PRIVACY MARK UNDEF-NED Subject EXECUTE ORDER TO tNC'OkPOR3 'rF' PF ALTS TLC CYWERSPJAC E COND 'I ONS TNTO MAJOR DOD EXERCISES Or n_rtator CJCS SC DTG 1120402 Feb 11 Precedence ROUTINE DAC General To CDR USSTRATCOM SC cc CDR USCENTCOM MC CDR USPACOM HONOLULU HI SC CDR US OUTHCOM MC CDR USJFCOM NORFOLK VA MC Aµ'RICOM CDR MC CD-P IJSSOCO_• MC L UCOZ CDC b_C COMBATANT CDR USNOR'THCOM SC CDR USTRANSCOM SC DIRNSA FT GEORGE G MEADE MD DTSA DIRECTOR SC DIP TWASHTN GTON DC HQ USAF SL ARMY HQ CNO WASHINGTON JC SC CMC WASHINGTON I3C SC IbHI 'L HOUSE SITUATION f-Oom WASH NGTON DC USD POLICY SC USD INTEL SC JOINT STAFF COMP SC JO--N_ STAF'F DJ2 SC JOINT S' 'AF'F DJ3 SCC JOINT STA-01 D 7 SC 10114 S'IAF'I• DJ n SC JOINT STAFF DJ7 SC JOINT STAFF J3 DEP-DIR GLOBAL OPS SC JO7-NT STAFF J3 NMCC OPS SC JOINT STAFF J3 SC -------------------------------------------------MSGTD GENADM N t SMTF 200'7 C7C S S F002 SUBJ L 'XEC JTL OPC E Z TO INCORPOR TE RE ALISTIC CYBnRSPACE CONDITIONS INTO MAJOR DOD EXERCTSES MSGJD ORDER CJCS SUBJ EXECUTE ORDER TO INCORPORATE REALISTIC CYBERSPACE CONDITIONS INTO MAJOR DOD EXFRCTSES S RET USA F'VEY REF A DOC CJC' S MEMO TO SECDEPYMILITA RY LARGE GROUP-PLUS Ll'J13ACK ON CYBERWARFARE 27SEP2010 RE F B DOC DEFF_ NSE PLANNING AND PROGRX14MING GUIDANCE FYICI REF C DOC NATIONAL D EFENSE STRATEGY FOR CYBERSPACE OPERATIONS DRAT RE F D DOC DODT 5530 COfuYJlVTF'R T'FTWORK DF'FFNSt 9MAR200J ORDTYP EXORD CJCS TTMF ZONF4 Z d GENTEXT SITUATION Z - U CYBERSPACE IS A C ONTESTFD DOMAIN AND M'I'LT B XOP W MORE HOT' Co-yr- S fI D - y AS GLOBAL STATE AND NON-STATE ACTORS MAIN ACCESS TO SOI HISTICA'TED O 'Fi lgslVE CYBER CAPABI ITIES DOD NETWORKS ARE SUBJECT TO CONSTANT ATTEMPTS AT INTRUSION EXPLOITATION OR DATA COMPROMISE AND ATTACK BY FOREIGN NTELLIGENC E AND MILITARY SERVICES ORGANIZED CRIMINAL GROUP'S TERRORISTS ACTIVISTS HACKERS AND INSIDERS ALTHOUGH MANY SUCH EFFORTS ARE AIMED AT OBTAINING SENSITIVE 3N1'ORMA°TION A POTENTIALLY GP ATPR O PIR T 'ONA L CONCI 'RN iS THAT -4 SOPHISTICATED ADVERSARY -'MIGHT HOLD DOD NET -°C'ENTRIC WARFIOHTIAJG OPERATIONS AT RISK THF LOW COST OF FNTItY Alit THE AVA-lLA'sTTJTY OF SOPHISTICATED CYBER AT TACK CAPABILITIES FOR HIRE AS WELL AS TEE IMPRACTICALITY OF PERFECT CYBER DEFENSE MAKES A