In future, a US president could consider economic sanctions, cyber-retaliation or a military strike if key US computer systems were attacked, officials have said recently.
The planning was given added urgency by a cyber-attack last month on the defence contractor, Lockheed Martin.
A new report from the Pentagon is due out in a matter of weeks.
"A response to a cyber-incident or attack on the US would not necessarily be a cyber-response. All appropriate options would be on the table," Pentagon spokesman Colonel Dave Lapan told reporters on Tuesday.
Mr Lapan confirmed the Pentagon was drawing up a cyber defence strategy, which would be ready in two to three weeks.
Cyber-attacks from foreign nations that threaten widespread US civilian casualties, like cutting off power supplies or shutting down emergency-responder networks, could be treated as an act of aggression under the new policy.