As cyber threats have grown in sophistication, federal efforts to address them have evolved. Presidential Decision Directive 63, signed in May 1998, established a structure under White House leadership to coordinate the activities of designated lead departments and agencies, in partnership with their counterparts from the private sector, to eliminate any significant vulnerabilities to both physical and cyber attacks on our critical infrastructures, including computer systems. National cyber policy was updated in 2003 with The National Strategy to Secure Cyberspace. Presidential Decision Directive 63 was superseded later that year by Homeland Security Presidential Directive 7, which assigned the Secretary of Homeland Security responsibility for coordinating the nation’s overall critical infrastructure protection efforts, including protection of the cyber infrastructure, across all sectors (federal, state, local, and private) working in cooperation with designated sector-specific agencies within the executive branch. Both of these policies focused on defensive strategies, and Homeland Security Presidential Directive 7 did not emphasize protection of federal government information systems. Subsequent classified presidential directives and strategic planning documents have continued to reflect evolving federal policy in response to cyber threats. Recognizing the need for common solutions to improve cybersecurity, the White House, Office of Management and Budget, and various federal agencies have launched or continued several governmentwide initiatives that are intended to enhance information security at federal agencies. According to Director of National Intelligence implementing guidance, in 2008 the Comprehensive National Cybersecurity Initiative was begun in order to develop an approach to address current threats, anticipate future threats and technologies, and foster innovative public-private partnerships. It was created to bridge cyber-related missions for federal agencies, by asking them to undertake a set of 12 initiatives and 7 strategic enabling activities. According to DOD officials, these initiatives include defensive, offensive, research and development, and counterintelligence efforts. Programs focus primarily on the security of executive-branch networks, which represent only a fraction of the global information and communications infrastructure on which the United States depends. In May 2009, the National Security Council and Homeland Security Council completed a 60-day interagency review intended to assess U.S. policies and structures for cybersecurity and outline initial areas for action. The resulting report recommended, among other things, appointing an official in the White House to coordinate the nation’s cybersecurity policies and activities, preparing an updated national cybersecurity strategy, developing a framework for cyber research and development, and continuing to evaluate the Comprehensive National Cybersecurity Initiatives. Following the lead of federal government efforts, DOD initiated several efforts to develop policy and guidance on cyberspace operations. In 2006 and 2007, The National Military Strategy for Cyberspace Operations and associated Implementation Plan provided a strategy for the U.S. military to achieve military superiority in cyberspace and established a military strategic framework that orients and focuses DOD action in the areas of military, intelligence, and business operation in and through cyberspace. In 2008, U.S. Strategic Command developed the Operational Concept for Cyberspace, which identifies near-term concepts to improve operations in and through cyberspace and gain superiority over potential adversaries in support of national objectives. The 2009 Quadrennial Roles and Missions Review Report discussed efforts by the Cyber Issue Team, jointly led by the Office of the Under Secretary of Defense for Policy and U.S. Strategic Command, which addressed cyberspace issues related to developing, structuring, and employing the cyberspace force. Also in 2009, U.S. Strategic Command developed an Operations Order titled Operation Gladiator Phoenix to provide DOD with a strategic framework to operate, secure, and defend the global information grid. As early as 2006, the Quadrennial Defense Review highlighted the department’s need to be capable of shaping and defending cyberspace. DOD published a new Quadrennial Defense Review in February 2010, which designated cyberspace operations as a key mission area and discussed steps the department was taking to strengthen capabilities in the cyber domain, including centralizing command of cyber operations and enhancing partnerships with other agencies and governments. Currently, DOD continues to develop and update cyberspace policies. Different types of cybersecurity threats from numerous sources may adversely affect computers, software, networks, agency operations, industry, or the Internet itself. Cyber threats to federal information systems continue to evolve and grow. These threats can be unintentional or intentional, targeted or nontargeted, and can come from a variety of sources. Unintentional threats can be caused by inattentive or untrained employees, software upgrades, maintenance procedures, and equipment failures that inadvertently disrupt systems or corrupt data. Intentional threats include both targeted and nontargeted attacks. An attack is considered to be targeted when a group or individual attacks a specific system or cyber-based critical infrastructure. A nontargeted attack occurs when the intended target of the attack is uncertain, such as when a virus, worm, or other malicious software is released on the Internet with no specific