Block 1 IQT CSF

Operational chain of command

President → Secretary of Defense → Combatant Commander. The Chairman of the Joint Chiefs of Staff advises but is not in this chain.

Air Force cyber execution flow

United States Cyber Command priorities → Air Forces Cyber / Sixteenth Air Force → 616th Operations Center → coordination nodes → tactical units and crews.

President

National level; Commander-in-Chief who sets national direction and priorities.

Secretary of Defense (SECDEF)

Department of Defense level; directs the Department and passes operational direction to Combatant Commanders.

Office of the Secretary of Defense (OSD)

Department of Defense policy level; develops strategy, policy, programs, oversight, and guidance.

Chairman of the Joint Chiefs of Staff (CJCS)

Joint advisory level; principal military advisor who integrates plans but does not command through the operational chain.

Service Chiefs

Service administrative level; organize, train, equip, administer, and support their forces.

United States Cyber Command (USCYBERCOM)

Functional Combatant Command; sets global cyber priorities and directs assigned cyber forces.

Joint Forces Headquarters-Cyber (JFHQ-C)

Joint operational level; integrates cyber planning for an aligned Combatant Command and controls assigned tactical cyber forces.

Department of Defense Cyber Defense Command (DCDC)

United States Cyber Command enterprise-defense command; directs and synchronizes Department of Defense network operations and internal defensive measures.

Defense Information Systems Agency (DISA)

Department of Defense combat support agency; provides and secures enterprise information technology (IT) infrastructure.

Air Forces Cyber / Sixteenth Air Force (AFCYBER / 16 AF)

Air Force service cyber component to United States Cyber Command; integrates Air Force cyber and information-warfare capabilities.

616th Operations Center (616 OC)

Air Forces Cyber operational headquarters; converts higher priorities into executable Air Force plans, orders, and assessments.

Air Force Information Network Mission Assurance Center (AMAC)

Air Force enterprise coordination node; maintains 24/7 network awareness, tactical command and control (C2), and deconfliction.

Major Command Communications and Coordination Center (MCCC)

Major Command (MAJCOM) level; links the command to its bases and tracks mission impacts and task execution.

67th Cyberspace Wing (67 CW)

Air Forces Cyber execution wing; conducts global cyber operations, training, capability development, testing, and range support.

688th Cyberspace Wing (688 CW)

Air Forces Cyber wing for Defensive Cyberspace Operations (DCO), network operations, deployable communications, and engineering.

960th Cyber Wing (960 CW)

Air Force Reserve Command (AFRC) cyber wing; provides Reserve associate forces aligned with active-duty cyber units.

299th Network Operations Squadron (299 NOS)

Air National Guard (ANG) tactical network squadron; supports Guard units nationwide and in four United States territories.

26th Cyberspace Operations Group (26 COG)

Group under the 688th Cyberspace Wing; operates, manages, and secures the Air Force Information Network.

690th Cyberspace Operations Group (690 COG)

Group under the 688th Cyberspace Wing; conducts persistent and expeditionary network operations.

Department of Defense Information Network (DoDIN)

The Department's interconnected information capabilities, networks, services, data, and security processes.

Air Force Information Network (AFIN)

Air Force information capabilities and processes used to collect, process, store, protect, and manage information.

Air Force Network (AFNET)

Air Force enterprise network on which tactical crews conduct daily network operations.

Directive Authority for Cyberspace Operations (DACO)

United States Cyber Command authority across Department of Defense components for global network operations and internal defense; it does not make them assigned forces.

Combatant Command (COCOM)

Full, nontransferable command authority held by a Combatant Commander over assigned forces.

Operational Control (OPCON)

Delegable mission authority to organize and employ forces and assign tasks and objectives; excludes administration and discipline.

Tactical Control (TACON)

Narrow authority over detailed tactical movement, maneuver, and application of force for an assigned task.

Administrative Control (ADCON)

Service authority over personnel, resources, logistics, training, readiness, and discipline.

