Sunburst Vapor - A Cybersecurity Prompted Case Study of National-Scale Organizational Transformation

The National Guard Bureau’s (NGB) Sunburst Vapor response to the SolarWinds compromise in 2020 required an agile ad hoc response that included support from newly formed Cyber Protection Teams from states across the US. While this led to a new level of cyber capability, the NGB realized in after-action analysis, which included a report by the authors, that instead of organizing this new internal response team ad hoc, they created a new Cybersecurity Division that could dramatically increase the speed of response at this new level of capability. Based on embedded observation by the authors during the event and follow-up interviews with key personnel, this case study provides profiles of incident response load, organizational capacity, and analysis of the impetus to change. Included are diagrams of changes in organizational processes, mapping of structural relationships, and illustrations of the changes in incident response capabilities.