target. Government officials are concerned about cyber attacks from individuals and groups with malicious intent, such as criminals, terrorists, and adversarial foreign nations. Threats to DOD computer networks posed by the intelligence branches of foreign countries and hackers alike represent an unprecedented national security challenge. For example, in February 2009, the Director of National Intelligence testified that foreign nations and criminals have targeted government and private-sector networks to gain a competitive advantage and potentially disrupt or destroy them, and that terrorist groups have expressed a desire to use cyber attacks as a means to target the United States. The Federal Bureau of Investigation has also identified multiple sources of threats to our nation’s critical information systems, including foreign nations engaged in espionage and information warfare, domestic criminals, hackers, virus writers, and disgruntled employees and contractors working within an organization. Table 1 summarizes those groups or individuals that are considered to be key sources of cyber threats to our nation’s information systems and cyber infrastructures. These groups and individuals have a variety of attack techniques at their disposal. Furthermore, as we have previously reported, the techniques have characteristics that can vastly enhance the reach and effect of their actions, such as the following:  Attackers do not need to be physically close to their targets to perpetrate a cyber attack.  Technology allows actions to easily cross multiple state and national borders.  Attacks can be carried out automatically, at high speed, and by attacking a vast number of victims at the same time.  Attackers can more easily remain anonymous. Table 2 identifies the types and techniques of cyber attacks that are commonly used. Various terms are used within the DOD cyberspace domain. For example, in May 2008, DOD defined cyberspace as the “global domain within the information environment consisting of the interdependent network of information technology infrastructures, including the Internet, telecommunications networks, computer systems, and embedded processors and controllers.” Also, DOD defines computer network defense as actions taken to protect, monitor, analyze, detect, and respond to unauthorized activity within DOD information systems and computer networks. For further discussion of policies, programs, and tools that DOD uses to protect its networks, see appendix III. Table 3 lists several key terms used within the DOD cyberspace domain. DOD’s organization to address cybersecurity threats is decentralized and spread across various offices, commands, military services, and military agencies. DOD cybersecurity roles and responsibilities are vast and include developing joint policy and guidance and operational functions to protect and defend its computer networks. DOD is taking proactive measures to better address cybersecurity threats, such as developing new organizational structures, led by the establishment of the U.S. Cyber Command, to facilitate the integration of cyberspace operations. Cybersecurity roles and responsibilities within DOD are spread across various DOD components. The current cybersecurity organizational structure is decentralized and there are many DOD components that hold responsibilities. Cybersecurity roles and responsibilities include developing joint policy and guidance and operational functions to defend and secure DOD networks, and are spread among the Office of the Secretary of Defense, Joint Staff, functional and geographic combatant commands, military services, and military agencies. According to DOD officials, to ensure a holistic approach and limit potential stovepiping, the department has begun to develop cybersecurity expertise across various offices. Figure 1 illustrates DOD’s cyber organization as of March 2010. Additionally, there are other organizations that play a pivotal role in cybersecurity, such as the DOD intelligence agencies, National Guard, and defense criminal investigative organizations. DOD is taking proactive measures to reorganize and develop new organizational structures to better address cybersecurity threats. However, it is too early to tell if these organizational changes will help DOD better address cybersecurity threats. There are several offices within both the Office of the Secretary of Defense and the Joint Staff that share responsibility for developing joint cyber policy, guidance, and doctrine for DOD activities that occur in and through cyberspace. For example, within the Office of the Secretary of Defense, the offices of the Under Secretary of Defense for Policy; Assistant Secretary of Defense for Networks and Information Integration; and the Under Secretary of Defense for Intelligence, all share responsibility for developing joint cyber policy and guidance. For example, according to DOD officials, both the Assistant Secretary of Defense for Networks and Information Integration and the Under Secretary of Defense for Policy have responsibility for strategic-level guidance and oversight for computer network operations and information assurance. Appendix II provides more detailed information on the cyber-related responsibilities of the DOD offices. Several offices within the Joint Staff also hold responsibilities for developing joint cyber policy, guidance, and doctrine for DOD activities that occur in and through cyberspace. The Joint Staff’s cyber responsibilities include establishing and developing doctrine, policies, and associated joint tactics, techniques, and procedures for DOD’s global information grid, information assurance, and joint and combined operations.