jp3_12r

Chapter II
c. Authorities Overlap. Like other military operations conducted by the JFC or
Service elements, CO are covered by appropriate authorities, such as military orders,
standing or supplemental rules of engagement, DOD policy, etc. This includes military
intelligence activities that provide ISR in cyberspace. The JFC also receives support from
DOD intelligence agencies, such as NSA, in accordance with national and departmental
policies and guidance. Likewise, DOD ordinary business operations in cyberspace are
accomplished by DOD agencies following DOD policy.
2. Military Operations In and Through Cyberspace
a. Cyberspace Operations. The successful execution of CO requires integrated and
synchronized offensive, defensive, and DODIN operations, underpinned by effective and
timely operational preparation of the environment (OPE). CO missions are categorized as
OCO, DCO, and DODIN operations based on their intent. Specific actions are discussed in
paragraph 2.e, “Cyberspace Actions.” All CO missions are informed by timely intelligence
and threat indicators from traditional and advanced sensors, vulnerability information from
DOD and non-DOD sources, and accurate assessments.
See JP 5-0, Joint Operation Planning, Appendix D, “Assessment,” for more information on
assessment and battle damage assessment (BDA).
(1) Offensive Cyberspace Operations. OCO are CO intended to project power by
the application of force in and through cyberspace. OCO will be authorized like offensive
operations in the physical domains, via an execute order (EXORD). OCO requires
deconfliction in accordance with (IAW) current policies.
(2) Defensive Cyberspace Operations. DCO are CO intended to defend DOD or
other friendly cyberspace. Specifically, they are passive and active cyberspace defense
operations to preserve the ability to utilize friendly cyberspace capabilities and protect data,
networks, net-centric capabilities, and other designated systems. DCO responds to
unauthorized activity or alerts/threat information against the DODIN, and leverages
intelligence, counterintelligence (CI), LE, and other military capabilities as required. DCO
includes outmaneuvering adversaries taking or about to take offensive actions against
defended networks, or otherwise responding to internal and external cyberspace threats.
Most DCO occurs within the defended network. Internal defensive measures include
mission assurance actions to dynamically reestablish, re-secure, reroute, reconstitute, or
isolate degraded or compromised local networks to ensure sufficient cyberspace access for
JFC forces. DCO also includes actively hunting for advanced internal threats that evade
routine security measures. However, some adversary actions can trigger DCO response
actions (DCO-RA) necessary to defend networks, when authorized, by creating effects
outside of the DODIN. DCO consists of those actions designed to protect friendly
cyberspace from adversary actions. DCO may be conducted in response to attack,
exploitation, intrusion, or effects of malware on the DODIN or other assets that DOD is
directed to defend. DOD’s DCO mission is accomplished using a layered, adaptive, defensein-depth
approach, with mutually supporting elements of digital and physical protection. A
key characteristic of DOD’s DCO activities is a construct of active cyberspace defense. The
Department of Defense Strategy for Operating in Cyberspace describes active cyberspace
II-2 JP 3-12