AFI 17-203 — Cyber Incident Handling

What this publication covers

This Instruction provides guidance on AF DCO and the conduct of network incident handling. For the purposes of this instruction, DCO and DoDIN Operations refer to day-to-day network monitoring, analysis, detection, and response. They do not refer to missions/actions associated with deliberate mission planning for named defensive operations.

This Instruction also applies to incidents involving systems which are not directly connected to or part of an AF network, e.g., supervisory control and data acquisi tion (SCADA) systems or information systems that are an integral part of a weapon system and may connect to the DoDIN indirectly through the use of removable media or a wireless connection.

Publications that cite AFI 17-203

• AFI 17-101 — Risk Management Framework (Rmf) For Air Force Information Technology (It) Current 2 mentions
• AFI 17-130 — Cybersecurity Program Management Current 2 mentions

If AFI 17-203 changes, these are the documents that point at it. Extracted from the publications' own text, so it reflects what we have read, not a complete dependency map. Every publishing office validates its own document; nobody validates the seams between them.

Nearby in the AFI series

• AFI 17-140 — Architecting Current
• AFI 17-140 AETC Sup — Architecting Current
• AFI 17-201 — Command and Control (C2) for Cyberspace Operations Current
• AFI 17-210 Not in the current catalog
• AFI 17-210 MOUNTAINHOMEAFB Sup — Ceremonial Public Address (CPA) Support Current