The Internet enables global connectivity, communication, and innovation. It has brought increased prosperity to the United States, inaugurating new industries and revitalizing old ones. It has also helped to ensure the superiority of the Joint Force, strengthening our ability to coordinate and quickly adapt to dynamic circumstances. In this decisive decade, the success of our Nation depends upon a free, open, and secure cyberspace.
The United States is challenged by malicious cyber actors who seek to exploit our technological vulnerabilities and undermine our military’s competitive edge. They target our critical infrastructure and endanger the American people. Defending against and defeating these cyber threats is a Department of Defense (DoD) imperative.
The classified 2023 Department of Defense Cyber Strategy establishes how the Department will operate in and through cyberspace to protect the American people and advance the defense priorities of the United States. It implements the priorities of the 2022 National Security Strategy, 2022 National Defense Strategy (NDS), and 2023 National Cybersecurity Strategy. It builds upon and supersedes the 2018 DoD Cyber Strategy. This unclassified summary is intended to present the overarching priorities of the 2023 DoD Cyber Strategy and should not be considered exhaustive. The scope of this document is limited to the cyber domain; it does not establish policy for the Department’s operations in the information environment.
The 2023 DoD Cyber Strategy is grounded in real-world experience. Since 2018, the Department has
conducted a significant number of cyberspace operations through its policy of defending forward, actively disrupting malicious cyber activity before it can affect the U.S. Homeland. This strategy is further informed by Russia’s 2022 war on Ukraine, which has seen a significant use of cyber capabilities during armed conflict. In this saturated cyber battlefield, military operations conducted by states and non-state proxies have collided with the cyber defense efforts of numerous private sector actors. The conflict has demonstrated the character of war in the cyber domain. Its lessons will shape the maturation of our cyber capabilities.
The Department’s experiences have shown that cyber capabilities held in reserve or employed in isolation render little deterrent effect on their own. Instead, these military capabilities are most effective when used in concert with other instruments of national power, creating a deterrent greater than the sum of its parts. In this way, cyberspace operations represent an indispensable element of U.S. and Allied military strength and form a core component of integrated deterrence.
The Department will also use cyberspace operations for the purpose of campaigning, undertaking actions to limit, frustrate, or disrupt adversaries’ activities below the level of armed conflict and to achieve favorable security conditions. By persistently engaging malicious cyber actors and other malign threats to U.S. interests in cyberspace, U.S. Cyber Command (USCYBERCOM) will support Department-wide campaigns to strengthen deterrence and gain advantages. As it campaigns in cyberspace, the Department will remain closely attuned to adversary perceptions and will manage the risk of unintended escalation.
Our global Allies and partners are foundational to the 2023 DoD Cyber Strategy. The United States’ diplomatic and defense relationships represent a force multiplier that extends into cyberspace, enabling rapid coordination and awareness of emerging threats. To this end, we will improve our effectiveness and security in cyberspace by fostering a community of cyber-capable nations with shared interests and values. By combining international engagement with significant institutional reforms and technological investments in emerging cyber capabilities, the Department will build enduring advantages in cyberspace.
As the Department’s cyber capabilities evolve, so do those of our adversaries. Both the People’s Republic of China (PRC) and Russia have embraced malicious cyber activity as a means to counter U.S. conventional military power and degrade the combat capability of the Joint Force. The PRC in particular sees superiority in cyberspace as core to its theories of victory and represents the Department’s pacing challenge in cyberspace. Using cyber means, the PRC has engaged in prolonged campaigns of espionage, theft, and compromise against key defense networks and broader U.S. critical infrastructure, especially the Defense Industrial Base (DIB). Globally, malicious cyber activity continues to grow in both volume and severity, impacting the U.S. Homeland and placing Americans at risk.
