The CYBER DEFENSE CENTER issues industry threat escalation advisories for Peacetime and Wartime.

The Cyber Defense Force Posture is the only industry peacetime and wartime escalation advisory for changing a company's readiness state against cyber threats. This advisory model should be used in conjunction with wartime preparedness planning as recommended by the CYBER DEFENSE CENTER. Corporate incident response playbooks should be modified based upon current and changing advisory levels. 

The readiness state is intended to be used as an activation trigger for incident response procedures. Companies may adopt this model to improve overall response readiness for Peacetime (levels 1-3) and Wartime (levels 4-5). 

PEACETIME: This level indicates no direct or declared nation-state involvement in ongoing cyber attacks. Attack attribution to known threat actors is possible.  

PEACETIME: This level indicates an increase in cyber-attacks due to a condition such as a holiday or new criminal variant or threat. Nations states may be involved indirectly in attacks and attacker attribution is possible.

PEACETIME: This level indicates that nation-states are threatening, menacing, preparing, or proxying targeted cyber attacks on public or private sector critical infrastructure. Direct attribution may be limited.  

WARTIME: Nation states are actively and directly conducting targeted cyber attacks against public or private sector critical infrastructure. This usually involves the use of variants of current cyber tactics with some advanced tactics potentially weaponized or developed for specific targets. Cyber warfare by adversarial nation-states is imminent. 

WARTIME: Cyber warfare is active or declared. Attacks on companies by adversarial nation states is active.  This usually involves the use of advanced cyber weapons. Companies and infrastructure subject to campaigns conducted by nation-states may be targeted or indiscriminate.