text: Chapter 2
  Synchronizing Department of Defense Information Network Operations and Defensive
  Cyberspace Operations
  2-101. Defensive cyberspace operations and DODIN operations share a common objective of a secure
  network. DODIN operations tasks are network-focused. Cybersecurity sets the baseline security posture of
  the network to protect against known exploits and vulnerabilities, rather than a particular threat actor or
  capability. The cybersecurity workforce attempts to mitigate all vulnerabilities of their assigned network or
  systems. Cybersecurity uses available intelligence about specific threats to improve the network’s security
  posture.
  2-102. By contrast, defensive cyberspace operations are mission-focused and threat-specific. Defensive
  cyberspace operations missions involve deliberate measures to counter a specific threat attack, exploitation,
  or malware that has breached security measures. Defensive cyberspace operations leverage information from
  intelligence, counterintelligence, law enforcement, and other sources, as required.
  Cyberspace Electromagnetic Activities
  2-103. Commanders and staffs face the challenge of enabling joint, interorganizational, and multinational
  collaboration and assuring access to critical data and information networks in increasingly congested and
  contested cyberspace and electromagnetic spectrum environments, while simultaneously denying the same
  to the enemy. Operating in the congested and contested information environment requires commanders and
  their staffs to synchronize signal, cyberspace, and EW capabilities through CEMA. Cyberspace
  electromagnetic activities is the process of planning, integrating, and synchronizing cyberspace and
  electronic warfare operations in support of unified land operations (ADP 3-0).
  2-104. CEMA integrates—
  * Cyberspace operations.
   DODIN operations.
   Defensive cyberspace operations.
   Offensive cyberspace operations.
  * EW.
   Electronic attack.
   Electronic protection.
   Electronic warfare support.
  * Spectrum management operations.
  2-105. Because the hybrid threat integrates information warfare capabilities in these areas, U.S. forces must
  similarly coordinate their defenses. Attempting to conduct signal, cyberspace, and EW activities in isolation
  makes them more vulnerable. Synchronizing these activities through CEMA ensures coordinated defense and
  counter-offense against threat information warfare activities.
  2-106. To support CEMA at the theater army level and below, the G-6 (S-6) staff and spectrum manager
  integrate DODIN operations and spectrum management actions. They also coordinate to synchronize these
  actions with mutually supporting capabilities residing in the G-2 (S-2) and G-3 (S-3) sections.
  2-107. Signal, cyberspace, and EW missions share certain areas of potential overlap. Each has its own set
  of threat and performance indicators. Synchronizing signal, cyberspace, and EW missions and tasks
  strengthens all of them beyond their inherent capabilities.
  2-108. Shared awareness between signal, cyberspace operations, EW, and intelligence elements improves
  situational understanding and identifies opportunities for mutual support between the capabilities. The
  CEMA section coordinates to deconflict spectrum use between signal and EW elements. Deconfliction
  ensures EW capabilities do not create unintended electromagnetic interference (frequency fratricide) with
  friendly communications, unmanned aircraft systems, weapon systems, or positioning, navigation, and
  timing. Failing to share situational understanding could cause planners or operations personnel to miss
  indicators of a cyberspace or electronic attack. The EW section can plan and execute electronic attack and
  electronic protection actions to support signal capabilities.