AF Defensive Cyberspace Operations

Mission — Cyberspace Vulnerability Assessment source

Beginning in FY25, continuation of this work is described in Budget Program Activity Code (BPAC) 677824. Funding in this BPAC contributes to the development of software and related activities in support of the creation of the Integrated Defensive Cyberspace System (IDCS). The Cyberspace Vulnerability Assessment/Hunter (CVA/H) weapon system provides Air Forces Cyber (AFCYBER) and Combatant Commanders additional mobile precision in addition to currently fielded protection capabilities to identify, pursue, and mitigate cyberspace threats. The CVA/H weapon system performs defensive sorties world-wide via remote or on-site access. CVA/H executes Hunter missions on Air Force (AF) and Department of Defense (DoD) networks and systems. Hunter operations characterize and then eliminate threats for the purpose of mission assurance. The Hunter mission focuses on the capability to find, fix, track, target, engage, and assess (F2T2EA) the advanced persistent threat (APT). This effort funds development efforts to enhance command and control situational awareness and to expand the capability of the current weapon system to meet scope and scale of the USCYBERCOM directed Cyber Protection Teams (CPTs) and AF Mission Defense Teams (MDTs). Activity in this BPAC also supports development of enhancements to legacy AF Defensive Cyberspace Operations (DCO) weapon systems, as needed, to support current operations and facilitate the transition of legacy capabilities to the IDCS described more fully in BPAC 677824. This program element may include necessary civilian pay expenses required to manage, execute, and deliver weapon system capability. The use of such program funds would be in addition to the civilian pay expenses budgeted in program element 0605827F, 0605828F, 0605829F, 0605831F, 0605832F, 0605833F, 0605898F, 0606398F. In FY24 0.000M was expended for civilian pay expenses in this BPAC, and in FY25 0.000M is forecasted for civilian pay expenses in this BPAC.

Mission — AF Defensive Cyberspace Operations source

Air Force Defensive Cyberspace Operations (AF DCO) allows the Department of the AF (DAF) to keep pace with the ever-evolving cyberspace threats. AF DCO develops capabilities that provide the DAF increased assurance in prosecuting air campaigns through enhanced cyber defense and situational awareness over the systems and assets required to enable the movement of forces. AF DCO is building an integrated architecture that extends cyber defense to, and integrates data from, information systems, mission systems, and control systems relevant to air campaigns. The Integrated Defensive Cyberspace System (IDCS) will unify the missions of network defense and cyber protection teams, allowing them to conduct cyber missions from the same system with shared, mission-relevant data. IDCS safeguards AF Information Network (AFIN) and Department of Defense (DoD) network enclaves including their associated computer systems, software applications and sensitive operational information against unauthorized access, intrusion, data exfiltration, corruption, and/or destruction. Legacy system modernization activities have been combined into IDCS (BPAC 677824). The Firestarter effort will continue to be funded in BPAC 677820. Firestarter capabilities will be incrementally integrated to be compatible with and operate within the IDCS. IDCS continually improves its capabilities through modern software delivery practices: continuous research and development (R&D), testing, fielding, and modification based on operational feedback. IDCS is operated by the DAF Total Force, including Active Duty (AD), Air National Guard (ANG), and AF Reserve Command (AFRC) Airmen. IDCS enables rapid deployment of defensive cyber sensor capabilities while disrupting bad actors from exploiting critical vulnerabilities by developing and employing both automated decision making (ADM) and human/machine teaming (HMT) with trained defensive cyber operators. IDCS supports both enterprise (fixed) and edge/mobile use cases and allows the DAF to execute the Cyberspace Vulnerability Assessment/Hunter (CVA/H), AF Cyber Defense (ACD), and Cyber Defense Analysis (CDA) missions. IDCS addresses a critical capability gap identified by the Secretary of the AF - the lack of a synchronized, enterprise-level approach to mitigate cyberspace vulnerabilities related to mission performance and/or mission assurance. Failing to address this gap will hinder the DAF ability to project Air Power and dominate in a fight against near-peer adversaries. IDCS integrates with, and makes its data available to, the DAF Data Fabric, Joint Cyberspace Warfighting Architecture (JCWA), and the Advanced Battle Management System (ABMS). IDCS provides increased visibility into health and readiness of cyberspace systems for both local and enterprise commanders. Activities also include various Advisory and Assistance Services (A&AS) and Program Management Administration (PMA) activities to support the aforementioned development efforts. This program element may include necessary civilian pay expenses required to manage, execute, and deliver weapon system capability. The use of such program funds would be in addition to the civilian pay expenses budgeted in program element 0605827F, 0605828F, 0605829F, 0605831F, 0605832F, 0605833F, 0605898F, 0606398F. In FY24 0.953M was expended for civilian pay expenses in this program element, and in FY25 3.237M is forecasted for civilian pay expenses in this program element. In FY25, PE 0208088F, AF Defensive Cyberspace Operations, Project 677821, Cyberspace Vulnerability Assessment, Project 677822, Cyber Defense Analysis, and Project 677823, AFCERT efforts were transferred to PE 0208088F, AF Defensive Cyberspace Operations, Project 677824, Integrated Defensive Cyber System, in order to distinguish IDCS from previous efforts. The FY 2026 request was reduced by $.998 million for Advisory and Assistance Services to promote efficiencies and advance the policies of the Administration in alignment with Executive Order 14222, "Implementing the President's Department of Government Efficiency Cost Efficiency Initiative.” This program is in Budget Activity 7, Operational System Development because this budget activity includes development efforts to upgrade systems that have been fielded or have received approval for full rate production and anticipate production funding in the current or subsequent fiscal year.

