text: Cyberspace Operations and Electromagnetic Warfare Fundamentals
  friendly cyberspace. DCO-IDM involves actions to locate and eliminate cyber threats within friendly
  networks. Cyberspace forces employ defensive measures to neutralize and eliminate threats, allowing
  reestablishment of degraded, compromised, or threatened portions of the DODIN. Cyberspace forces
  conducting DCO-IDM primarily conduct cyberspace defense tasks, but may also perform some tasks similar
  to cyberspace security.
  2-11. Cyberspace defense includes actions taken within protected cyberspace to defeat specific threats that
  have breached or are threatening to breach cyberspace security measures and include actions to detect,
  characterize, counter, and mitigate threats, including malware or the unauthorized activities of users, and to
  restore the system to a secure configuration. (JP 3-12). Cyberspace forces act on cues from cybersecurity or
  intelligence alerts of adversary activity within friendly networks. Cyberspace defense tasks during DCO-
  IDM include hunting for threats on friendly networks, deploying advanced countermeasures, and responding
  to eliminate these threats and mitigate their effects.
  DEFENSIVE CYBERSPACE OPERATIONS-RESPONSE ACTIONS
  2-12. Defensive cyberspace operation-response actions are operations that are part of a defensive cyberspace
  operations mission that are taken external to the defended network or portion of cyberspace without
  permission of the owner of the affected system (JP 3-12). DCO-RA take place outside the boundary of the
  DODIN. Some DCO-RA may include actions that rise to the level of use of force and may include physical
  damage or destruction of enemy systems. DCO-RA consist of conducting cyberspace attacks and cyberspace
  exploitation similar to OCO. However, DCO-RA use these actions for defensive purposes only, unlike OCO
  that is used to project power in and through cyberspace.
  2-13. Decisions to conduct DCO-RA depend heavily on the broader strategic and operational contexts such
  as the existence or imminence of open hostilities, the degree of certainty in attribution of the threat; the
  damage the threat has or is expected to cause, and national policy considerations. DCO-RA are conducted by
  national mission team(s) and require a properly coordinated military order, coordination with interagency
  and unified action partners, and careful consideration of scope, rules of engagement, and operational
  objectives.
  OFFENSIVE CYBERSPACE OPERATIONS
  2-14. Offensive cyberspace operations are missions intended to project power in and through cyberspace (JP
  3-12). Cyberspace forces conduct OCO outside of DOD networks to achieve positions of relative advantage
  through cyberspace exploitation and cyberspace attack actions in support of commanders’ objectives.
  Commanders must integrate OCO within the combined arms scheme of maneuver throughout the operations
  process to achieve optimal effects.
  2-15. The Army provides cyberspace forces trained to perform OCO across the range of military operations
  to the joint force. Army forces conducting OCO do so under the authority of a joint force commander. Refer
  to Appendix C for information on integrating with unified action partners. Joint forces may provide OCO
  support to corps and below Army commanders in response to requests through the joint targeting process.
  Refer to Appendix D for more information on joint cyberspace forces. Targets for cyberspace effects may
  require extended planning time, extended approval time, as well as synchronization and deconfliction with
  partners external to the DOD. Chapter 4 covers targeting considerations in detail.
  CYBERSPACE ACTIONS
  2-16. Execution of these cyberspace operations entails one or more specific tasks, which joint cyberspace
  doctrine refers to as cyberspace actions (refer to JP 3-12), and the employment of one or more cyberspace
  capabilities. Figure 2-2 on page 2-6 depicts the relationships between the types of cyberspace operations and
  their associated actions, the location of those operations in cyberspace, and the forces that conduct those
  operations. The four cyberspace actions are—
  * Cyberspace security (refer to FM 6-02 and ATP 6-02.71).
  * Cyberspace defense.
  * Cyberspace exploitation.