Which statement accurately describes governance for DCO and OCO in terms of authorization?

Which statement accurately describes governance for DCO and OCO in terms of authorization?

• A. DCO has no governance by ROE.
• B. DCO is governed by ROE and authorities, while OCO requires explicit authorization and legal/ethical approval.
• C. Both DCO and OCO require no authorization.
• D. DCO and OCO are identical in authorization.

Answer: (B)

Defensive cyber operations are managed under established rules of engagement and the formal chain of authority. This means DCO can proceed within ROE and the approved authorities set by leadership and legal/policy reviews, focusing on protecting, detecting, and responding to threats to own networks with approved methods. Offensive cyber operations, by contrast, require explicit authorization at higher levels and undergo legal and ethical review before actions are taken. This ensures compliance with laws (including the laws of armed conflict), policy constraints, and risk considerations, given the potential for escalation and collateral effects. So the governance described—DCO governed by ROE and authorities, while OCO requires explicit authorization and legal/ethical approval—accurately reflects how authorization is structured for defensive versus offensive cyber actions.

Defensive cyber operations are managed under established rules of engagement and the formal chain of authority. This means DCO can proceed within ROE and the approved authorities set by leadership and legal/policy reviews, focusing on protecting, detecting, and responding to threats to own networks with approved methods.

Offensive cyber operations, by contrast, require explicit authorization at higher levels and undergo legal and ethical review before actions are taken. This ensures compliance with laws (including the laws of armed conflict), policy constraints, and risk considerations, given the potential for escalation and collateral effects.

So the governance described—DCO governed by ROE and authorities, while OCO requires explicit authorization and legal/ethical approval—accurately reflects how authorization is structured for defensive versus offensive cyber actions.