It does not say what those responses will be. It does say acts that qualify for violent response include 'significant cyber attacks directed against the U.S. economy, government or military,' that the goal would be to "deny" the enemy any benefit from an attack and create enough offensive capability that anyone contemplating an attack against the U.S. would know doing so "would be taking a grave risk."
According to a May article in the Washington Post, approved cyber weapons include malware that will penetrate a foreign network and leave behind a virus that can launch on its own later (a la Stuxnet).
Any such attack or counterattack would require the permission of the president, would have to be proportional to the threat and would have to be effective against the enemy, but not impose undue damage on civilians or systems uninvolved in the attack.
What are you trying to defend?
The U.S. Cyber Command's report contained such broad definitions of the battle "domain" – the area within the Internet defined and defended by the United States – that nearly anything remotely connected to the Unites States would qualify as a target that could merit a counterattack.
Also unclear is the difference between an attack intended as an act of war and one that is an attempt at espionage.
The report didn't define the difference closely, but did say the two categories of digital mayhem each requires a different response.
The "Cyber Domain" includes telecom networks, the Internet, computer systems, processors, controllers or other systems in industries critical to the economy or defense of the U.S.
In a report to Congress last month, the Office of the National Counterintelligence Executive said Russia and China especially are aggressive in their espionage attacks on the U.S. and that the Pentagon has to be aggressive in responding to them.
If we can't stop you, we'll shoot you
The Pentagon is trying to build stronger defenses to stop frequent incursions from outside the country, and to build offensive abilities to deter attackers who realize there is little direct, immediate threat of violence or other downside to attacking the U.S. online.
That will take time, as will more detailed descriptions of tipping points, triggers, violations, offenses and other behavior that might trigger an electronic counter-response.