H. R. 6523—192 
Subtitle B—Space Activities 
SEC. 911. INTEGRATED SPACE ARCHITECTURES. 
The Secretary of Defense and the Director of National Intel-
ligence shall develop an integrated process for national security 
space architecture planning, development, coordination, and anal-
ysis that— 
(1) encompasses defense and intelligence space plans, pro-
grams, budgets, and organizations; 
(2) provides mid-term to long-term recommendations to 
guide space-related defense and intelligence acquisitions, 
requirements, and investment decisions; 
(3) is independent of, but coordinated with, the space 
architecture planning, development, coordination, and analysis 
activities of each military department and each element of 
the intelligence community (as defined in section 3(4) of the 
National Security Act of 1947 (50 U.S.C. 401a(4))); and 
(4) makes use of, to the maximum extent practicable, joint 
duty assignment (as defined in section 668 of title 10, United 
States Code) positions. 
SEC. 912. LIMITATION ON USE OF FUNDS FOR COSTS OF TERMINATING 
CONTRACTS UNDER THE NATIONAL POLAR-ORBITING 
OPERATIONAL ENVIRONMENTAL SATELLITE SYSTEM PRO-
GRAM. 
None of the funds authorized to be appropriated or otherwise 
made available by this Act to the Secretary of Defense for the 
National 
Polar-Orbiting 
Operational 
Environmental 
Satellite 
System Program may be obligated or expended for the costs of 
terminating a contract awarded under the Program unless the 
Secretary of Defense and the Secretary of Commerce enter into 
an agreement under which the Secretary of Defense and the Sec-
retary of Commerce will each be responsible for half the costs 
of terminating the contract. 
SEC. 913. LIMITATION ON USE OF FUNDS FOR PURCHASING GLOBAL 
POSITIONING SYSTEM USER EQUIPMENT. 
(a) IN GENERAL.—Except as provided in subsections (b) and 
(c), none of the funds authorized to be appropriated or otherwise 
made available by this Act or any other Act for the Department 
of Defense may be obligated or expended to purchase user equip-
ment for the Global Positioning System during fiscal years after 
fiscal year 2017 unless the equipment is capable of receiving the 
military code (commonly known as the ‘‘M code’’) from the Global 
Positioning System. 
(b) EXCEPTION.—The limitation under subsection (a) shall not 
apply with respect to the purchase of passenger vehicles or commer-
cial vehicles in which Global Positioning System equipment is 
installed. 
(c) WAIVER.—The Secretary of Defense may waive the limitation 
under subsection (a) if the Secretary determines that— 
(1) suitable user equipment capable of receiving the mili-
tary code from the Global Positioning System is not available; 
or 
(2) with respect to a purchase of user equipment, the 
Department of Defense does not require that user equipment
H. R. 6523—193 
to be capable of receiving the military code from the Global 
Positioning System. 
SEC. 914. PLAN FOR INTEGRATION OF SPACE-BASED NUCLEAR DETEC-
TION SENSORS. 
(a) IN GENERAL.—The Secretary of Defense shall, in consulta-
tion with the Director of National Intelligence and the Adminis-
trator for Nuclear Security, submit to the congressional defense 
committees a plan to integrate space-based nuclear detection sen-
sors in a geosynchronous orbit on the Space-Based Infrared System 
or other satellite platforms. 
(b) LIMITATION
ON USE
OF FUNDS
FOR
THE SPACE-BASED 
INFRARED SYSTEM.— 
(1) IN GENERAL.—Not more than 90 percent of the amounts 
specified in paragraph (2) may be obligated or expended before 
the date on which the Secretary of Defense submits to the 
congressional defense committees the plan required by sub-
section (a). 
(2) AMOUNTS
SPECIFIED.—The amounts specified in this 
paragraph are the following: 
(A) The amount authorized to be appropriated by sec-
tion 103 for procurement for the Air Force for missiles 
for the Space-Based Infrared System. 
(B) The amount authorized to be appropriated by sec-
tion 201 for research, development, test, and evaluation 
for the Air Force for the Space-Based Infrared System. 
SEC. 915. PRESERVATION OF THE SOLID ROCKET MOTOR INDUSTRIAL 
BASE. 