MGRADED COMPROMISED OR LOCr ILY n TTFRa tI CT1 NTLY DF N%L D CYBFR I NVIRONNJENT i HIGH-PROB PTLITY THREAT TO DOD NET-CENTRIC OPERATIONS IN AIT FUTURE CONFLICT GENTFX T t42$SlON L GENTEXTJEXECUTTONd3 U EXECUTION 3 A U TNTIMT 3 A I ' COMBATANT COMNLANDERS SERVICE C°l EFS AND SUEOADINATE E'_EIIENTS INCORPORATE REALISTIC CYBERSPP CE CONDITIONS TO INCLUDE ROBUST RED TEAT OPERATIONS INTO MAJOR XI IRCI SES IN ORDER TO DEVELOP C t APA81LITIES AND TTP - S TO SUS T zIN COMBAT _AND OTHER ESSENTIAL OPERATIONS ITT z DEGRADED OR DENIED THIS EXORD SUPPORTS BUT DOES NOT RFQU7RE THE' Df vp' OPMEN C YBER ENVTRONMFN7 01' COMPONENT CYBE R AGGRESSOR T A24S-IN I'NsTIA4 PHASU$ READ TkLill OP-RAIIOFS MAY PLOT BE REQUIRED TO GENERATE DESIRED EXE_iRItiE E-FFECTS-BUT DOES REQUIRE NSA CERTIFICT ON FileD iTRA4'COM ACCREDITATION OY ANY COMPONENT CYBE R AGGRMSSOR TE_ANS PRIOR O LIVE PLAY ON DOD NETWORKS STARTING 1$0 DAYS AFTER RELEASE OF THIS ORDER C RTTFICAT x ON REQUIREMENT DOES NOT AFFECT RED TFAM PLAY THAT HAS ALREADY SEEN SCR 1DULED POR COMBATANT COMPirND EXSRCISL S PRIOR -0 T i i-' DATE TEAM THAT HAVE ALREADY BEEN CERTIFIED TO OPERATE BY NSA DO NOT HAVE TO GET ECERTIPIED ELY Y8E COM BUT WILL NEED TO K 'P Y'IIEi_t C'EIATIF _CAT CAN t Ik RLW2' IAW CRT-TER-7 A TO BE ESTABLISHED AY CYBERCOAM IC'cl RSA U TASKS U DOD COMPONEN'T'S FOR TILE' PURPOSE'S OF TIiIS OI r -VR NCLUDE'S JIIE MILITARY DEPARTk4ENTS THE COMBATANT COM lANDS DEFENSE AGENC'LS AND THE US COAST-GUARIQ rAS_ AP ROP-R IATR _ 3 13 A •7 REF D IF REED TEAM SERVICES ARE ACCOM-LISHED BY YOUR CERTIFIED 3 B 1 j TIER 2 CNDSP M SURE YOUR CND SUBSCRIBER AGREEMENTS CAPTURE THE RFfiUT REMRNT IDENTIFIED IN THIS EXORD 3 B I K SERV CTS INCORPORATE OPERATIONAL TTP'S DEVELOPED TO M TTG TE EFFECTS OF ADVERSARY DISRUPTION Off' NET-CENTRIC CAPABt'LTIES TTETO OPRERA1 IONS INTEGRATE 77-TOPS TTP'S TNTO SERVICE SCHOOLHOUSES INCLUDING WEAPONS SCHOOLS NETWORK OPEI kT'1ONS TRAINING VENUES COORDINATE WITH USSTRATCOM ON ALL TIER 1 RED TEAM OPERA' IONS 3 B L EMPLOYED UNDER DOD COMPONENT C 'ON T I OI AS PART OE' THIS 'EXORD TN ORDER TO FACILITATE S 'R-kTCOtI'S GIG-vglDE SITUATIONAL AWARENESS EVENT CIiARAC'IER tVATION AND DECONPLICT ION OE ON-NET OPERAT 0NS 3 I3 1 M IDENTIFY RESOURCE CONSTRAIINTS ASSOCIATED WITH