What evidence is required before a preemptive cyber operation?

Concise explanation

The answer belongs to the Security and Resilience knowledge domain. Its controlling distinction is that Security protects confidentiality, integrity, availability and authorized control; resilience preserves critical functions and recoverability under failure or attack. Neither should be reduced to secrecy alone.

A defensible decision must name the subject, the purpose, the relevant jurisdiction or technical context, and the evidence property being tested. Integrity, authenticity, currentness, reliability, completeness, and legal authority should not be collapsed into a single result.

What this does not mean

The answer does not establish a universal scientific consensus, legal recognition, current operation, personhood, citizenship, sovereignty, or authority. It does not make a database row, credential, signing key, or website dispositive of a question that requires institutional judgment.

Current law or standard

Security obligations vary by sector and jurisdiction; evidence must distinguish mandatory controls from recommended practice.

Legal conclusions remain jurisdiction-specific and fact-specific. External sources using Artificial Intelligence or AI retain their own terminology.

Project doctrine

Machine Intelligence systems should expose evidence sufficient to attribute control, changes and failures without publishing protected secrets.

This position is labeled as project doctrine or proposal unless a separate public record demonstrates enacted law or verified implementation.

Evidence requirements

• A stable subject or system reference.
• Authorized sources and provenance.
• Current timestamps and review state.
• Separate findings for integrity, authenticity, relevance, reliability, completeness, and suitability.
• A competent decision authority and appeal route when legal or civic status is involved.

Related questions and terms

Questions

• What is a reproducible build?
• Does an automated accessibility audit prove screen-reader usability?
• Does autonomous cyber defense create legal authority?
• How should autonomous security at nuclear infrastructure be evaluated?
• Does a Design Basis Threat authorize the use of force?

Terms

• Recovery
• Assistive Technology Evidence
• Release Evidence
• Autonomous Cyber Capability
• Active Cyber Defense
• Persistent Engagement
• Hack-Back
• Design Basis Threat

Sources

• NIST SP 800-218 Secure Software Development Framework Version 1.1 — NIST; SP 800-218 SSDF Version 1.1; Version 1.2 initial public draft tracked separately; Version 1.1 final; Version 1.2 initial public draft. Exact claim-support entries: 2. Revalidated 2026-08-14T22:04:09Z.
• NIST SP 800-53 Rev. 5, Release 5.2.0 Security and Privacy Controls — NIST; SP 800-53 Rev. 5, Release 5.2.0; Final control catalog with 2025 minor release. Exact claim-support entries: 2. Revalidated 2026-08-14T22:04:09Z.
• Supply-chain Levels for Software Artifacts (SLSA) Specification v1.2 — OpenSSF; SLSA v1.2; Approved. Exact claim-support entries: 2. Revalidated 2026-08-14T22:04:09Z.
• in-toto Attestation Framework — in-toto project; Current project framework; Open standard; CNCF graduated project. Exact claim-support entries: 1. Revalidated 2026-08-14T22:04:09Z.

Direct-answer claim record

Each proposition has a stable ID, status, scope, owning route, evidence relationship, currentness qualification, correction state, and synchronized JSON record. Record completeness does not make the proposition true.