(a) REPORT.—Not later than 180 days after the date of the 
enactment of this Act, the Secretary of Defense shall, in consultation 
with the Administrator of the National Aeronautics and Space 
Administration, submit to the appropriate committees of Congress 
a report on the impact of the cancellation of the Constellation 
program of the National Aeronautics and Space Administration 
on any anticipated next generation mission requirements for missile 
defense interceptors, tactical and strategic missiles, targets, and 
satellite and human spaceflight launch vehicles. 
(b) ELEMENTS.—The report required under subsection (a) shall 
include the following: 
(1) A description and assessment of the effects on Depart-
ment of Defense programs that utilize solid rocket motors of 
the cancellation of the Ares I, the Ares V, or their solid rocket 
alternatives or derivatives, and all supporting elements. 
(2) A description of the plans of the Department of Defense 
to mitigate the impact of the cancellation of the Ares I, the 
Ares V, or their solid rocket alternatives or derivatives, and 
all supporting elements, on the United States solid rocket motor 
industrial base, including a description of the National Aero-
nautics and Space Administration and Department of Defense 
funding required to implement such plans between fiscal years 
2012 and 2017. 
(3) A description of the impact of the cancellation of the 
Ares I, Ares V, or their solid rocket alternatives or derivatives, 
and all supporting elements, on international partners in pro-
grams such as the D–5 Trident missile. 
(4) A detailed description of the source of the data used 
in the report.
H. R. 6523—194 
(c) APPROPRIATE COMMITTEES OF CONGRESS DEFINED.—In this 
subsection, the term ‘‘appropriate committees of Congress’’ means— 
(1) the Committees on Armed Services, Commerce, Science, 
and Transportation, and Appropriations of the Senate; and 
(2) the Committees on Armed Services, Science and Tech-
nology, and Appropriations of the House of Representatives. 
SEC. 916. IMPLEMENTATION PLAN TO SUSTAIN SOLID ROCKET MOTOR 
INDUSTRIAL BASE. 
(a) IN GENERAL.—The Secretary of Defense shall develop an 
implementation plan to sustain the solid rocket motor industrial 
base that— 
(1) is based on the recommendations included in the report 
submitted to the congressional defense committees under sec-
tion 1078 of the National Defense Authorization Act for Fiscal 
Year 2010 (Public Law 111–84; 123 Stat. 2479); and 
(2) includes a funding plan for carrying out the implementa-
tion plan. 
(b) SUBMITTAL
TO
CONGRESS.—The implementation plan 
required by subsection (a) shall be submitted to Congress with 
the budget of the President for fiscal year 2012 as submitted under 
section 1105(a) of title 31, United States Code. 
SEC. 917. REVIEW AND PLAN ON SUSTAINMENT OF LIQUID ROCKET 
PROPULSION SYSTEMS INDUSTRIAL BASE. 
(a) IN GENERAL.—The Secretary of Defense shall, in consulta-
tion with the Administrator of the National Aeronautics and Space 
Administration, review, and develop a plan to sustain, the liquid 
rocket propulsion systems industrial base. 
(b) ELEMENTS.—The review and plan required by subsection 
(a) shall address the following: 
(1) The capacity to maintain currently available liquid 
rocket propulsion systems. 
(2) The maintenance of an intellectual and engineering 
capacity to support next generation liquid rocket propulsion 
systems and engines, as needed. 
(3) Opportunities for interagency collaboration and research 
and development on future propulsion systems. 
(c) SUBMITTAL TO CONGRESS.—Not later than 180 days after 
the date of the enactment of this Act, the Secretary shall submit 
to the congressional defense committees the plan required by sub-
section (a). 
Subtitle C—Intelligence-Related Matters 
SEC. 921. FIVE-YEAR EXTENSION OF AUTHORITY FOR SECRETARY OF 
DEFENSE TO ENGAGE IN COMMERCIAL ACTIVITIES AS 
SECURITY FOR INTELLIGENCE COLLECTION ACTIVITIES. 
The second sentence of section 431(a) of title 10, United States 
Code, is amended by striking ‘‘December 31, 2010’’ and inserting 
‘‘December 31, 2015’’. 
SEC. 922. MODIFICATION OF ATTENDEES AT PROCEEDINGS OF INTEL-
LIGENCE, 
SURVEILLANCE, 
AND 
RECONNAISSANCE 
INTEGRATION COUNCIL. 
