Defense cybersecurity is how the US military and its suppliers protect networks, data and cyber forces. It combines contractor rules, cloud authorization, command structures and career paths, and this guide maps each part and links to a full explainer.
How the field fits together
Four layers sit inside defense cybersecurity. Doctrine says what cyberspace operations are for. Commands and units carry them out. Rules and standards set the security bar for the contractors and cloud providers that handle defense information. People, in uniform and out, do the work.
Each layer has its own page on this site. The table below is the quick map, and the sections that follow summarize each page without repeating it. For the event side of the story, start from the AFITC conference guide. This site is an independent resource and is not affiliated with the US Air Force, the Department of Defense or any event organiser.
| Layer | Topic | What it answers |
|---|---|---|
| Doctrine | Cyberpower | What cyberspace operations are meant to achieve |
| Doctrine | Zero trust | How the department wants networks to grant access |
| Commands | US Cyber Command, Sixteenth Air Force | Who plans and conducts cyber operations |
| Policy | DoD CIO | Who sets department-wide IT and cyber policy |
| Rules | NIST SP 800-171, DFARS 7012, CMMC, FedRAMP | What contractors and cloud providers must meet |
| People | Air Force cyber careers, one commander’s biography | Who does the work and how they enter it |
Source: the guides linked in the sections below, which cite 10 U.S.C. § 142 for the DoD CIO and the CMMC program rule for the rules layer.
Doctrine: what cyberpower and zero trust mean
Air Force doctrine organizes cyberspace work into offensive, defensive and network-operations missions. The explainer on what cyberpower means in Air Force doctrine defines the vocabulary: cyberspace as a domain, the layers inside it, and how the Air Force, Sixteenth Air Force and US Cyber Command relate. It is the best first read for anyone new to the terms used at defense cyber events.
Zero trust is the department’s answer to a different question: how should a defended network decide who gets in. The principle is that no user, device or network location is trusted by default, and every access request is checked against policy. The guide to zero trust for defense networks covers the NIST model behind the idea, the pillars in the DoD strategy and its target dates.
Commands: US Cyber Command and Sixteenth Air Force
US Cyber Command is the military’s unified command for cyberspace. A Congressional Research Service primer records that Defense Secretary Robert Gates directed its creation on June 23, 2009, that its commander also serves as Director of the NSA, and that it draws forces from four service components. The explainer on US Cyber Command’s mission, structure and history covers how it was elevated to a full combatant command and why the dual-hat arrangement has been reviewed more than once.
The Air Force’s service component is Sixteenth Air Force, also called Air Forces Cyber. The Air Force announced the merger of the 24th and 25th Air Forces that created it in an April 4, 2019 press release, Air Force Times reported, describing a new organization combining cyber, intelligence, surveillance and reconnaissance, electronic warfare and information operations under one commander. The guide to Sixteenth Air Force and what Air Forces Cyber does explains the wings, the predecessors and the reasons for the merger.
The two pages fit together. Cyber Command’s mission, in the CRS primer’s words, is to “direct, synchronize, and coordinate cyberspace planning and operations”, and Sixteenth Air Force is where the Air Force’s contribution to that effort lives. Readers who want the doctrine behind both should read the cyberpower explainer first.
Policy: the DoD Chief Information Officer
Above the commands sits the department’s policy owner for information technology. The DoD Chief Information Officer is a civilian appointed by the President with the advice and consent of the Senate, and by statute reports directly to the Secretary of Defense. The same statute, 10 U.S.C. § 142, gives the office authority over the Defense Information Systems Agency.
The explainer on what the DoD CIO does covers the statutory duties, the budget certification process and the office’s role in zero trust and CMMC. That is why this role keeps appearing in the rules sections below: many contractor requirements trace back to policy written there.
Rules: standards that bind contractors and cloud providers
This is the most practical layer for companies. Four documents do most of the work, and each has its own page.
NIST SP 800-171
NIST SP 800-171 is the list of security requirements for protecting Controlled Unclassified Information (CUI) on nonfederal systems. NIST published Revision 3 in May 2024, but the CMMC program rule still applies Revision 2. The guide to NIST SP 800-171 and how to protect CUI covers the requirement families, the differences between revisions and how the SPRS score works.
DFARS 252.204-7012 and the wider industrial base
The contract clause that brings NIST 800-171 to defense suppliers is DFARS 252.204-7012. It also sets the incident reporting duty: the clause defines “rapidly report” as within 72 hours of discovery of a cyber incident. The page on defense industrial base cybersecurity rules and resources walks through reporting, flow-down to subcontractors and the voluntary information sharing run through DC3.
CMMC
CMMC verifies that contractors actually meet those requirements. The program rule says the model consists of three levels. At Level 2, an organization meets the requirement for contract award by meeting all 110 security requirements of NIST SP 800-171 Revision 2, or by receiving a Conditional status with at least the minimum passing score of 80 percent and the remaining items in a plan of action, which must be closed within 180 days. The rule was effective December 16, 2024. The page on CMMC requirements, levels and assessments covers the assessment types and the rollout phases.
