-- Within the context of any ongoing exchanges of hostilities, a hack attack has to be proportional. Moreover, it must be limited to military infrastructure and personnel and any civilians directly involved in the hostilities. If a hacker targets something that serves both military and civilian use, then it's considered a military hit by default, legitimizing the use of retaliatory force.
-- Hackers are not permitted to tweet specific cyber-threats with the intention of terrorizing civilians, but crying wolf about a perceived danger that happens to cause panic is OK. "OMG THE JUSTIN BIEBER CONCERT IS CANCELED" won't get you NATO-bombed.
-- You're not allowed to cause civilians to starve or die of thirst with your hacking. Emptying all the Fritos from the shelves of the local supermarket to fuel your 24/7 hacking activities is excluded.
-- Cyber-espionage gets a pass as long as you don't do it in enemy territory, in which case you'll be treated as a spy in accordance with the laws of the land, and perhaps even killed. That is, if you're not worth torturing first to extract information.
-- Cyber-espionage of private companies in other countries has nothing to do with NATO. Economic warfare (a no less important threat) will have to be handled through different channels.
Bottom line: Your attempts to hack the McDonald's gift card system to score a million Big Macs won't get you bombed by NATO. So relax, dude.