(a) FINDINGS.—Section 923(a)(4) of the National Defense 
Authorization Act for Fiscal Year 2004 (Public Law 108–163; 117
H. R. 6523—195 
Stat. 1574; 10 U.S.C. 426 note) is amended by striking ‘‘National 
Foreign Intelligence Program (NFIP), Joint Military Intelligence 
Program (JMIP), and Tactical Intelligence and Related Activities 
Program (TIARA)’’ and inserting ‘‘National Intelligence Program 
(NIP) and a Military Intelligence Program (MIP)’’. 
(b) ADDITIONAL AUTHORIZED ATTENDEES.—Section 426(a) of title 
10, United States Code, is amended by adding at the end the 
following new paragraph: 
‘‘(4) Each Secretary of a military department may designate 
an officer or employee of such military department to attend the 
proceedings of the Council as a representative of such military 
department.’’. 
SEC. 923. REPORT ON DEPARTMENT OF DEFENSE INTERSERVICE 
MANAGEMENT 
AND 
COORDINATION 
OF 
REMOTELY 
PILOTED 
AIRCRAFT 
SUPPORT 
OF 
INTELLIGENCE, 
SURVEILLANCE, AND RECONNAISSANCE. 
(a) REPORT REQUIRED.— 
(1) REPORT
TO
SECRETARY
OF
DEFENSE
BY
CHIEFS
OF 
STAFF.—Not later than 120 days after the date of the enactment 
of this Act, the Chief of Staff of the Army, the Chief of Naval 
Operations, and the Chief of Staff of the Air Force shall jointly 
submit to the Secretary of Defense a report, in accordance 
with this section, on remotely piloted aircraft (RPA) support 
of intelligence, surveillance, and reconnaissance (ISR) within 
their respective Armed Forces. 
(2) TRANSMITTAL TO CONGRESS.—Not later than 30 days 
after the receipt of the report required by paragraph (1), the 
Secretary shall transmit the report, together with the assess-
ment and any recommendations of the Secretary (including 
the matters required pursuant to subsection (b)(2)), to the 
congressional defense committees. 
(b) ELEMENTS.—The report required by subsection (a) shall 
include the following: 
(1) In the case of the report required by subsection (a)(1), 
a description by each chief of staff referred to in that subsection 
of— 
(A) current and planned remotely piloted aircraft 
inventories to support intelligence, surveillance, and recon-
naissance requirements over the period 2011 to 2020, 
including an identification of systems each Armed Force 
considers organic and the systems capable of providing 
theater-level support to the commanders of the combatant 
commands; 
(B) policy and processes of each Armed Force for coordi-
nating investments in remotely piloted aircraft to meet 
joint force requirements for intelligence, surveillance, and 
reconnaissance and to eliminate unnecessary duplication 
in both development and capability; and 
(C) the current employment of remotely piloted aircraft 
by each Armed Force, including the number of remotely 
piloted aircraft deployed in support operations, the number 
of remotely piloted aircraft assigned for training, and the 
number of remotely piloted aircraft warehoused, the 
capacity of each Armed Force to process, exploit, and 
disseminate intelligence, surveillance, and reconnaissance 
data collected, and the extent to which assets are provided
H. R. 6523—196 
to the joint community to meet requirements of the combat-
ant commands. 