FedRAMP
FedRAMP governs cloud services. The program describes itself as a government-wide, standardized, reusable approach to cloud security assessment and authorization, and its FedRAMP 20x path was announced as a new route “developed with industry and government, tested in public, and delivered incrementally”. The explainer on how FedRAMP authorizes cloud services covers the classes, the 20x phases and how DoD adds its own impact levels on top.
The four fit as a chain. NIST 800-171 is the content, DFARS 7012 is the contract hook and the reporting duty, CMMC is the verification and FedRAMP covers the cloud services a contractor might use to hold the data.
People: careers and leaders
The last layer is people. Enlisted, officer and civilian routes all lead into Air Force cyber work, and the guide to Air Force cyber careers across enlisted, officer and civilian paths compares them. As one example from the Air Force’s own recruiting page for Cyberspace Effects Operations officers, Officer Training School lasts 8.5 weeks at Maxwell Air Force Base, Alabama. The enlisted and civilian entry rules differ, and the career page sets them side by side.
Leadership profiles add context. The biography of Lt. Gen. Christopher P. Weggeman follows a retired general who commanded Twenty-Fourth Air Force, the predecessor to today’s cyber numbered air force, from 2016 to 2018, according to Wikipedia. It shows how cyber leadership roles sit within a longer operational career.
Where to start, by reader
- A contractor or subcontractor: read NIST SP 800-171 first, then the industrial base page, then CMMC. Add FedRAMP if cloud services hold defense information.
- A student or job seeker: start with the careers page, then the cyberpower explainer so the job titles make sense.
- A conference attendee: read the cyberpower and Cyber Command pages for the vocabulary, then the zero trust page for the department’s network security direction.
- A policy reader: the DoD CIO and zero trust pages show where the department’s direction is set.
Defense cyber topics also come up at government events. The overview of government cybersecurity conferences lists where briefings on these subjects take place.
Reading the acronyms
Defense cyber writing leans on shorthand, and the same few terms recur across every page here.
- CUI is Controlled Unclassified Information: unclassified data that law or policy says must be safeguarded. NIST SP 800-171 exists to protect it on contractor systems.
- DFARS is the Defense Federal Acquisition Regulation Supplement, the set of acquisition rules whose clauses appear in defense contracts.
- CMMC is the Cybersecurity Maturity Model Certification program, the way DoD verifies contractor security.
- FedRAMP is the Federal Risk and Authorization Management Program for cloud services.
- DISA is the Defense Information Systems Agency, which the DoD CIO oversees by statute.
- USCYBERCOM is US Cyber Command, and AFCYBER is Air Forces Cyber, the Air Force component.
Terms like these are easy to confuse because they sit side by side in the same documents. A contractor can be subject to a DFARS clause that cites NIST 800-171, be assessed under CMMC, and use a FedRAMP-authorized cloud service, all for one contract. Reading the pages in the order suggested above keeps those relationships straight.
How the layers connect in practice
Consider how one idea travels through the system. A policy owner, in this field the DoD CIO, decides the department needs a particular security posture, such as zero trust. That direction reaches the network defenders in commands like Sixteenth Air Force, and it reaches suppliers through contract clauses and verification programs.
The reverse also holds. Incident reporting by contractors, such as the 72-hour duty described above, feeds information back to the department. The defense industrial base page covers the voluntary sharing program alongside the mandatory reports. Seeing both directions explains why a contractor’s compliance paperwork and a command’s operational planning appear in the same field.
That connection is also why defense cyber topics fill conference programs. Policy owners, command staff, suppliers and recruiters all have a stake in the same set of questions, so they meet at the same events. The conference guide linked above describes the Air Force event in Montgomery, Alabama, and its place among related gatherings.
Caveats for readers
Everything in this section of the site summarizes public documents at the date each page was written. Rules, rollout phases and organization charts change, and several pages here cover programs that are still being phased in. Where a page gives a date or figure, it names the document that supports it, and readers should check that document before relying on the figure for a contract, a bid or a career decision.
None of these pages is legal advice or an official statement. They do not make an organization compliant with any rule. They explain what the public documents say so that readers can ask better questions of their contracting officer, compliance adviser or recruiter.
Frequently asked questions
What does defense cybersecurity cover?
It covers protecting military networks, defending the contractors and cloud providers that handle defense information, and conducting cyberspace operations. This site splits it into doctrine, commands, policy, rules and people.
Who sets the rules contractors must follow?
Contract clauses such as DFARS 252.204-7012 and the CMMC program rule set them, built on NIST SP 800-171. They are published in the Federal Register and on acquisition.gov.
Is this site an official source?
No. It is an independent explainer. Official requirements are in the cited clauses, rules and agency pages, and a specific contract governs a specific company.
Which page should a newcomer read first?
The cyberpower explainer gives the vocabulary, and the page for the reader’s own situation, such as contractor rules or careers, covers the practical detail.
Photo credits: panumas nikhomkhai (Pexels License); Brett Sayles (Pexels License).
