# The Navy’s Bold Move: Adapting Watchstanding Principles to Cyber Defense Operations
The United States Navy is pioneering a remarkable shift in how it approaches cybersecurity — by borrowing a time-tested tradition from its own maritime operations. Watchstanding, a concept deeply embedded in naval culture for decades, is now being applied to protect the service’s networks, data, and digital infrastructure in ways that could reshape federal cyber defense strategies across the Department of Defense.
## What Are Watchstanding Principles?
Watchstanding has long been the backbone of naval operations aboard ships and submarines. It revolves around five core qualities:
– **Formality and Integrity** — maintaining disciplined, accountable processes at all times
– **High Level of Knowledge** — ensuring personnel are thoroughly trained and informed
– **Procedural Compliance** — following established protocols without exception
– **Questioning Attitude** — encouraging operators to challenge assumptions and seek clarity
– **Ownership** — instilling a sense of personal responsibility for the mission at hand
These principles were originally designed to keep vessels and their crews safe in high-stakes environments, particularly aboard nuclear submarines where precision is non-negotiable. Now, the Navy is proving that these same attributes are just as critical in the digital battlespace.
## A Leader’s Vision for Cyber Defense
Capt. Brian Evans, commanding officer of the Navy Cyber Defense Operations Command (NCDOC), has been at the forefront of this transformation. With an academic background in computer science at both the undergraduate and graduate levels, Evans brings a unique blend of technical expertise and operational experience to his role. His journey through the nuclear submarine training pipeline — named after Admiral Hyman Rickover — gave him firsthand exposure to watchstanding principles that he now champions in the cyber domain.
“These watchstanding principles were born out of an environment where precision matters,” Evans explained. “You cannot afford to be anything less than precise when standing watch on a reactor in a submarine. Over the course of my career, these principles have been adopted more widely across the Navy.”
Evans emphasized that the cyber domain demands the same level of discipline, knowledge, and accountability as any physical warfare environment. His team at NCDOC is working to build an operational culture where every defensive action is informed by deep expertise, clear communication, and a thorough understanding of adversary tactics.
## Translating Cyber Risk for Decision-Makers
One of Evans’ most critical responsibilities is bridging the gap between technical cyber operations and strategic naval leadership. Senior Navy leaders understand risk in traditional operational contexts — supply chains, fleet movements, force protection — but articulating cyber risk in terms that resonate across the full spectrum of naval operations requires deliberate effort.
“The Navy doesn’t do cyber for cyber alone. It is part of multidomain operations,” Evans noted. “How does a cyber event influence what is happening in other domains to affect risk to the force writ large is extremely important.”
By framing cyber risk within the broader context of Navy operations, Evans ensures that leadership can make informed decisions about resource allocation, operational planning, and defensive priorities. This translation layer between technical cyber activity and strategic warfighting impact is essential for maintaining alignment across the organization.
## Defending Shore and Sea: A Dual Responsibility
The complexity of the Navy’s cyber defense mission is amplified by the diversity of its operational environments. Evans’ team must protect systems and networks that span both land-based installations and afloat platforms, including carriers, submarines, and expeditionary vessels.
To support this mission, NCDOC deploys four to six personnel per carrier strike group or amphibious readiness group to maintain continuous 24/7 cyber coverage at sea. On shore, the command — operating under U.S. Fleet Cyber Command — supports Navy information technology and operational technology needs with a workforce of just under 1,000 personnel.
This dual-mandate requires a defensive platform that is both resilient and adaptable, capable of addressing threats across vastly different operational contexts simultaneously.
## Two Pillars of Defensive Cyber Operations
Evans outlined the two primary categories of defensive cyberspace operations that NCDOC executes:
### Intelligence-Driven Operations
The first pillar focuses on staying ahead of adversaries by leveraging the intelligence apparatus of the U.S. government. By analyzing threat indicators observed globally, NCDOC operators gain foresight into potential adversary objectives, capabilities, and techniques before those threats materialize against Navy networks.
“We are leveraging the exquisite intelligence apparatus of the U.S. government to gain insights into what the adversary may want to do based on what we’re seeing them do elsewhere around the world,” Evans described.
### Incident-Driven Operations
The second pillar is reactive in nature, centered on responding to confirmed or suspected malicious cyber activity. These operations involve navigating complex questions of authority, intelligence sharing, and tactical response. The goal is to generate desired effects from adversary contact while carefully managing the tradeoffs between intelligence gain, operational impact, and legal authorities.
“Sometimes there is a discussion about intelligence gain and loss, and there’s always this move through who has the right authorities, who has the right lead on these types of things depending upon what the nature of the incident is,” Evans explained.
