A report released by the Government Accountability Office (GAO) published earlier this week said that the Pentagon does “not clearly define its roles and responsibilities for cyber incidents.”


We often find this in most companies.  It is not clear who can authorize response actions and ultimately who calls the shots.

With the Pentagon, the problem stems from two sets of conflicting rules set out by two military divisions, and how they assist civil efforts to recover from a cyberattack. The US Northern Command says it would be the support civil command during an attack, whereas the US Central Command says it would be responsible. The report concludes that “The gap, and the uncertainty that results, could hinder the timeliness or effectiveness of critical Defense Dept. support to civil authorities during cyber-related emergencies.”


What do your plans say? Who can cut the Internet? Core network? Who manages the response and deals with the strategic issue.

Check out our book on Cyber Breach exercises available on Amazon.