3. Federal lead agencies. In order to ensure that the Cyber UCG achieves
maximum effectiveness in coordinating responses to significant cyber
incidents, the following agencies shall serve as Federal lead agencies for the
specified line of effort:
1. In view of the fact that significant cyber incidents will often involve at
least the possibility of a nation-state actor or have some other national
security nexus, the Department of Justice, acting through the Federal
Bureau of Investigation and the National Cyber Investigative Joint Task
Force, shall be the Federal lead agency for threat response activities.
2. The Department of Homeland Security, acting through the National
Cybersecurity and Communications Integration Center, shall be the
Federal lead agency for asset response activities.
3. The Office of the Director of National Intelligence, through the Cyber
Threat Intelligence Integration Center, shall be the Federal lead agency
for intelligence support and related activities.
Drawing upon the resources and capabilities across the Federal Government,
the Federal lead agencies are responsible for:
1. Coordinating any multi-agency threat or asset response activities to
provide unity of effort, to include coordinating with any agency
providing support to the incident, to include SSAs in recognition of their
unique expertise;
2. Ensuring that their respective lines of effort are coordinated with other
Cyber UCG participants and affected entities, as appropriate;
3. Identifying and recommending to the CRG, if elevation is required, any
additional Federal Government resources or actions necessary to
appropriately respond to and recover from the incident; and
4. Coordinating with affected entities on various aspects of threat, asset,
and affected entity response activities through a Cyber UCG, as
appropriate.
3.
Field-Level Coordination
Field-level representatives of the Federal asset or threat response lead agencies shall
ensure that they effectively coordinate their activities within their respective lines of
effort with each other and the affected entity. Such representatives may be colocated with the affected entity.
VI. Unified Public Communications
The Departments of Homeland Security and Justice shall maintain and update as
necessary a fact sheet outlining how private individuals and organizations can contact
relevant Federal agencies about a cyber incident.
7/8