Cybercom’s defensive arm elevated to sub-unified command

U.S. Cyber Command’s network defense arm has officially been designated as a sub-unified command.

Congress directed Joint Force Headquarters-Department of Defense Information Network (JFHQ-DODIN) to elevate to a sub-unified command under Cybercom in the fiscal 2025 annual defense policy bill.

JFHQ-DODIN was created in 2015 as a subordinate headquarters under Cyber Command to protect and defend the Pentagon’s network globally. It’s led by a three-star general who also serves in a “dual-hat” role as the director of the Defense Information Systems Agency, a much bigger combat support agency providing critical IT services to warfighters.

Secretary of Defense Pete Hegseth directed that JFHQ-DODIN be designated a sub-unified command, effective immediately May 28, and its name has been changed to Department of Defense Cyber Defense Command (DCDC).

The name change was a recognition of the command’s ability to execute authority, direction and control over cyberspace forces, according to Steve Mavica, a spokesman for DCDC.

“This action aligns with the 2025 Interim National Defense Strategic Guidance to prioritize the command’s secure, operate, and defend the DODIN mission and enable U.S. Military Forces to deliver lethal effects when and where most needed. The elevation of DCDC to a subordinate unified command is a recognition of the vital importance of our mission to lead unified action in the security, operations, and defense of the DODIN, one of DOD’s most critical strategic assets,” Mavica said. “It is about increasing readiness and resiliency of the DODIN and those forces who conduct network operations, security, and defense activities in the face of the rapid pace of technological advances and the increasing abilities of cyber adversaries.”

The elevation follows Cybercom’s decision in December 2022 to elevate the Cyber National Mission Force — comprised of DOD’s most talented cyber operators aligned in task forces organized against specific threat actors, with the core mission of defending the nation against digital threats — to a sub-unified command. Congress wanted to put the defensive unit on the same playing field as the offensive entity.

The move doesn’t necessarily provide additional authorities or funding streams, but does offer opportunities to pursue certain resources, processes and authorities as needed for more effective approaches to protect the DODIN. Officials are working to deliver an assessment of requirements for the newly minted DCDC to be mission effective and combat ready as well as a plan for implementation, according to an official, who was not authorized to speak publicly.

DCDC’s commander, Lt. Gen. Paul Stanton, who took charge last fall, has tried to put the organization on more of a proactive footing to defend networks and respond to adversary activity. Having been exhausted by the whack-a-mole approach, with adversary intrusions continuing, he wants to impose costs.

“If it’s easy for the enemy to gain access into our environment and to achieve effects, shame on us,” he told reporters in January. “If we prioritize and make it really hard for the enemies to gain access to the things that they’re interested in, that we are also interested in, we start to make it hard on the enemy. While that’s an indirect imposition of cost, if they have to spend months, years, or even decide that that objective is not worth their time or energy because they’re simply not going to gain access to it, then we start shifting that cost curve.”

The command can also work to impose costs offensively, transitioning from defense by feeding information to the CNMF for action.

The organization is looking to “take the observations from our defense, where we gain and maintain contact with our enemies, and hand those insights to the appropriate forces that can conduct offensive missions,” he added.