Computer Network Defense (CND)

Computer Network Defense (CND) encompasses the defensive cyberspace operations, including network monitoring, intrusion detection, incident response, and vulnerability management, used by DoD and government agencies to protect their information systems and networks from cyberattacks, unauthorized access, and malicious activity.

What is CND?

CND is a core capability of DoD's cyberspace operations framework, which divides military cyber activities into Defensive Cyberspace Operations (DCO), Offensive Cyberspace Operations (OCO), and DoD Information Network Operations (DODIN Ops). CND specifically refers to the defensive posture: continuously monitoring networks for anomalous or malicious activity, detecting intrusions, analyzing threats, and responding to and recovering from cyberattacks. Within DoD, CND is coordinated through Cyber Protection Teams (CPTs), the Joint Force Headquarters-DoD Information Network (JFHQ-DODIN), and service-level cyber commands. Defense contractors who operate DoD information systems or who work within DoD network environments are required to support CND activities, including incident reporting, network access logging, and compliance with cybersecurity requirements that enable CND tools and techniques to function effectively. The DFARS 252.204-7012 clause and its successor requirements mandate specific CND-related obligations for defense contractors including rapid cyber incident reporting and media preservation for forensic analysis.

Why CND matters for government contractors

Defense contractors are frequent targets of sophisticated nation-state cyber actors seeking to steal defense technology and program information. Understanding CND concepts helps contractors implement the defensive architectures that DoD expects on contractor networks, satisfy DFARS cyber requirements, and respond appropriately when incidents occur.

Example

A defense prime contractor operates networks that store covered defense information under DFARS 252.204-7012. The contractor implements a CND program that includes 24/7 security operations center (SOC) monitoring, endpoint detection and response (EDR) tools, regular vulnerability scanning, and an incident response plan. When an intrusion is detected, the contractor follows its CND-aligned incident response procedure, isolates affected systems, preserves forensic images, and notifies CISA and DCSA within the 72-hour timeframe required by DFARS.

Frequently Asked Questions

What is the difference between CND and cybersecurity?

Cybersecurity is the broad discipline of protecting information systems. CND is a specific operational concept within DoD's cyberspace operations doctrine focusing on active defensive measures, monitoring, detecting, and responding to attacks, rather than the full spectrum of security controls. In practice, the terms overlap significantly in defense contractor contexts.

What are Cyber Protection Teams (CPTs)?

CPTs are DoD-organized cyber units that provide active CND support to mission-critical networks when those networks are at elevated risk of cyberattack. CPTs can be deployed to contractors' networks if the government determines that contractor systems are at imminent risk, with contractor cooperation required under the terms of the contract.

What does DFARS 252.204-7012 require in terms of CND?

DFARS 252.204-7012 requires defense contractors to provide "adequate security" on systems processing covered defense information, implement all security controls in NIST SP 800-171, rapidly report cyber incidents to DoD, preserve images of compromised systems for 90 days, and grant DoD access to contractor systems for forensic investigation. These requirements are fundamentally CND-enabling obligations.

How do contractors demonstrate CND capability in proposals?

Defense IT and cybersecurity solicitations frequently request technical descriptions of the contractor's CND capabilities, SOC operations, incident response procedures, threat intelligence integration, and endpoint protection approaches. Strong CND capability narratives, supported by past performance on cyber incident detection and response, are evaluated favorably in technical proposal sections.