THIS EXORD TO USSTRATCON_ FOR ADVOCACY 3 3 2 U Ci RUSSTRATCOM 3 E3 3 0 ' JE I 'OLLV' CRi '1ASIf CDRUSSTFtATCOM' S _DISCP ETIOid _ MAY BE DEL_ GATI D TO l3SC _ 3ERCOtvl AT 3 6 3 E U I E VELOP A STANDARD REF'ORTTNG TOOT TO CAP'T'URT LESSONS T FAR Rf INCLUDING EFFECT VE RESPONSES 10 RED 'S EAN ACTIONS IN TUE JLLIS DATi'ALaSE AND DISSEMINATE UPDATES ANNUALLY IN THE GLOBAL C BER-SYNCHRONTZA4ION CONFERENCE OR MORE FREQUENTLY AS NEEDED SHARE LESSONS LEARNED Li ROM RED TEAM OPERATIONS WITH COMPONENTS CND'-SP' S AND OOT E IN ORDER TO IMPROVE GLOBAL CYBER D F P F SPS - - 3 B 3 G U ASSIST SERVICES IN INCORPORATING INDICATIONS AND WARNING Or ADVERSARY CYBER ATTACKS AND CYBER DEFENSE-RELATED MITIGATING '-VT ' S INTO DOD 3 B 3 1 U SU JF wT TO FOREIGN DISCLOSURE RF GUT ATTONS SHARE EFFF TTVE CYBER-DEFENSE i'TP'S TO NCLUDL I W WiTH APPROPRIATE MISSIO4 PARTNERS '_'O TMPROVE ALLIED AND COALITION CYBER DEFENSE AND SECURITY EFFORTS 3 B - UY DTECTOI NA ' I Ota L- g-CIIRITY A GP NCY _ DIPNSA ___ - 3 B 5 U DEFENSE INTELLIGENCE AGENCY COMPONENT --ASKS- P ARA -_ 3 R l b DTA IN ADDITION TO APP7-ICABLE 3 B 6 U DEFENSE INFORMATION SYSTEMS AGENCY DISA ' IN ADDITION TO APPLICABLE COMPONENT TASKS PARA 3 -B 1 BPT PROVIDE INI ORMATTON ASSURANCE AND NEiOPS SUPPORT TO DOD COMPONENTS TIN DEVELOPING ACID IMPLEMEN'I'TUG CAPABILITY TO FIGHT THROUGH A DEGRADED OR COMPROMISES CYBER ENVIRONMENT WHER8 ADDITIONAL RESOURCES ARE REOUIR 0 ISO THIS EFFORT IDVN' TIF'Y THEM THROUH NORMAL 'RESOURC I NG PROCESSES AND CILANNELS 3 B 7 U OFFICE OF THE SECRETARY OF DEFENSE DOD CHIEF INFORMATION OFFICER DOD CIO PROVIDE POLICY DIRECTION AND GUIDANCE FOIL THE DEVELOPMENT AND IMPLEMENTATION OF CYBER DEFENSE REQUIREMENTS IDENTIFIED IN THE COURSE OF RED TEAM OPPOSED µ XER SES AND WARG AMFu B S U OFE'IC E OF TIME SECRETARY OF DEFENSE - DIRECTOR OPERATIONAL TEST AND EVALUATION DOT§E _AW STATUTORY GUIDANCE AND CW DOD COMPONENTS PERFORM 3 B 8 A U OPERATIONAL ASSESSMENTS OF CYBER DEFENSE AND INORMATION ASSURANCE ACTIVITIES ISO MAJOR WARF'IGHITING EXFRCTSF S 3 B 8 2-M CAPTURE CYBER I E FENSE AND OTHER APPLICABLE LESSONS LEARNED 1N JLLIS 3 B 8 C U SHARE METRICS DEVELOPED AS PART OF A8S SSIv NT PROCESS WTTH USCYBERCOM AND NSA TO SUPPORT DEVELOPMENT OF STANDARDIZED REPLIC BLE 