Programs and activities (including those governed by PPD-41), and the use of tools necessary to facilitate them, conducted on information systems, networks, or physical or virtual infrastructure by the owner or operator or with the consent of the owner or operator and, as appropriate, the user for the primary purpose of protecting (1) those information systems, networks, or physical or virtual infrastructure; or (2) data stored on, processed on, or transiting those information systems, networks, or physical or virtual infrastructure. Network Defense does not involve accessing or conducting activities on information systems, networks, or physical or virtual infrastructure without authorization from the owner or operator or exceeding access authorized by the owner or operator.
Sources:
CNSSI 4009-2022
from
NSPM-13