Taiwan's state missile institute clears US defence cyber audit for its rocket propellant line

Taiwan's state-run National Chung-Shan Institute of Science and Technology (NCSIST), the military research body that develops the island's missiles, said on Monday that the production line it uses to mass-produce solid rocket propellant has passed a US Cybersecurity Maturity Model Certification (CMMC) Level 2 assessment. CMMC is the cybersecurity standard that companies must meet to work in the American defence industry supply chain.

The institute said the cast-cure propellant line, run by its propulsion research centre, has two jobs: mass-producing rocket propellant for Taiwan's own missile programmes and competing for work in the US defence supply chain. It said the line went through more than a year of preparation, upgrades and assessment before it was cleared. The line was inaugurated in 2022 at the institute's Pengyuan campus in Pingtung County, according to the Liberty Times.

An accredited third-party CMMC assessment organisation, known as a C3PAO, checked 110 information security controls that the line had put in place under the US National Institute of Standards and Technology standard NIST SP 800-171, the institute said. It added that the result shows those controls are built into daily production and that the line now has a traceable and auditable security system protecting its core technology.

NCSIST said this is the third time its work has cleared a CMMC Level 2 review, after earlier approvals covering radar sub-antennas for the Patriot air defence missile system and its drone development work. It said passing the review shows the propellant line can take on international defence cooperation and high-end military projects that demand strict protection of information.

AI management standard

In a second announcement, NCSIST said it had also obtained ISO 42001 certification for its artificial intelligence management system. It described itself as the first public-sector body in Taiwan to apply for and pass that assessment on its own initiative. ISO 42001 is the first international standard for AI management that can be verified by an outside auditor.

To prepare, the institute set up a cross-departmental AI management committee, ran staff training, drew up an internal AI policy and risk management framework, and carried out documentation work and a gap analysis before the third-party audit, according to its statement.

NCSIST said the AI framework will support work on autonomous navigation and recognition for uncrewed tactical vehicles and on AI-assisted battlefield decision support. It said that as autonomous decision-making in drones and battlefield intelligence recognition become key technologies for asymmetric warfare, the resistance of AI systems to attack and the reliability of their algorithms have become national security issues.

The institute said it would combine the AI framework with its ISO 27001 information security system and the CMMC controls to protect sensitive military data once AI tools are introduced. It also said it would keep working with Taiwanese defence companies to raise their cybersecurity maturity and protect trade secrets, core technology and the wider defence supply chain.

What it means

Solid rocket propellant is a core input for missiles and rockets, and the certification removes one formal barrier to the institute bidding for subcontract work in the American missile supply chain. The institute did not name any US customer, contract, product or production volume tied to the propellant line, so the commercial payoff remains unproven.