DECISION FACTORS AND DECISION CONTEXT FOR MILITARY COMMAND AUTHORITIES DURING CYBER INCIDENTS

Abstract

Cyber incident response in the interests of the military command authorities (MCA) of the Armed Forces of Ukraine takes place under time pressure, data incompleteness and mandatory coordination among several subjects of the national response system. For the MCA, the outcome is not the recording of an event's technical indicators but a prepared response decision that defines permitted and prohibited actions, their time windows, priorities and constraints. The current normative framework (Law of Ukraine No. 2163-VIII, the Cybersecurity Strategy of Ukraine, Resolutions of the Cabinet of Ministers of Ukraine No. 1471 and No. 1533 of November 2025) and international process models (NIST CSF 2.0, NIST SP 800-61 Rev. 3, the ISO/IEC 27035 series) regulate the response sequence in detail but do not treat the conditions of decision-making as a distinct object of description. As a result, different units may rely on divergent assumptions about constraints, priorities and consequences, which reduces the comparability of decisions even for technically similar incidents. The paper proposes a taxonomy of internal and external factors influencing decisions and a structure of the decision context as a consistent input-data package decomposed into mission context, policy constraints, asset context and threat intelligence. To reduce uncertainty, a status attribute (known, assumed, unknown) and artefact-based confirmation of key parameters are introduced, and traceability is supported by a role framework of subjects who form and approve context elements. A correspondence matrix "factor — context element — decision consequence" and a minimal artefact checklist are constructed as a practical instrument for preparing a decision within the response loop. The results separate the incident description from the decision-making conditions, improve the comparability of decisions for typical incident classes and form a terminological and conceptual basis for the subsequent justification of an assessment system of indicators and criteria. The proposed apparatus does not duplicate prioritization or alternative-selection models but precedes them by fixing the input conditions on which such models rely.