DoD sends new cyber strategy, informed by Russian invasion, to Congress

WASHINGTON — The Pentagon has sent its new classified cyber strategy, which has been informed by lessons learned from Russia’s invasion of Ukraine and supersedes the department’s 2018 iteration, to Congress. 

An unclassified summary of the strategy will be released in the coming months, according to DoD. However, a public DoD fact sheet [PDF] about the strategy sheds some light on what might be inside. 

“The 2023 DoD Cyber Strategy is grounded in real-world experience,” according to the fact sheet. “Since 2018, the Department has conducted a number of significant cyberspace operations through its policy of defending forward, actively disrupting malicious cyber activity before it can affect the U.S. Homeland. This strategy is further informed by Russia’s 2022 invasion of Ukraine, which has demonstrated how cyber capabilities may be used in large-scale conventional conflict.”

Many of the themes presented in the strategy are familiar to what officials have talked about in the past when it comes to the department’s cyberspace operations — maximizing “cyber capabilities in support of integrated deterrence,” countering adversaries and partnering with allies and partners to defend the cyber domain.

The Pentagon plans to address current and emerging cyber threats through four lines of effort outlined in the fact sheet: defending the nation, preparing to fight and win wars, protecting the cyber domain with allies and partners and optimizing training and equipping of its cyber forces.

The new cyber strategy will “directly align” with the White House’s National Cyber Strategy that was released earlier this year, DoD Chief Information Officer John Sherman told Breaking Defense in March. 

“The National Cyber Strategy challenges us to set the agenda on our terms to outpace our adversaries,” Sherman said then. “This vision directly aligns with the Department’s cloud and software modernization efforts which aim to drive a resilient, zero-trust based cyber foundation in the cloud. Now is the time to drive the dramatic change necessary to make cyber threats far more difficult and far more costly for our adversaries.”

Both the DoD and White House strategies emphasize defending the cyber domain from threats posed by foreign adversaries like China, Russia and Iran and transnational criminal organizations.

Meanwhile, DoD awaits a nominee for a new role — assistant secretary of defense for cyber policy — that would supervise all cyber policy and serve as the principal cyber advisor to the secretary of defense. The official would spearhead implementing DoD’s new cyber strategy.

The new position, which was created in the fiscal 2023 version of the National Defense Authorization Act, will essentially do half of the job currently owned by John Plumb, principal cyber advisor to the secretary of defense and assistant secretary of defense for space policy.

A nominee isn’t expected until September at the earliest following a study to examine what exactly the position would entail.