Mission — Computer Security RDTE: Firestarter source

The Firestarter program provides newly improved capabilities and technical transition opportunities for Cyber Defense and Information Assurance (IA) technologies and tools needed to defend Air Force (AF) Command, Control, Communications, Computer, and Intelligence (C4I) systems from cyber attacks, while ensuring recovery in the event of an attack. The emphasis of the program is directed toward defensive cyberspace capabilities; computer and network systems security; damage assessment and recovery; cyber threat recognition, attribution, and mitigation; and active response methodologies in response to evolving threats and changes to cyber environment. These areas of emphasis are realized through research and development, test and acquisition in the areas of proactive defense, defensive counter cyberspace, cyberspace intelligence, surveillance and reconnaissance & situational awareness, persistent network operations, as well as decision support, recovery, and digital forensics. Current AF systems, such as the Air Force Network (AFNet) Non-Classified Internet Protocol Router Network (NIPRNet) Gateways, Secret Internet Protocol Router Network (SIPRNet) Modernization program, and Host Based Security System leverage this technology to meet their information assurance and defensive cyberspace needs/requirements. Firestarter utilizes cyber and IA technology investments by United States Cyber Command (USCYBERCOM), the Defense Advanced Research Projects Agency (DARPA), the National Security Agency (NSA), Director of National Intelligence (DNI), Intelligence Advanced Research Projects Activity (IARPA), and the Department of Homeland Security (DHS), and various government research laboratories, to jump-start its development of solutions to existing AF cyber and IA requirements. This program supports AF Cyberspace strategic direction in support of Cyber Defense which provides capabilities to Sixteenth AF, as AF component to USCYBERCOM, Defense Information Systems Agency (DISA), National Security Agency (NSA), and other services to ensure Global Information Grid (GIG) cyber and IA requirements are being met. Activities performed include those designed to identify, analyze, test, rapidly acquire, and integrate emerging IA and cyber technology and defensive cyberspace weapons systems and capabilities into all regions of the GIG - terrestrial, airborne, and space systems. In addition, this effort will support implementation of Department of Defense (DoD) Enterprise-wide IA & Computer Network Defense (CND) Solutions Steering Group (ESSG) solutions. This program element may include necessary civilian pay expenses required to manage, execute, and deliver weapon system capability. The use of such program funds would be in addition to the civilian pay expenses budgeted in program element 0605827F, 0605828F, 0605829F, 0605831F, 0605832F, 0605833F, 0605898F, 0606398F. In FY24 $0.000M was expended for civilian pay expenses in this program element, and in FY25 $0.000M is forecasted for civilian pay expenses in this program element.

Mission — Cyber Defense Analysis source

Beginning in FY25, continuation of this work is described in Budget Program Activity Code (BPAC) 677824. The Cyberspace Defense Analysis (CDA) weapon system conducts Defensive Cyberspace Operations (DCO) during peace time and contingency operations and network defense by monitoring, collecting, analyzing, and reporting sensitive information transiting or residing on the Air Force Network (AFNet). CDA assessments of non-secure telecommunications determine type and amount of sensitive and/or classified information that may have been disclosed to our adversaries and encompasses several mission subsets, including: Telephony Communications, Radio Frequency (RF) Communications, Email Communications, Internet based Capabilities (IbC), and Cyber Operations Risk Assessment (CORA). The CDA weapon system protects the AF's critical information such as Personally Identifiable Information (PII), Operations Security (OPSEC), and other sensitive information through passive monitoring and active Data Loss Protection (DLP). CDA shows its true capability in the force protection realm, OPSEC, DLP, etc. and helps ensure our adversaries are not provided early warning of our plans, capabilities, or limitations. This program element may include necessary civilian pay expenses required to manage, execute, and deliver weapon system capability. The use of such program funds would be in addition to the civilian pay expenses budgeted in program element 0605827F, 0605828F, 0605829F, 0605831F, 0605832F, 0605833F, 0605898F, 0606398F. In FY24 $0.000M was expended for civilian pay expenses in this program element, and in FY25 $0.000M is forecasted for civilian pay expenses in this program element.