(2) In the case of the transmittal required by subsection 
(a)(2)— 
(A) an assessment of the effectiveness of the employ-
ment of remotely piloted aircraft by each Armed Force, 
and a description of the percentage of joint force require-
ments for intelligence, surveillance, and reconnaissance 
that are being met by the remotely piloted aircraft of 
each Armed Force; 
(B) a description of the joint concept of operations 
under which each Armed Force provides intelligence, 
surveillance, and reconnaissance capabilities through 
remotely piloted aircraft to meet the requirements of the 
combatant commands; 
(C) a description of the processes by which current 
requirements of the commanders of the combatant com-
mands for intelligence, surveillance, and reconnaissance 
are validated, and how the remotely piloted aircraft 
capabilities of each Armed Force are assigned against vali-
dated requirements; 
(D) a description of the current intelligence, surveil-
lance, and reconnaissance requirements of each combatant 
command through remotely piloted aircraft; 
(E) a description of how the requirements described 
under subparagraph (D) are being met; 
(F) an identification of any mission degradation or 
failure within the combatant commands due to lack of 
intelligence, surveillance, and reconnaissance support; 
(G) a description of various means of addressing any 
shortfalls in meeting the requirements described under 
subparagraph (D), including temporary shortfalls and 
permanent shortfalls; 
(H) a description of the organization of the Unmanned 
Aerial System Task Force, including the goals and objec-
tives of the task force and the participation and roles 
of each Armed Force within the task force; 
(I) a description of the organization of the Intelligence, 
Surveillance, and Reconnaissance Task Force, including 
the goals and objectives of the task force and the participa-
tion and roles of each Armed Force within the task force; 
and 
(J) an identification of any theater-level intelligence, 
surveillance, and reconnaissance capacity of an Armed 
Force that is not being made available by services to fulfill 
joint force requirements for intelligence, surveillance, and 
reconnaissance. 
(c) REMOTELY PILOTED AIRCRAFT DEFINED.—In this section, 
the term ‘‘remotely piloted aircraft’’ means any unmanned aircraft 
operated remotely, whether within or beyond line-of-sight, including 
unmanned aerial systems (UAS), unmanned aerial vehicles (UAV), 
remotely piloted vehicles (RPV), and remotely piloted aircraft (RPA).
H. R. 6523—197 
SEC. 924. REPORT ON REQUIREMENTS FULFILLMENT AND PERSONNEL 
MANAGEMENT RELATING TO AIR FORCE INTELLIGENCE, 
SURVEILLANCE, AND RECONNAISSANCE PROVIDED BY 
REMOTELY PILOTED AIRCRAFT. 
(a) REPORT REQUIRED.—Not later than 120 days after the date 
of the enactment of this Act, the Secretary of the Air Force shall, 
in coordination with the Under Secretary of Defense for Acquisition, 
Technology, and Logistics and the Under Secretary of Defense for 
Intelligence, submit to the appropriate committees of Congress a 
report on requirements fulfillment and personnel management in 
connection with Air Force intelligence, surveillance, and reconnais-
sance (ISR) provided by remotely piloted aircraft (RPA). 
(b) ELEMENTS.—The report required by subsection (a) shall 
include the following: 
(1) A description of the Joint Concept of Operation under 
which the Air Force operates to fulfill intelligence, surveillance, 
and reconnaissance requirements provided by remotely piloted 
aircraft. 
(2) A description of the current requirements of each 
combatant command for Air Force intelligence, surveillance, 
and reconnaissance provided by remotely piloted aircraft, 
including— 
(A) the number of orbits or combat air patrols for 
each major platform and sensor payload combination; 
(B) the number of aircraft, aircraft operators, and 
ground crews in each orbit or combat air patrol, variations 
in the numbers of each, and the explanation for such vari-
ations; 
(C) a description of how requirements are being met 
by the management of personnel, platforms, sensors, and 
networks; and 
(D) a description of various means of addressing any 
shortfalls in meeting such requirements, including tem-
porary shortfalls and permanent shortfalls. 
(3) A description of manpower management to fulfill Air 
Force mission requirements for intelligence, surveillance, and 
reconnaissance requirements provided by remotely piloted air-
craft, including the current number of personnel associated 
with each combat air patrol by remotely piloted aircraft for 
aircraft pilots, sensor operators, mission intelligence coordina-
tors, and processing, exploitation, and dissemination analysts 
(in this section referred to as ‘‘operators and analysts for 
remotely piloted aircraft’’). 
(4) A description of current Air Force manpower require-
ments for operators and analysts for remotely piloted aircraft, 
and any plans for meeting such requirements, including— 
(A) an identification of any shortfalls in personnel, 
skill specialties, and grades; and 
(B) any plans of the Air Force to address such short-
falls, including— 
(i) plans to address shortfalls in applicable career 
field retention rates; and 
(ii) plans for utilization of National Guard and 
other reserve component personnel to address short-
falls in such personnel, skill specialties, and grades.