'PROCESSES ISO AGGRESSOR 'rE Aij TTtAmlmc -AND CE RTI TCATIQN 3 8 8 D U LEVERAGE PARTICIPATION IN ILIA ADVERSARY TACTICS ANALYSiS To ASSIST CYBERCOM IN DEVELOPING AN -ADVERSARY TACTICS PLAYBOOK ISO COMPONENT TRAINING SEE PARA 3 B 3 t 4 U COORJINAT NG INSTRUCTIONS ACTIVE COORDINATION WITH COUNTERPARTS ABOVE S B U DTRLAUTH WITHIN DOD AND BEYOND JULLS AND GLOBAL CYBER SYNCHRONIZATION CONr REQUIREMENTS TO DISSEMINATE AND IMPROVE UPON LESSONS LEARNED IS HIGHLY DESIRED z C U USSTRATC 6H W ILL ESTABL7 S14 2 CHAtat l LS FOR EXERC I SF PLAY 4NCE A LETTER OR REQUEST FOR RED TEAM SUPPORT AUGMENTATIOII IS RECEIVED FROM A COMMANDER USCYBERCOM WILL COORDINATE WITH THE COMPONENTS FOR RED TEAM SUPPORT COORDINATION MILL INCLUDE XEkC1 SE-SPECII IC GROUND RULE'S As NEEDED TO ASSURE REAL-WORLD MISSION ASSURANCE CONTINUITY 5_ U GROUND RUI I -- U DEFINITIONS 6 A U DOD COMPONENTS FOR THE PURPOSES OF THIS ORDER INC7 UDES THE MILITARY DEPARTMENTS TIE COMBATANT COMMANDS DEP NISL AGENCIES ' AND DOD FIELD ACTIVITIES ALSO INCLUDES THE US COAST GUARD AS APPROPRIATE 6 8 U DEGRADED CY8ERSPAC8 ENVIRONMENT FOR THE PURPOSE S OI' THIS EXORD AN OPERATING ENVIRONMENT IN WHICH THE AVAILABILITY OR RELIAfSIL TY OF 14- SsION ESSENTIAL NETWORKS OR SYSTEMS IS NOT ASSURED WHETHER AS A RESULT OF ADVERSARY AC'T'ION D IT'ENSIVE flIT2GI' TION MEASURES SUCH AS IMPLLMENITATION OF MTNiIMIZE USE OF ALTERNATIVE BANDTN 1IDTH-CONISTRA INED SYSTEMS OR ADDITIONAL SECURITY MEASURES INADVERTENT FRIENDLY ACTION OR NATURAL EVENT N-- Y INCLUDE TEMPORARY INTERD4ITTENT OR LOCALIZ ED NON-AVAILABILITY DENIAL OF NETWORK OR SYSTEM ACCESS DUE TO ADVERSARY ACTIVITY NATURAL EVENT OR FRIENDLY DEFENSIVE ACTIONS SUCH AS SYSTEM ISOLATION IN TIME EVEtlff OF' KNOWN OR SUSPECTED CORI_PROMISE FOR THE PURPOSES CF THIS F XORD A COMPROMISED OPERATING 6 C U COMPROMISE ENVIRONMENT IS ONE IN C'4HICH THE CONF'TDE'111TIALTTY 1'N EGRITY OR NONREPUDIAT_ON OF MISSION ESSENTIAL NETWORKS SYSTEMS OR DATA IS ASSESSED AS QUESTIONABLE DUE TO INSIDER THREAT TNADVERTENT ACTION OR ADVERSARY IN A COMPROMISED CYBER ENVIRONMENT NETWORKS AND SYS EMS MAY EXPLOITATION APPEAR TO BE OPERATING NORMALLY EVEN WHILE BEING ALTERED OR EXPLO TED BY A CRIMINAL OR HOSTILE ENTITY A COMPROMISED CYBERSPACt ENVIRONMENT TS INHERENTLY