text: Signal Support by Army Echelon, Core Competencies, Training, and the Army Network
  Department of Defense Information Network Operations
  2-95. The cyberspace operations mission of DODIN operations is primarily a signal support function.
  Department of Defense information network operations are operations to secure, configure, operate, extend,
  maintain, and sustain Department of Defense cyberspace to create and preserve the confidentiality,
  availability, and integrity of the Department of Defense information network. (JP 3-12). DODIN operations
  functions include routine activities to operate the network and establish the baseline cybersecurity
  framework.
  Support to Defensive Cyberspace Operations
  2-96. Defensive cyberspace operations are missions to preserve the ability to utilize blue cyberspace
  capabilities and protect data, networks, cyberspace-enabled devices, and other designated systems by
  defeating on-going or imminent malicious cyberspace activity (JP 3-12). Most defensive cyberspace
  operations tasks at corps and below focus on enabling friendly command and control and fires while
  protecting the DODIN. Adversaries and enemies continuously seek to gain an advantage by penetrating
  friendly networks to disrupt operations. Army units conduct defensive cyberspace operations to prevent,
  detect, identify, and respond to anomalous or unauthorized activity, intrusions, or attacks against the DODIN
  and other networks when authorized.
  Defensive Cyberspace Operations-Internal Defensive Measures
  2-97. Defensive cyberspace operations-internal defensive measures are operations in which authorized
  defense actions occur within the defended portion of cyberspace (JP 3-12). Most defensive cyberspace
  operations missions are defensive cyberspace operations-internal defensive measures, which include pro-
  active and aggressive internal threat hunting for advanced and/or persistent threats, as well as the active
  internal countermeasures and responses used to eliminate these threats and mitigate their effects (JP 3-12).
  Defensive cyberspace operations-internal defensive measures are responses to unauthorized activity, alerts,
  or threat information within the defended network. Defensive cyberspace operations-internal defensive
  measures leverage intelligence, counterintelligence, law enforcement, and other military capabilities, as
  required.
  2-98. For compromised DODIN elements, specific tactics include rerouting, reconstitution, restoration, or
  isolation. To defend cyberspace, signal personnel work to detect, analyze, and respond to unauthorized
  activities not mitigated by cybersecurity measures. United States Army Cyber Command (ARCYBER) is the
  Army lead for defensive cyberspace operations-internal defensive measures. Cyberspace defenders and
  DODIN operations personnel apply mitigation measures recommended by cyber protection teams.
  Defensive Cyberspace Operations-Response Actions
  2-99. Defensive cyberspace operations-response actions are operations that are part of a defensive
  cyberspace operations mission that are taken external to the defended network or portion of cyberspace
  without the permission of the owner of the affected system (JP 3-12). Because the actions occur outside the
  DOD network, defensive cyberspace operations-response actions are subject to legal constraints and
  restraints. Defensive cyberspace operations-response actions require authorization according to standing and
  supplemental rules of engagement. To support response actions, signal personnel help identify key terrain in
  cyberspace during CEMA. Security logs collected as part of DODIN operations help identify threat actions
  and feed planning for defensive cyberspace operations-response actions. Signal Soldiers and units provide
  the network (the DODIN-A) used for defensive cyberspace operations-response actions planning and
  targeting requests.
  Support to Offensive Cyberspace Operations
  2-100. Offensive cyberspace operations are cyberspace operations intended to project power by the
  application of force in or through cyberspace (JP 3-12). Army units plan, synchronize and integrate offensive
  cyberspace operations to create effects supporting commanders’ objectives. Signal Soldiers and units provide
  the network (the DODIN-A) used for offensive cyberspace operations targeting requests.