text: Appendix D
  UNITED STATES CYBER COMMAND
  D-22. The Unified Command Plan and various Secretary of Defense orders grant United States Cyber
  Command (USCYBERCOM) the coordinating authority for all DOD cyberspace operations, including those
  operations to operate, secure, and defend the DODIN. USCYBERCOM accomplishes its missions within
  three primary lines of operation: secure, operate, and defend the DODIN; defend the nation from attack in
  cyberspace; and provide cyberspace support as required by a combatant commander. USCYBERCOM
  directs the security operations and defense of the DODIN using directive authority for cyberspace operations.
  When directed, USCYBERCOM also conducts military cyberspace operations external to the DODIN in
  support of national objectives. Refer to JP 3-12 for more information on USCYBERCOM roles and
  responsibilities.
  D-23. Cyberspace operations are conducted by cyberspace forces consisting of both military and civilian
  personnel. DOD cyberspace forces include forces assigned to USCYBERCOM through the global force
  management process, Service-retained forces, and reserve component forces. Cyberspace forces also include
  personnel that perform cybersecurity service provider roles established by the Services and DOD agencies to
  protect segments of the DODIN. Cybersecurity service providers are generally DOD certified civilians and
  contractors who perform DODIN protection services such as analytics, infrastructure support, incident
  response, auditing, and service provider management.
  CYBER MISSION FORCE
  D-24. The commander, United States Cyber Command exercises combatant command authority over the
  cyber mission force. The commander, United States Cyber Command uses cyber mission force units to
  conduct national strategic missions or assigns units to support combatant commander missions through a
  JFHQ-C. The cyber mission force is a subset of the DOD’s total force for cyberspace operations. The cyber
  mission forces consists of three types of elements:
  * Cyber combat mission force.
  * Cyber protection force.
  * Cyber national mission force (CNMF).
  Cyber Combat Mission Force
  D-25. The cyber combat mission force conducts OCO and related technical and analytical activities in support
  of geographic or functional CCMD operations. When authorized and directed, the cyber combat mission
  force conducts cyberspace attacks in neutral and enemy cyberspace to create effects against threat
  capabilities. The cyber combat mission force consists of combat mission teams and combat support team(s).
  D-26. Combat mission teams are tactical teams that conduct cyberspace reconnaissance and cyberspace
  attacks in neutral and enemy cyberspace. Combat cyber teams are technical teams that support combat
  mission teams through intelligence analysis, cyberspace capability development, linguist support, and
  planning.
  Cyber Protection Force
  D-27. The cyber protection force conducts DCO-IDM within the DODIN or, when authorized and directed,
  in friendly cyberspace beyond the DODIN. The cyber protection force consists of cyber protection team(s)
  (CPT) organized, trained, and equipped to defend assigned cyberspace in coordination with and supporting
  segment owners, cybersecurity service providers, and users. The types of CPTs are—
  * National CPTs. Assigned to and directed by Cyber National Mission Force-Headquarters
  (CNMF-HQ).
  * DODIN CPTs. Assigned to and directed by Joint Force Headquarters-Department of Defense
  information network.
  * CCMD CPTs. Assigned to and directed by CCMDs.
  * Service CPTs. Assigned to and directed by their assigned Service cyberspace component.