Mission — AFCERT source

Beginning in FY25, continuation of this work is described in Budget Program Activity Code (BPAC) 677824. Funding in this BPAC contributes to the development of software and related activities in support of the creation of the Integrated Defensive Cyberspace System (IDCS). IDCS generates defensive cyberspace capabilities supported by active response methodologies as the main focus of our efforts (we utilize National Institute of Standards and Technology (NIST)-standardized actions, such as protecting and securing computer and network systems, detecting and assessing damage, defending while recognizing / attributing / mitigating cyber threats, and recovering systems and data) as the Department of the Air Force (DAF) seeks to keep pace with ever-evolving threats and changes to our operational [cyber] environment. IDCS benefits the DAF Total Force, including Active Duty (AD), Air National Guard (ANG), and Air Force Reserve Command (AFRC) Airmen by enabling rapid deployment of defensive cyber sensor capabilities while disrupting bad actors from exploiting critical vulnerabilities upon the initial discovery of adversarial action at the tactical edge, by utilizing both automated decision making (ADM) and human/machine teaming (HMT) with trained defensive cyber operators. IDCS will equip DAF operational units (predominantly Sixteenth Air Force (AFCYBER), 688th Cyber Wing Cyber Security Service Providers (CSSPs), and 67th Cyber Wing, Air Force Cyber Protection Teams (CPTs), in addition to Mission Defense Teams (MDTs) and network defenders) with capabilities required to sensor, monitor and protect DAF and ad-hoc mission networks (including networks utilized by Air Force Special Operations Command (AFSOC)), Industrial Control Systems (ICS), and Weapon Systems. IDCS supports both enterprise (fixed) and edge/mobile use cases. IDCS exists to sustain two major components: (1) common sensor platform, known as VOLTRN+; (2) situational awareness platform, known as Enterprise Logging Ingest & Cyber Situational Awareness Refinery (ELICSAR), acting as DAF's version of a Big Data Platform (BDP). IDCS components are comprised of 3 main parts: (A) Strategic Data Platform; (B) Strategic and Tactical Analytics; (C) Joint Situational Awareness Applications. Working together, IDCS enables AF DCO to host, integrate, and feed defensive-cyber-related data, which informs both operational and strategic analysis, contributing to enhanced situational awareness for senior leaders. IDCS addresses the lack of a synchronized, enterprise-level approach to mitigate cyberspace vulnerabilities related to mission performance and/or mission assurance. Failing to address capability gaps will hinder DAF's ability to project Air Power and dominate in a fight against near-peer adversaries. The increased request to Research, Development, Test and Evaluation (RDT&E) funding for this portfolio reflects the threats (identified with Secretary of the Air Force support) to Air Force Defensive Cyber Operations, specifically requiring sensor data and enhanced situational awareness to mobilize, deploy, and sustain forces. IDCS develops, sources, sustains, and provides common non-proprietary modular hardware (including commercial-off-the-shelf (COTS) solutions), hosting, an edge cloud-compute defensive cyber platform (with options for both standalone or cloud-connected software), and cloud-based containerized software needed to execute the Cyberspace Vulnerability Assessment/Hunter (CVA/H), Air Force Cyber Defense (ACD), and Cyber Defense Analysis (CDA) missions. IDCS provides increased visibility into health and readiness of cyberspace systems for both local and enterprise leaders. IDCS aggregates and analyzes cyberspace data with the ability to enhance strategic assessments through the use of Artificial Intelligence (AI) and Machine Learning (ML), along with providing a comprehensive dashboard and reporting structure, which assists DCO operators in detecting and defeating Advanced Persistent Threats (APTs). IDCS development and sustainment is required to enable DAF's Defensive Cyber Operations to meet the urgent need to deploy modernized, interconnected cyber defenses across the entire Air Force, including the Pacific theater to deter near-peer aggression. IDCS contributes to successful sortie generation (getting planes off the ground and keeping them in the fight) while ensuring the integrity and global dominance of US Air Power. IDCS will be integrated with and leverage developmental activity from across the DoD including USCYBERCOM's Joint Cyber Warfighting Architecture and the DAF's Command, Control, Communications and Battle Management (C3BM). Activities also include various Advisory and Assistance Services (A&AS) and Program Management Administration (PMA) activities to support the aforementioned development efforts. This program element may include necessary civilian pay expenses required to manage, execute, and deliver weapon system capability. The use of such program funds would be in addition to the civilian pay expenses budgeted in program element 0605827F, 0605828F, 0605829F, 0605831F, 0605832F, 0605833F, 0605898F, 0606398F. In FY24 0.000M was expended for civilian pay expenses in this program element, and in FY25 0.000M is forecasted for civilian pay expenses in this program element.

