30 to hinder software reverse engineering 31 and detection by antivirus or human analysts. 371. Digital forensics should be closely associated with cyber threat hunting. Deployable cyber defense 372. In some cases, when technical, operational or procedural issues do not allow cyber defense actions to be carried out remotely from the main cyber force facilities, part of the capabilities must be deployed to tackle specific defense, exploitation or attack situations. 373. The cyber force must have deployable cyber defense teams made up of personnel, means and procedures that are customizable (according to the mission) and transportable (by regular military or civilian means of transport, trained and prepared to deploy wherever required areas of operations, exercises, facilities or platforms in other domain of operations, critical infrastructure facilities, etc, in the shortest possible time, in order to reinforce existing cyber defense or handle urgent critical situations. 374. Deployable cyber defense teams must be able to be configured hastily, in a specific mode of operation, both in tools and personnel, according to the mission. The most common specific modes of operation are defensive (monitoring and security event management, audit, digital forensics and APT protection, while the exploitative and offensive modes could be provided occasionally. Technical capabilities 375. The cyber force must have capabilities to provide technical support to the command and operational capabilities, such as IT security audits, cyber range, technology observatory, research and development, arsenal, information security, and cryptography. IT security audit 376. Regarding information technology systems (IT systems) three main authorities must be differentiated the owner or operational authority, the administrator or technical authority and the person responsible for security or security authority.