The Army, foreseeing the increasing global scope of the cyberspace mission, determined it needed an organization solely focused on cyberspace operations. The decision went into the Army Campaign Plan decision point process with the designation, Decision Point 141, and received approval from the Vice Chief of Staff of the Army and the Under Secretary of the Army on 22 December 2009. The Army Chief of Staff approved the decision on 1 February 2010, and directed the establishment of a new separate command with operations centered at Fort Belvoir, Virginia.
A Headquarters, Department of the Army G-3/5/7 Execute Order (No. 155-10), released on 11 May 2010, directed Army Forces Cyber (ARFORCYBER)’s establishment as a separate command. The command was to achieve initial operational capability by 29 June 2010 and full operational capability by 1 October 2010. It was to establish the Army Cyberspace Operations and Integration Center (ACOIC) at Fort Belvoir no later than the 3rd Quarter of FY 2010 and assume operational control of Network Enterprise Technology Command (NETCOM)/9th Signal Command (Army) and Intelligence and Signal Command (INSCOM) for cyberspace operations, and operational control of several 1st Information Operations (IO) Command (Land) elements.
On 21 May, the Army announced the establishment of a new ARFORCYBER Headquarters within the National Capitol Region by October 2010. On 30 June, the Army’s interim ARFORCYBER declared initial operating capability for the ACOIC at Fort Belvoir.
On 1 October 2010, the Army designated the new three-star command as ARCYBER, an operational–level Army force, reporting directly to Headquarters, Department of the Army, and receiving the lineage and honors of the former Second Army. The command operated with an authorized complement of 561 personnel who were assigned at Fort Belvoir and Fort Meade, pending a final stationing decision. The total command strength included approximately 21,000 Soldiers, Department of the Army Civilians and Contractors located worldwide. The command brought an unprecedented unity of effort and synchronization of all Army forces operating within the cyber domain.
The major changes under ARCYBER were primarily in the new organizational alignment of essential functions and the establishment of the ACOIC. For example, ARCYBER better aligned INSCOM’s cyber intelligence and offense forces and placed them under ARCYBER operational control. The ACOIC served as ARCYBER’s single recognized operations center, further evolving the Army’s decade-long effort to blend complimentary functions of the Army Global Network Operations and Security Center and 1st IO Command (Land), both of which joined under a single one-star director of operations reporting directly to the ARCYBER commander. Although the mechanics of the overall mission remained largely the same, the ACOIC ensured less discernible separation in how they were carried out, better integrating capabilities across the board.
ARCYBER’s primary mission was to support USCYBERCOM in defending Department of Defense networks and the Nation, which meant operating in a joint environment that included not just USCYBERCOM, the Component Commands, and the Army’s sister Service Components, but also other departments, agencies, and private entities. Therefore, as USCYBERCOM established its operating procedures, ARCYBER also concurrently needed to establish and develop effective linkages with the Army’s sister Services, which translated into growing ARCYBER’s intelligence and cyber operations capabilities. The command also needed to establish internal processes and procedures within and between the Defense Department's cyber organizations to enable cyberspace activities under various authorities to work in concert with each other to more effectively support cyber operations.
Within its first year as an operational command, Army Cyber Command accomplished nine major objectives that included:
• Integration with USCYBERCOM and Service cyber components
• Operational focus with unprecedented unity of effort in operating and defending all Army networks
• Significant contribution to operational cyber planning
• Increased full spectrum capacity and capability
• Continued focus on enterprise capabilities
• Integrated cyberspace operations in major combatant command exercises
• Establishment of an Army Cyberspace Proponent Office
• Aggressively developed cyberspace requirements
• Produced draft “Army Cyber 2020” Strategic Plan
Relationship between U. S. Army Cyber Command and Second Army
The Relationship between ARCYBER and Second Army has undergone several changes since the establishment of ARCYBER in 2010. From its establishment in October 2010 to March 2014, Army Cyber Command perpetuated the lineage and honors of the inactive Second United States Army, which traced its history to World War I. In March 2014, the Army activated a new unit designated Second Army that resulted in the Second Army's lineage and honors being withdrawn from Army Cyber Command and assigned to the newly activated unit. Although Army Cyber Command no longer retained the lineage and honors, the Commander of Army Cyber Command was designated as the Commander of Second Army. Second Army, with the NETCOM assigned to it, became a Direct Reporting Unit of the Chief Information Officer/G-6, HQDA, to optimize the Army's force structure in support of Army Cyber Command's mission. After ARCYBER became an Army Service Component Command to U.S. Strategic Command in July 2016, the Army reassessed ARCYBER's command and control relationship with NETCOM and Second Army. In January 2017, to improve readiness and achieve unity of command, the Army discontinued Second Army, reassigned NETCOM to ARCYBER, and returned Second Army's lineage and honors to ARCYBER.
Shoulder sleeve insignia symbolism
Green alludes to Army Cyber Command as a land-based organization. The inner border of the pentagon shape suggests the containment of threats against the cyberspace infrastructure. The black background represents space, the unit’s area of operations. The flowing grid pattern in the background denotes the shifting electronic energy of the cyberspace environment. The terrestrial globe signifies the global electronic reach of the command; it is divided from light to dark, to display the Army Cyber Command’s round-the-clock operational velocity and the interaction of its cyber responsibilities. The three spears symbolize the three areas of computer network capabilities: attack, defend, and exploit. The lightning bolt illustrates the ability and swiftness to strike anywhere.
Distinctive Unit Insignia
The black background represents space, the unit’s area of operations. The flowing pattern in the background denotes the shifting electronic energy of the Cyberspace environment. The fleur-delis indicates the command’s lineage to the Second Army, inheriting the unit’s campaign credit in Lorraine, France, during World War I. The three spears symbolize the three areas of computer network capabilities - attack, defend, and exploit. The lightning bolt illustrates the ability for the command to swiftly strike anywhere. Green alludes to the global reach of the Army Cyber command, also conveying the unit being a land based organization. The motto translates to “Second To None.”
1st IO Command
780th MI Brigade (Cyber)
Cyber Protection Brigade
U.S. Cyber Command
Air Forces Cyber
U.S. Fleet Cyber
Marine Corps Forces Cyber
Coast Guard Cyber
U.S. Army Reserve
Army National Guard
U.S. Army Cyber Center of Excellence
Developing tomorrow’s cyberspace strategies today.
Army Cyber School (CAC only)
Army Cyber Institute
National Defense University iCollege
Air Force Institute of Technology
Defense Cyber Investigations Training Academy
Hacking for Defense
Army Cyber Direct Commissioning
More Cyber Opportunities