Support relationship

One force aids, protects, complements, or sustains another without transferring Operational Control or Tactical Control.

General Support

Supports the supported force as a whole.

Mutual Support

Two forces support each other toward the same objective.

Direct Support

Supports one named force and answers directly to that force's requests.

Close Support

Support close enough to require detailed coordination and integration.

Department of Defense Information Network Operations (DoDIN Operations)

Standing, threat-agnostic work that secures, configures, operates, and sustains the network.

Defensive Cyberspace Operations-Internal Defensive Measures (DCO-IDM)

Threat-specific defense conducted inside the defended network.

Defensive Cyberspace Operations-Response Actions (DCO-RA)

Threat-specific defensive action outside the defended network to stop an attack against it.

Offensive Cyberspace Operations (OCO)

Projects power through cyberspace to create effects for national or Combatant Commander objectives.

Blue cyberspace

Friendly or defended cyberspace.

Gray cyberspace

Cyberspace not controlled by friendly forces or a known adversary.

Red cyberspace

Cyberspace owned or controlled by an adversary.

Physical network layer

Hardware and geography: devices, cables, servers, facilities, and physical access.

Logical network layer

Code and connections: software, protocols, addresses, domains, configurations, and data flow.

Cyber-persona layer

Digital identities and behavior: accounts, profiles, online activity, and attribution.

Operation Order (OPORD)

Complete five-paragraph order for executing a specific operation.

Tasking Order (TASKORD)

Short-lived or one-time order assigning forces, capabilities, targets, or missions.

Fragmentary Order (FRAGO)

Abbreviated change to an existing Operation Order or Tasking Order.

Air Force Cyber Tasking Order (AF CTO)

Directs a specific Air Force cyber action during a defined time window.

Air Force Cyberspace Control Order (AF CCO)

Directs the building or shaping of cyberspace terrain before employment.

Air Force Maintenance Tasking Order (AF MTO)

Directs routine, medium-to-low-risk maintenance not tied to one mission objective.

Air Force Time Compliance Network Order (AF TCNO)

Directs immediate network patching or mitigation of an exploitable vulnerability.

Air Force Time Compliance Technical Order (AF TCTO)

Program Office technical fix for a Technical Order (TO)-controlled weapon system.

Command, Control, Communications, and Computers Notice to Airmen (C4 NOTAM)

Information-only network notice; directs no action and tracks no compliance.

Air Force Special Instructions (AF SPINS)

Adds planning, execution, and assessment details to Air Force Cyber Tasking Orders and Cyberspace Control Orders.

Cyber Protection Condition (CPCON)

Required defensive readiness posture issued by the 616th Operations Center.

Rules of Engagement (ROE)

Rules that define when and how military cyber actions may be conducted.

A1 — Manpower and Personnel

Staff directorate for manpower, personnel policy, and family support.

A2 — Intelligence, Surveillance, and Reconnaissance (ISR)

Staff directorate for intelligence policy, capabilities, planning, programming, and budgeting.

A3 — Air, Space, and Information Operations

Staff directorate for operations policy, force management, weather, training, and readiness.

A4 — Logistics, Engineering, and Force Protection

Staff directorate for logistics, engineering, and force-protection policy and resources.

A5 — Plans and Requirements

Staff directorate for force movement, bed-down, redeployment, plans, and operational requirements.

A6 — Communications

Staff directorate for communications systems and infrastructure.

National Threat Operations Center (NTOC)

Supporting organization for real-time cryptologic analysis, signals intelligence (SIGINT), and cyber-threat response.

Air Force Lifecycle Management Center (AFLCMC)

Supporting organization that manages weapon systems from development through upgrades, sustainment, and retirement.

Cyberspace Capabilities Center (CCC)

Supporting organization that closes enterprise cyber gaps and synchronizes communications and information-technology requirements.

National Air and Space Intelligence Center (NASIC)

Supporting intelligence center that characterizes air, space, missile, and cyber threats.

