On October 01, 1995, the Navy augmented the Fleet Deception Groups (FLTDECGRUPAC and FLTDECGRULANT) with several other smaller commands and re-designated the assemblage as the Fleet Information Warfare Center (FIWC) - the Navy’s Center of Excellence for Information Operations (IO). SECNAV established the Naval Computer Incident Response Team (NAVCIRT) as a department of FIWC, reflecting the Information Warfare (IW) Manual and Joint Pub 3-13 modifications that added Information Assurance (IA) protection as a pillar of IO. NAVCIRT’s primary missions were incident handling and sensor monitoring for Navy.
In 1998, as a consequence of a computer network intrusion labeled “Solar Sunrise,” then Deputy Secretary of Defense, Mr. John Hamre, created a standing Joint Task Force for Computer Network Defense (JTF-CND) and directed each service to stand up a component force. Navy complied by creating a new command, the Navy Component Task Force for Computer Network Defense (NCTF-CND) on 31 Jan 1999. Residing in the Naval District in NW Washington DC, NCTF-CND was the operational commander for FIWC (NAVCIRT) to JTF-CND. In late 2000, JTF-CND became JTF-CNO (Computer Network Operations).
In May 2002, the Naval Network Warfare Command (NNWC) was established as a three-star flag headquarters and type commander of information operations, technology, and management, and assumed command of FIWC and NCTF-CND, among many others. In October 2002, the new Unified Command Plan, Change 2, re-aligned JTF-CNO under the United States Strategic Command (USSTRATCOM). After the signing of the Joint Concept of Operations for Global Information Grid Network Operations (GIG NetOps), JTF-CNO was later renamed JTF-GNO (Global Network Operations), responsible for directing the operation and defense of the GIG.
In Jan 2001, the newly released DODD 8530.1, Computer Network Defense, mandated that each service have a CND Service Provider (CNDSP). In June 2003, NAVCIRT separated from FIWC and merged with NCTF-CND, combining billets and mission, and was designated as the NAVCIRT Task Force. NAVCIRT was designated as CNDSP for Navy by DON CIO (212125Z NOV 2003). In March 2005, NAVCIRT was accredited as a Level 2 CNDSP by OSD, as required by DODI 8530.2, 2003.
On Jan 10, 2006, NAVCIRT became Navy Cyber Defense Operations Command (NCDOC), established as an Echelon IV command by OPNAV Note 5450, administratively and operationally subordinate to NNWC, and assigned as instantaneously TACON to JTF-GNO, which was responsible for overall management and conduct of computer network and systems defense.
Jan 2010, Fleet Cyber Command (FCC) was established as Navy Component Command to newly established United States Cyber Command (USCC), which was created by combining JTF-GNO and JFCC-NW, as a sub-unified command under STRATCOM. As a result, NCDOC was realigned from NNWC under operational control of FCC, and administrative control (ADCON) of Navy Cyber Forces (NCF), the newly established type commander. In 2011, NAVADMIN 130/11 realigned ADCON of NCDOC, and other shore activities, to FCC. In November 2013, NCDOC moved from JEB Little Creek, Virginia Beach, VA to Lake View Technology Park, Suffolk, VA. In October 2014, ADCON of NCDOC was shifted to the newly established Commander, Navy Information Dominance Forces, now renamed Navy Information Forces.
NCDOC started out as the IW-D (N63) Division of the Fleet Information Warfare Center (FIWC), located in two small rooms on the first deck of building 1126, Naval Amphibious Base Little Creek, Norfolk, VA. Outgrowing those spaces (a recurring theme in NCDOC history), they expanded to a double-wide trailer behind 1126 in the spring of 1997. Recognizing the need for growth, CAPT Marty Sherrard obtained the former SIMA Little Creek building across the street, building 1265, and converted it from a boat shop into a high-tech computer facility. Now the FIWC Operations Department (N3), they were the first occupants of 1265. As the N3 grew, it built out various 1265 spaces, including the Red Team Operations Center (ROC), Inferno (server room named in recognition of adminstrator Dante Deangelis), the Treehouse (2nd deck classroom), and Building in a Building (BIB) in one of the two former large painting bays. When NETWARCOM stood up, they moved into building 1265, and all FIWC personnel except N3 moved back to 1126. A major construction project in 2005 built out a combined NCDOC-NETWARCOM watch floor and operations space.
By 2011, building 1265 was bursting at the seams. It was now surrounded by 120 portable office units (aka trailers) to accomodate all the personnel. A roughly $85M MILCON project to accomodate NNWC, NCDOC, and NIOC-Norfolk had been proposed since the early 2000's, but not funded. With the shutdown of U.S. Joint Forces Command, Navy was left with 4 years remaining on the lease for 2 buildings in the Lake View Technology Park in Suffolk, VA, so the decision was made to move all 4 cyber commands in Little Creek (NCDOC, NNWC, FLTCYBERCOM (South), and NAVCYBERFOR to Suffolk.