2. National Operational Coordination
1. Agency Enhanced Coordination Procedures. Each Federal agency that
regularly participates in the CRG, including SSAs, shall establish and follow
enhanced coordination procedures as defined in the annex to this PPD in
situations in which the demands of responding to a significant cyber incident
exceed its standing capacity.
2. Cyber Unified Coordination Group. A Cyber Unified Coordination Group
(UCG) shall serve as the primary method for coordinating between and among
Federal agencies in response to a significant cyber incident as well as for
integrating private sector partners into incident response efforts, as
appropriate. A Cyber UCG shall be formed at the direction of the NSC
Principals Committee, Deputies Committee, or the CRG, or when two or more
Federal agencies that generally participate in the CRG, including relevant
SSAs, request its formation. A Cyber UCG shall also be formed when a
significant cyber incident affects critical infrastructure owners and operators
identified by the Secretary of Homeland Security as owning or operating
critical infrastructure for which a cyber incident could reasonably result in
catastrophic regional or national effects on public health or safety, economic
security, or national security.
A Cyber UCG will normally consist of Federal lead agencies for threat
response, asset response, and intelligence support, but will also include SSAs,
if a cyber incident affects or is likely to affect sectors they represent. In
addition, as required by the scope, nature, and facts of a particular significant
cyber incident, a Cyber UCG may include participation from other Federal
agencies, SLTT governments, nongovernmental organizations, international
counterparts, or the private sector.
Following the formation of a Cyber UCG, Federal agencies responding to the
incident shall assign appropriate senior executives, staff, and resources to
execute the agency’s responsibilities as part of a Cyber UCG. The Cyber UCG is
intended to result in unity of effort and not to alter agency authorities or
leadership, oversight, or command responsibilities. Unless mutually agreed
upon between agency heads or their designees, and consistent with applicable
legal authorities such as the Economy Act of 1932 (31 U.S.C. 1535), Federal
departments and agencies will maintain operational control over their
respective agency assets.
6/8