## Three Command Priorities: Warfighting, Agility, and Precision
Evans identified three overarching priorities that guide NCDOC’s defensive cyber operations:
### 1. Warfighting
At its core, the mission is about protecting the Navy’s ability to fight and win. Cyber defense directly translates into the protection of ships, systems, and ultimately the lives of sailors and Marines. Every investment and operational decision is filtered through a resilience lens, ensuring that resources deliver tangible operational outcomes and strengthen the service’s capacity to counter adversaries.
### 2. Agility
The cyber threat landscape evolves at a relentless pace. New vulnerabilities emerge constantly, adversary tactics grow more sophisticated, and emerging technologies introduce both opportunities and risks. Evans stressed that the Navy must cultivate processes and a mindset that allow for rapid adaptation.
“We have to have processes and a mindset that we are ready to adapt quickly to a change in our understanding of adversary tactics and techniques,” he said. Building workforce flexibility and exposure to emerging technologies — including through direct vendor engagements — is key to maintaining this agility.
### 3. Precision
The technical complexity and velocity of the cyber domain demand that operators not only understand what is happening in real time but also communicate its significance clearly to decision-makers. Precision ensures that defensive actions are proportionate, informed, and strategically aligned.
Evans sees precision as a unifying thread connecting the watchstanding tradition with modern cyber operations: “Whether you’re talking about operating a reactor and keeping it safe, or the precision that is required in the cyberspace domain, both domains require that unrelenting pursuit of the highest level of precision as you execute.”
## Building a Knowledge-Driven Cyber Workforce
Underpinning all of these efforts is NCDOC’s foundational training program, which is designed to build deep domain expertise across the workforce. The command intentionally creates opportunities for personnel to engage with emerging technologies, access fresh intelligence insights, and stay current on the evolving threat environment.
This investment in human capital reflects a broader recognition that the best defensive technologies are only as effective as the operators who wield them. By fostering a culture of continuous learning and technical excellence, NCDOC ensures its personnel can meet the demands of an increasingly complex cyber battlefield.
—
## Frequently Asked Questions (FAQ)
**Q: What are watchstanding principles?**
A: Watchstanding principles are a set of five core qualities — formality and integrity, a high level of knowledge, procedural compliance, a questioning attitude, and ownership — that have been used in naval operations for decades to ensure safety and mission success, particularly aboard ships and submarines.
**Q: Why is the Navy applying watchstanding principles to cyber defense?**
A: The cyber domain shares many characteristics with traditional naval operations: it demands precision, disciplined processes, deep knowledge, and accountability. Watchstanding principles provide a proven framework for building a culture of excellence and accountability in cyber defense operations.
**Q: What is the Navy Cyber Defense Operations Command (NCDOC)?**
A: NCDOC is the Navy’s primary defensive cyber operations command, responsible for protecting Navy networks, data, and systems both ashore and afloat. It operates under U.S. Fleet Cyber Command and employs close to 1,000 personnel.
**Q: How does NCDOC support naval operations at sea?**
A: NCDOC deploys four to six cyber defense personnel per carrier strike group or amphibious readiness group to provide continuous 24/7 cyber coverage for deployed naval forces.
**Q: What are the two types of defensive cyberspace operations?**
A: The two types are intelligence-driven operations, which focus on anticipating and staying ahead of adversaries, and incident-driven operations, which focus on responding to active malicious cyber activity.
**Q: What are NCDOC’s three command priorities?**
A: The three priorities are warfighting (protecting the Navy’s ability to operate in and through the cyber domain), agility (rapidly adapting to new threats and technologies), and precision (ensuring clear understanding and communication of cyber activity and its implications).
**Q: How does NCDOC communicate cyber risk to Navy leadership?**
A: NCDOC translates cyber risk into the broader context of Navy operations and multidomain warfighting, helping senior leaders understand how digital threats impact fleet readiness, mission success, and overall force protection.
**Q: Why is the Navy’s cyber defense mission more complex than that of many other organizations?**
A: The Navy must defend systems and networks across diverse environments — including land-based shore facilities, afloat ships, and submarines — each with unique operational requirements, technical architectures, and threat profiles.
—
## Conclusion
The Navy’s integration of watchstanding principles into cyber defense represents a powerful example of how timeless operational traditions can be adapted to meet the challenges of a modern digital battlespace. Under Capt. Evans’ leadership, NCDOC is building a defensive posture grounded in deep knowledge, relentless precision, strategic agility, and unwavering ownership. By connecting cyber operations to the broader warfighting mission and translating technical risk into operational terms, the Navy is ensuring that its cyber defense capabilities serve the force as a whole — protecting ships, systems, and the sailors and Marines who depend on them. As the threat environment continues to evolve, this principled, knowledge-driven approach positions the Navy to stay ahead of adversaries and maintain its dominance across all domains, including cyberspace.
Thank you for reading