Air Force Office of Special Investigations (AFOSI)

Supporting investigative agency for criminal, terrorist, and espionage threats.

Program Management Office (PMO)

External system owner that develops and fields a unique system; technical access does not replace its authorization.

Cyber Mission Force (CMF)

Forces assigned to United States Cyber Command, including protection, national-mission, and combat-mission forces.

United States Cyber Command and subordinate command elements

Command staffs and units that plan, control, integrate, and support the Cyber Mission Force.

Service, Department of Defense agency, and field-activity cyber forces

Cyber forces not assigned to United States Cyber Command that support Service or agency functions.

Cyberspace assessment teams

Red, blue, and purple teams that conduct cooperative or adversarial risk assessments.

Cyberspace supporting-actions elements

Acquisition, information technology, logistics, and other elements that enable cyber operations.

Combatant Command (CCMD) cyberspace-operations elements

Combatant Command cyber units that plan and integrate operations within their command.

Department of Defense intelligence cyber forces

Intelligence units whose primary mission enables or uses cyber operations.

Commander, United States Special Operations Command-assigned forces (CDRUSSOCOM-assigned forces)

Special Operations cyber forces trained for offensive, defensive, and network operations.

Cyber Protection Force (CPF)

Cyber Mission Force element for proactive internal Department of Defense network defense.

Cyber National Mission Force (CNMF)

Cyber Mission Force element for major cyber threats to the Department of Defense and the Nation.

Cyber Combat Mission Force (CCMF)

Cyber Mission Force element that directly supports Combatant Commander missions.

Large Force Employment (LFE)

Uses multiple cyber forces together in the same area and vulnerability window when they can support one another.

Force package

Group of cyber missions and forces organized for mutual support.

Resolve mission set

Builds, operates, or extends accepted cyberspace terrain.

Identify mission set

Scans, queries, compiles, and analyzes information to understand risk.

Protect mission set

Implements, configures, and remediates controls to reduce risk.

Detect mission set

Monitors and hunts to discover and characterize activity.

Respond mission set

Triages and immediately mitigates or disrupts an active threat.

Recover mission set

Restores systems, data, and mission capability after an incident.

Continuous Validation and Assessment (CV&A) mission set

Replicates enemy tactics, techniques, and procedures (TTPs) to assess and validate defenses.

Air Force Cyberspace Defense (ACD)

Weapon system for intrusion prevention, detection, response, incident handling, and forensics.

Air Force Intranet Control (AFINC)

Enterprise-boundary weapon system for centralized traffic control, blocking, whitelisting, and network awareness.

Cyber Command and Control Mission System (C3MS)

Operational command-and-control weapon system for awareness, order tracking, synchronization, and deconfliction.

Cyberspace Defense Analysis (CDA)

Weapon system that finds operations-security (OPSEC) disclosures, data leakage, and insider threats.

Cyberspace Security and Control System (CSCS)

Tactical weapon system for daily network operations across endpoints, identities, devices, storage, and vulnerabilities.

Cyberspace Vulnerability Assessment/Hunter (CVA/H)

Weapon system for assessments, penetration testing, compliance checks, and threat hunting.

Air Force Intranet Control Crew Commander / Battle Captain

Commands the crew, allocates resources, enforces policy, and makes final decisions.

Air Force Intranet Control Operations Controller

Directs defensive actions and deconflicts multiple tactical operations.

Air Force Intranet Control Event Controller

Coordinates network operations, incidents, releases, patching, and service stability.

Air Force Intranet Control Boundary Protection Team

Manages firewalls and traffic at the Air Force network boundary.

Air Force Intranet Control Domain Name System (DNS) and Email Operators

Defend Air Force Domain Name System and email gateways from malicious domains, phishing, and email threats.

Air Force Intranet Control Router Team

Manages routing paths, Service Delivery Points (SDPs), routers, and common-user virtual private networks (VPNs).