Alert Level Information

Alert Level Color Meanings

GREEN or LOW: Insignificant Threat Environment — Standard Operations

Threat Environment

• No known active campaigns targeting U.S. State, Local, Tribal, and Territorial (SLTT) government organizations.
• Background noise of opportunistic scanning and commodity malware is present but unremarkable.

Organizational Posture

• Standard watch.
• Routine monitoring, patching cycles, and awareness training are sufficient.
• No augmented staffing required.

Recommended Actions

• Maintain patching cadence.
• Complete scheduled training.
• Review access controls quarterly.
• Threat intelligence feeds on standard polling intervals.

BLUE or GUARDED: Increased Awareness — Potential Indicators Present

Threat Environment

• Credible threat intelligence suggests opportunistic targeting U.S. SLTTs.
• Peers reporting anomalous activity.

Organizational Posture

• Heightened vigilance.
• Increase monitoring frequency.
• Review recent threat intelligence.
• Confirm critical systems are patched.
• Incident response contacts refreshed.

Recommended Actions

• Audit externally exposed assets.
• Verify backups.
• Brief security team on relevant tactics, techniques, and procedures (TTPs).
• Increase log retention for critical systems.

YELLOW or ELEVATED: Credible Threat — Confirmed Adversary Activity

Threat Environment

• Threat actors with confirmed capability and intent are targeting specific U.S. SLTTs.
• TTPs are documented and publicly or privately disclosed.

Organizational Posture

• Active defense posture.
• Security Operations Center (SOC) operates at increased tempo.
• Threat hunting initiated.
• Leadership notified.
• Vendor and partner communications reviewed.

Recommended Actions

• Deploy threat-specific detections.
• Restrict or monitor high-risk access paths.
• Assess supply chain exposure.
• Review incident response (IR) plan.
• Prepare stakeholder communications.

ORANGE or HIGH: Active Threat — Direct Targeting or Confirmed Breach

Threat Environment

• Widespread U.S. SLTT impact.
• State-sponsored or sophisticated criminal actors are conducting operations against U.S. SLTT networks, supply chain, or partners.

Organizational Posture

• Incident response fully activated.
• Crisis team assembled.
• External IR support engaged if needed.
• Executive and board-level awareness required.

Recommended Actions

• Execute IR playbook.
• Isolate affected systems.
• Preserve forensic evidence.
• Notify relevant authorities and regulators.
• Prepare public or partner communications.

RED or SEVERE: Crisis — Systemic or Catastrophic Cyber Event

Threat Environment

• A coordinated, large-scale cyber attack is affecting multiple organizations, critical infrastructure, or government systems.
• National or sector-wide coordination is active.

Organizational Posture

• All hands.
• Mission-critical functions only.
• Maximum protective measures engaged across all systems.
• External coordination with government and sector partners required.

Recommended Actions

• Activate continuity of operations plan.
• Coordinate with federal government, partner information sharing and analysis centers (ISACs), and law enforcement.
• All non-essential systems offline or in minimum-footprint mode.