This issue of our Information Series is an updated version of an original paper published by in June 2019. It reflects maturity within the mission area and is designed to clarify key foundational elements created and used by JFHQ-DODIN’s commander to organize the battlespace and to exercise command and control over a unified force to secure, operate and defend the DoDIN.
“The Department of Defense Information Network (DoDIN) comprises all of DoD cyberspace….” For those charged to secure, operate, and defend any part of the DoDIN, this simple opening line found in Joint Publication 3-12 Cyberspace Operations, represents the vast battlespace in which JFHQ-DODIN has established operational norms and has driven countless operations, activities, and actions to more effectively manage cyber risk to one of the Department’s most critical operational assets. Foundational concepts to the larger DoDIN Command Operational Framework (DCOF) include DoDIN areas of operations (DAOs) and DoDIN sectors. Understanding these two concepts are essential to understanding the larger DCOF framework used to organize the DoDIN battlespace.
DoD's Cyber Terrain – the DoDIN & Boundaries
The cyberspace domain and the DoDIN are man-made. He who develops the architecture of the DoDIN defines the terrain itself. It also dictates many other operational factors such as how operationally effective it is, how defendable it is, span of control, flow of authorities, and many other factors. Cyber terrain refers to the hardware, software, and data that compose DoD systems and networks. It is defined as having three layers: a physical layer consisting of geographic and physical components; a logical layer involving data in motion and at rest and how elements relate to one another; and a cyber-persona layer representing individual and organizational entities.
In cyberspace, boundaries consist of the physical components (assets and infrastructure) found in the physical layer. Boundaries are drawn in military operations to facilitate coordination between adjacent units, formations, or areas. While they are not quite as obvious as a river or a mountain range, the physical components of cyber terrain such as a servers or routers are the easiest of the three layers to identify and thus, coordinate actions.
DoDIN Areas of Operations (DAOs)
Consistent with commanders in all other operational domains, when JFHQ-DODIN stood up in 2015 as a battlespace owner, its commander had to organize the assigned battlespace in terms of forces and terrain. This included the norm of the commander assigning one hundred percent of the terrain that they are responsible for to a direct subordinate battlespace owner. That subordinate commander repeats this process with their subordinate battlespace owners. This process is repeated by echelons until command authority is established that accounts for the totality of the battlespace. The DAOs make up the echelon of battlespace owners that JFHQ-DODIN directs.
Currently, 45 DAOs make up DoD’s cyber battlefield but because you must follow the architecture of the DoDIN to organize the terrain, DAO boundaries in most cases do not follow along organizational lines created for the DoD Component’s core mission. Just as Directive Authority for Cyberspace Operations (DACO) is agnostic to the DoD Component’s core mission, organizing the battlespace is agnostic to the organizational design of the DoD Component core mission because the architecture does not follow this design. For example, a four-star command has multiple direct subordinates for their core mission that are stationed globally. In virtually all cases, those remote subordinates will not be in the four star’s DAO. Even if one of these subordinate commands in on the same installation, it may or may not be in that 4-star DAO. It is all determined by the architecture or terrain. Networks are hierarchical in nature. To use an analogy, you start with the oceans, then follow the rivers, then the streams, and finally down to the creeks – determining who is “best postured” along the way.
DoDIN Sectors
For the DoDIN to provide and enable the capabilities that give the United States an operational advantage over an adversary, it requires many DAOs to do so. Capabilities come through connectivity to various mission critical systems and data, communications assets, access to combat information, intelligence, and software to enhance leadership decision-making. A mission-based or functional sector encompasses all the DAOs that enable and provide the critical capabilities required to accomplish the mission and operate effectively.
All DoD components have direct authority over a portion of the DoDIN that their mission is dependent upon, but none have authority over the totality of the DoDIN that their mission is dependent upon. The totality of DoDIN terrain that each DoD Components mission is dependent upon, is their DoDIN sector. The portion or sub-set of their sector that they are “best postured” to secure, operate and defend, is that DoD Component’s DAO. The purpose for defining a DoDIN sector, is to enable JFHQ-DODIN to operate as a supporting command by managing cyber risk to all DoD Component’s or DoDIN sector’s missions.
While sectors are not static (they can change with the mission or the activity), a predictable composite of DAOs develops over time. Again, all dictated by the architecture of the DoDIN, multiple DAOs support each DoDIN sector and the proportion that each DoD Components DAO is to their sector varies significantly. As an example:
Geographic Combatant Command DAOs represent approximately ten percent of their sector and their sector is supported by numerous other DAOs. This includes Four Service Cyber Component DAOs, Eight Combat Support Agency DAOs, two to three other Defense Agencies that are not Combat Support Agencies (MDA, NRO, others), four Functional Combatant Commands DAOs, and the Space Command DAO.
Each Service Cyber Component, Combat Support Agency, Functional Combatant Command, and the Space Command DAO simultaneously support their own sector and all Combatant Command sectors.
Bringing It All Together
Cyberspace was declared an operational domain for the primary purpose of improving DoD’s ability to manage cyber risk to all DoD missions. This declaration triggered a series of events that included the creation of the Secure, Operation and Defend the DoDIN Mission Area assigned to the commander of JFHQ-DODIN, and the requirement to organize the assigned battlespace in terms of forces and terrain. Organizing this battlespace needed to be built on foundational concepts.
These foundational concepts had to differentiate between those who are best postured to be empowered, enabled, and held accountable to secure, operate and defend that specific portion of the DoDIN from those whose mission assurance was dependent upon select DoDIN terrain that was not completely under their direct authority. The concept of a DAO was established as the subordinate battlespace owners and the DoDIN sector was established to enable the ability to manage cyber risk to all DoD Components missions.
Establishing these foundational concepts enabled the establishment of the overall organizing concept – DoDIN Command Operational Framework (DCOF). The DCOF enables JFHQ-DODIN to simultaneously and continuously operate as a supported command for global or trans-regional operations and as a supporting command to all DoD Components to manage cyber risk to their missions or their DoDIN sector. In both roles, JFHQ-DODIN synchronizes, coordinates, and directs DAOs.