Mission — 677824 - Integrated Defensive Cyberspace System source

Integrated Defensive Cyberspace System (IDCS) enhances the Department of Air Force (DAF) cyber infrastructure and supports operations within contested environments. The IDCS mission is to provide and maintain enterprise situational awareness of the DAF's cyber terrain within a contested environment to enable and support Cyber Forces response to evolving Cyber threats. The Air Force strategy previously involved three stand-alone programs that provided capabilities in a disparate fashion. IDCS delivers a comprehensive cyber defense architecture by integrating the three key mission sets with advanced sensors and data analytics. This provides commanders with critical risk assessments and enables proactive threat identification and neutralization on mission-critical networks. Integrated Defensive Cyberspace System (IDCS) is an integrated enterprise-level cybersecurity system that safeguards DAF computer, network, weapon, and control systems. It empowers operators to detect threats and assess their impact, allowing for quick deployment of defensive measures to thwart malicious actors from exploiting critical vulnerabilities. IDCS delivers the cybersecurity requirements of a variety of operational units, including the 16th AF, 688th Cyber Wing Cyber Security Service Providers (CSSPs), 67th Cyber Wing, AF Cyber Protection Teams (CPTs), Mission Defense Teams (MDTs), and network defenders. It equips these units with the tools necessary to protect DAF networks, Industrial Control Systems, and Weapon Systems. It supports both enterprise and edge/mobile cybersecurity defense use cases. IDCS provides capabilities to enable the following mission sets: Cyberspace Vulnerability Assessment/Hunter (CVA/H): The Hunter mission focuses on the capability to find, fix, track, target, engage, and assess (F2T2EA) the advanced persistent threat (APT). CVA/H provides capabilities to characterize and then eliminate threats for the purpose of mission assurance. CVA/H executes Hunter missions on Air Force (AF) and Department of Defense (DoD) networks and systems. Cyber Defense Analysis (CDA): The CDA mission conducts Defensive Cyberspace Operations (DCO) by monitoring, collecting, analyzing, and reporting sensitive information transiting or residing on the Air Force Network (AFNet). CDA assessments of non-secure telecommunications determine the type and amount of sensitive and/or classified information that may have been disclosed to our adversaries across Telephony Communications, Radio Frequency (RF) Communications, Email Communications, and Internet based Capabilities (IbC). The CDA mission protects the AF's critical information through passive monitoring and active Data Loss Protection (DLP). Air Force Cyber Defense (ACD): The ACD mission prevents, detects, and responds to adversarial penetration into DAF unclassified and classified networks. ACD provides 24/7/365 monitoring and defense of Secure/Non-Secure Internet Protocol Router Network (SIPRNET/NIPRNET) systems. Enterprise Network Cyber Situational Awareness: IDCS provides situational awareness across the DAF Enterprise Network and enables Enterprise level Command and Control of cyber tools to respond to Cyber threats. The capability provides Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response (SOAR) to enable understanding of cybersecurity attacks, respond quickly, and prevent future incidents. IDCS aggregates and analyzes cyberspace data with the ability to enhance strategic assessments and provide a comprehensive dashboard and reporting structure. Activities also include various Advisory and Assistance Services (A&AS) and Program Management Administration (PMA) activities to support the aforementioned development efforts. This program element may include necessary civilian pay expenses required to manage, execute, and deliver weapon system capability. The use of such program funds would be in addition to the civilian pay expenses budgeted in program element 0605827F, 0605828F, 0605829F, 0605831F, 0605832F, 0605833F, 0605898F, 0606398F. In FY24 0.953M was expended for civilian pay expenses in this program element, and in FY25 3.237M is forecasted for civilian pay expenses in this program element. In FY25, PE 0208088F, AF Defensive Cyberspace Operations, Project 677821 (CVA/H,) Project 677822 (CDA), and Project 677823 (AFCERT), were transferred to PE 0208088F, AF Defensive Cyberspace Operations, Project 677824 (IDCS), in order to distinguish IDCS from previous efforts.

Accomplishments & Planned Programs (5)