This 2022 RAND report documents case studies of cyber-espionage against the United State, and found limitations in current policymaker response to such incidents. While U.S. response options to cyber-espionage are not technically limited to the cyber domain, observed responses have been historically limited. This constraint has been imposed by the perceived norm of mutual espionage, but the lack of U.S. response has emboldened adversarial attacks. Though the U.S. is vulnerable to cyber-espionage, policymakers have found these breaches not to pose a significant national security threat. Current response options to cyber-espionage include government sanctions, targeted restrictions, diplomatic measures, law enforcement action, and both traditional military as well as cyber-offensive options. Over the past 20 years, these response options have stayed relatively consistent, if not becoming slightly more constrained as international tensions continue to increase. After examining several Russian cyber-enabled espionage and Chinese cyber-enabled espionage case studies from the late 1990s up to 2015, the report makes three overarching recommendations. Firstly, the U.S. should create clear guidelines for what constitutes acceptable conduct in cyberspace, and use diplomatic efforts to promote and enforce those norms. The U.S. should also defend protected networks more actively through pursuit of adversaries and employment of counterespionage tactics. Though preventing all cyber-breaches is impossible, these actions will reduce their impact on national security.