The Department of the Navy is bringing the service’s watchstanding principles to the cyber domain.

The Navy uses watchstanding principles on ships and submarines to ensure sailors and Marines keep their vessels safe based on characteristics that focus on formality and integrity, a high level of knowledge, procedural compliance, a questioning attitude and ownership.

These same qualities are equally necessary when protecting the service’s networks and data, said Capt. Brian Evans, commanding officer of the Navy Cyber Defense Operations Command (NCDOC).

“I’m constantly pushing the team to figure out how we articulate the conditions in which we’re operating, the capabilities we’re bringing to that operating environment, the actions that need to be taken and the risks associated with those things,” Evans said during Federal News Network’s Cyber Leaders Exchange 2026.

“There’s always risk associated with what you’re doing. How do we articulate that concisely to decision-makers so that we get the right outcomes? That requires an environment where your operators have a deep understanding of their warfighting domain. That is predicated again on exquisite knowledge of the systems that they are operating and a sound grasp of the tactics that they’re employing and the tactics of the adversary, and the way that we have chosen to really create this environment within NCDOC.”

The cyber defenders are embracing those concepts as part of how they are building more precise operations and the ability to communicate risk, he said.

Evans, who earned his undergraduate and graduate degrees in computer science, said he brought the watchstanding principles to cyber from his time in the submarine force.

“I am a product of the Hyman Rickover nuclear training pipeline, and so those principles were taught to me very early on. Those were what were articulated in an organization where precision matters. You cannot not be precise when you’re standing watch on a reactor in a submarine. These watchstanding principles were born out of that. They’ve more recently been adopted more widely across the Navy during my career,” he explained.

That means when Navy cyber defensive operators provide a risk assessment or take specific actions, senior leaders have a better understanding of why a task needs to be done.

“I spend a good majority of my time trying, as I engage with senior Navy leaders, to articulate what the cyber risk is because they understand the concept of risk — but then placing that in a broader context of overall Navy operations,” he said.

“How does cyber influence the operations around it? Because the Navy doesn’t do cyber for cyber alone. It is part of multidomain operations and how that cyber event is influencing what is happening in those other domains to affect risk to the force writ large is extremely important. Oftentimes senior leaders in the Navy are also familiar with how risk is articulated within other domains. They just need that help in doing that translation, and so we always try and frame that cyber risk in the context of broader risk to Navy operations.”

A key facet of Evans’ job is to understand and articulate the cyber risk the Navy is facing and to ensure the defensive platform remains agile. He said that means understanding the adversary’s capabilities through battle space awareness. It means using intelligence to understand the adversary’s objectives and their capabilities.

“We try and keep that platform small, and we try to continually assess it. We are generating the type of insight that we need from both a battlespace awareness perspective as well as the ability to action the indicators that we’re getting out of that system from a technological perspective,” Evans said.

“Both agility and precision, in my mind, are predicated on our cyberspace warfighting expertise. We have a foundational training program designed to build a level of knowledge. We intentionally build in opportunities to get exposure to emerging technologies and emerging insights about what is happening within the domain. This includes trying to educate ourselves sometimes through engagements with vendors on what is coming into the environment. What is new? How is it evolving?”

Of course, for the Navy, understanding how the cyberthreat environment is evolving is more complicated than for many other organizations because they have systems and networks on shore and afloat. Evans’ team is responsible for defending both.

He said a carrier strike group or an amphibious readiness group usually includes four to six NCDOC personnel to support 24/7 cyber coverage.

On shore, NCDOC — in the U.S. Fleet Cyber Command — supports Navy IT and operational technology needs. Overall, the command has just under 1,000 people.

Evans described the NCDOC’s two main types of defensive cyberspace operations:

• Intelligence-driven: The aim here is to stay ahead of the adversary.

“We are leveraging the exquisite intelligence apparatus of the U.S. government to gain insights into what the adversary may want to do based on what we’re seeing them do elsewhere around the world.”

• Incident-driven: In this instance, the command is responding to potential malicious cyber activity.

“We are responding and trying to generate the desired effects that you want out of that contact with the adversary. Sometimes there is a discussion about intelligence gain and loss, and there’s always this move through who has the right authorities, who has the right lead on these types of things depending upon what the nature of the incident is.”

Evans noted that the command currently has three major priorities in the Navy’s defensive cyber operations. The first is warfighting, with his team focused on protecting cyberspace and ensuring the service can operate in and through the cyber domain.

“That translates into potentially ships and lives for the Navy,” he said. Building resilience serves as the filter for the Navy’s investment decisions, ensuring resources are directed toward efforts that deliver operational outcomes and strengthen the service’s ability to counter adversaries.

His second priority is agility, given the constantly evolving cyber landscape. Evans said the Navy must be prepared to rapidly adjust to new vulnerabilities, emerging technologies and evolving adversary tactics.

“We have to have processes and a mindset that we are ready to adapt quickly to a change in our understanding of adversary tactics and techniques,” he said.

That adaptability also requires understanding how new technologies can be leveraged in ways the Navy may not have previously considered. “That’s how we’re trying to build the workforce and build in that ability to adapt and be agile.”

His third priority, or operational principle, is precision. Evans said the technical complexity and pace of the cyber domain require operators to quickly understand what is happening and clearly communicate its implications.

Ultimately, Evans said the command’s focus on warfighting, agility and precision reinforces the watchstanding principles that underpin the Navy’s defensive cyber operations.

“Whether you’re talking about operating a reactor and keeping it safe, or the precision that is required in the cyberspace domain, both domains require that unrelenting pursuit of the highest level of precision as you execute.”

Discover more articles and videos now on our Cyber Leaders Exchange 2026 event page.

Copyright © 2026 Federal News Network. All rights reserved. This website is not intended for users located within the European Economic Area.