≥ 75 %, below AAA’s 90 %). The result is Defence & Security AR: AA (VRS 2026) — Verified.

Tier ceiling by construction. At the Verified tier the pool’s own ceiling is (85 + 133) ÷ 270 = 218 ÷ 270 = 80.7 %, so AA is the best letter attainable without a witnessed demonstration (Clause 7.2); AAA would require Certified-tier evidence. No separate modifier is applied — the ceiling does the work.

Loss-driver read. DEF-3 and DEF-6 with the intrinsic cyber criteria feed the contested-environment / capture correlated-catastrophe driver; the assessment records whether DEF-EX-01 shares a fleet-wide control/update plane and its IEC 62443-3-2:2020 accumulation-group size for a per-fleet aggregate condition (Clause 9.2). DEF-5 and DEF-8 inform the recoverability and obsolescence read for credit (Clause 9.3).

Scope variant. Had the weapons-function boundary of DEF-EX-01 been impossible to establish, the model would be outside scope and no letter would issue (Clause 1.3); DEF-1 scores whether that boundary is verifiable, not whether a weapons function is present. Numbers illustrate mechanics only.

Bibliography

The full DEF anchor regime is verified in VRS-DEF-001; the following are the specific anchors this Protocol’s criteria and evidence tiers (Clauses 6 and 8) rest on, dated at point of use:

• ISO 8373:2021 — Robotics — Vocabulary (iso.org/standard/75539.html) — robot-term basis.
• ISO 10218-1:2025 / ISO 10218-2:2025 — industrial robot safety (robot; integration) (iso.org 73933; automate.org 2025) — absorbed ISO/TS 15066:2016; explicit cybersecurity clauses added. DEF-2 anchor.
• IEC 62443-4-2:2019 — technical security requirements for IACS components, SL-C against FR1–FR7 (webstore.iec.ch/en/publication/34421); IEC 62443-4-1:2018 — secure product development lifecycle. DEF-3/DEF-6 anchors.
• IEC 62443-3-3:2013 / IEC 62443-3-2:2020 — system-level security levels and zone/conduit risk assessment (webstore.iec.ch) — fleet control/update-plane accumulation anchor (Clause 9).
• MIL-STD-461H (2026-04-17; supersedes MIL-STD-461G:2015) — control of electromagnetic interference (everyspec.com; assist.dla.mil) — contested-environment EMI/EMC anchor (DEF-3).
• MIL-STD-810H (2019; Change Notice 1, 2022) — environmental engineering test methods (everyspec.com; iest.org) — theatre-qualification anchor (DEF-4).
• ISO 14224:2016 (corrected 2016-10-01) — collection and exchange of reliability and maintenance data (iso.org/standard/64076.html) — DEF-5 anchor.
• NIST SP 800-88 Rev. 2 (September 2025; supersedes Rev. 1:2014) — Guidelines for Media Sanitization (csrc.nist.gov/pubs/sp/800/88/r2/final) — capture/compromise crypto-erase anchor (DEF-6).
• NATO STANAG 4586 (Ed. 2, 2007) — UAV Control System interfaces (nato.int; everyspec.com) — ISR link-integrity context (DEF-3).
• VRS-DEF-501 — machine-readable data twin of this Protocol (Clause 5/6/7 values).

Change history