HARDER TO DETECT THAN A DEGRADED CYBERSPACE ENVIRONMENT AND C ONS80UFNCES MAY B8 MORE FAR-T E ACHING FOR TNS TAIvC_E IF' C2 OR LCGIS I'TCAL DATA IS INTERCEPTED CORRUPTED OR _ALTERED CRITICAL SUPPLIES AND COMPONEN t'S SUCK AS AERIAL REFUELER S AMMUNITION OR Mme DICAL SUPPORT MAY BE I4IISROUTED OR INTERCEPTED OR BLUE FORCE I F TRACKING MAY B„ ALTERED SO AS TO C'REATF FRIENDLY FIRE INCIDENTS OR MASK ADVERSARY ACTIVITIES 6 D U DFNITED CYBERSPACE ENVIRONMENT FOR THE PURPOSES OF THTS F XORD AN OPERATING ENVIRONMENT IN WHICH ACCESS TO OR NO j1- L PUNCT1ONS OP A f-t ssIONESSENTIAL NETORK OR SYSTEM ARE PREVENTED BY ADVERSARY ACTIVITY UNIINITENDED EVENT OR COMMANDER-DIRECTED RESTRzCTTON IV RESPONSE TO SUCH CONDITIONS FOR TI-17E PURPOSES OF TI•IIS 6 E U DEFENSE CRITICAL INFRASTRUCTURE DCI E RD AND PER DODD 3020 40 DOD AND NON-DOD NE TWORM AS8E' I'S kSSENTTAL TO PROJECTL SUPPORT AND SUSTAIN -MLLIZZIRY _FORCES AND OPERATI-30S WORLDWIDL _ b dI 6 10 J PUBLIC AFFAIRS PA GUIDANCE 10 A U POSTURE THE PA POSTURE FOR ALL DwF NST P CY3 R OPERATTONIS --'s PASSIVE RESPONSE TO QUERY ONLY 10 B U DISCLOSURE IN TIME EVENT THAT INFORMATION REGARD'NG A SPECTFTC EXERCISE OR CY8ER DEPENSIVL ACTION IS DI SCLOSE''D 1-14-2 FOLLOWING CONT INGLNCY STATEMENT IS AUTHORIZED FOP DASD PA USE A FT ER NOTIFICATION OF AND APPROVAL BY ALL AC ENCTES' WILL DE''E'R'R 'T'O OASD PA PROPER RELE SING 1iWT'HOR 'ITIE'S 10 C U APPROVED STATEMENT MAINTAINING THE DOD' S ABILITY TO SUSTAIN GLOBAL OPERATIONS IN A CONTESTED CYBER ENVIRONIEENT IS VITAL TO U S NATIONAL INTERESTS THE DOD PLANS AND CONDUCTS 'XERCISES TO 13UILD AND SUS zA N I 'S NET-CENTRIC OPERATIONAL CAPABILITIES ACROSS AN ARRAY OF FORESEEABLE CONDITIONS TO INCLUDE CYEER ATTACK AGAINST TI'S NETWORKS AND VTTA SYSTEMS BECAUSE IT WOULD AID THOSE WHO WOULD TFIREATEN U S INTLR STS IN AND DATA CYBERSPACE IT WOULD SSE IRRESPONSIBLE TO DISCUSS THE NATURE OF A'VY SPECIFIC OPERATIONS ACTUAL OR ALLEGED 11 U POC TS JCS D3 CYBr- R DIVISION CNOD DSN 6 I1°1991 HIS ORDER WILL REMAIN IN EFFECT UNTIL RESCINDED This document is from the holdings of The National Security Archive Suite 701 Gelman Library The George Washington University 2130 H Street NW Washington D C 20037 Phone 202 994-7000 Fax 202 994-7005 nsarchiv@gwu edu