H. R. 6523—198 
(5) A description of the projected Air Force manpower 
requirements for operators and analysts for remotely piloted 
aircraft in each of 2015 and 2020, including— 
(A) an identification of any significant challenges to 
achieving such requirements in particular skill specialties 
and grades; and 
(B) any plans of the Air Force to address such chal-
lenges. 
(6) A description of the collaboration of the Air Force with, 
and the reliance of the Air Force on, the other Armed Forces 
and the combat support agencies, in asset management for 
intelligence, surveillance, and reconnaissance by remotely 
piloted aircraft, including personnel for processing, exploitation, 
and dissemination. 
(7) A description of potential adverse consequences of oper-
ating intelligence, surveillance, and reconnaissance by remotely 
piloted aircraft, and associated intelligence support infrastruc-
ture, in a surge, understaffed state, or both, including— 
(A) the impact of having to provide forward processing, 
exploitation, and dissemination to support emerging 
capabilities; and 
(B) any plans of the Air Force to mitigate such con-
sequences. 
(8) A description of the status of Air Force training pro-
grams for operators and analysts for remotely piloted aircraft, 
including the ability to meet Air Force manpower requirements 
for such operators and analysts, and plans for increasing 
training capacity to match plans for expanding Air Force intel-
ligence, surveillance, and reconnaissance capabilities. 
(c) APPROPRIATE COMMITTEES OF CONGRESS DEFINED.—In this 
section, the term ‘‘appropriate committees of Congress’’ means— 
(1) the Committee on Armed Services, the Committee on 
Appropriations, and the Select Committee on Intelligence of 
the Senate; and 
(2) the Committee on Armed Services, the Committee on 
Appropriations, and the Permanent Select Committee on Intel-
ligence of the House of Representatives. 
Subtitle D—Cyber Warfare, Cyber 
Security, and Related Matters 
SEC. 931. CONTINUOUS MONITORING OF DEPARTMENT OF DEFENSE 
INFORMATION SYSTEMS FOR CYBERSECURITY. 
(a) IN GENERAL.—The Secretary of Defense shall direct the 
Chief Information Officer of the Department of Defense to work, 
in coordination with the Chief Information Officers of the military 
departments and the Defense Agencies and with senior cybersecu-
rity and information assurance officials within the Department 
of Defense and otherwise within the Federal Government, to 
achieve, to the extent practicable, the following: 
(1) The continuous prioritization of the policies, principles, 
standards, and guidelines developed under section 20 of the 
National Institute of Standards and Technology Act (15 U.S.C. 
278g–3) with agencies and offices operating or exercising control 
of national security systems (including the National Security 
Agency) based upon the evolving threat of information security
H. R. 6523—199 
incidents with respect to national security systems, the vulner-
ability of such systems to such incidents, and the consequences 
of information security incidents involving such systems. 
(2) The automation of continuous monitoring of the 
effectiveness of the information security policies, procedures, 
and practices within the information infrastructure of the 
Department of Defense, and the compliance of that infrastruc-
ture with such policies, procedures, and practices, including 
automation of— 
(A) management, operational, and technical controls 
of every information system identified in the inventory 
required under section 3505(c) of title 44, United States 
Code; and 
(B) management, operational, and technical controls 
relied on for evaluations under section 3545 of title 44, 
United States Code. 
(b) DEFINITIONS.—In this section: 
(1) The term ‘‘information security incident’’ means an 
occurrence that— 
(A) actually or potentially jeopardizes the confiden-
tiality, integrity, or availability of an information system 
or the information such system processes, stores, or trans-
mits; or 
(B) constitutes a violation or imminent threat of viola-
tion of security policies, security procedures, or acceptable 
use policies with respect to an information system. 
(2) The term ‘‘information infrastructure’’ means the under-
lying framework, equipment, and software that an information 
system and related assets rely on to process, transmit, receive, 
or store information electronically. 
(3) The term ‘‘national security system’’ has the meaning 
given that term in section 3542(b)(2) of title 44, United States 
Code. 
SEC. 932. STRATEGY ON COMPUTER SOFTWARE ASSURANCE. 
(a) STRATEGY
REQUIRED.—The Secretary of Defense shall 
develop and implement, by not later than October 1, 2011, a strategy 
for assuring the security of software and software-based applications 
for all covered systems. 
(b) COVERED SYSTEMS.—For purposes of this section, a covered 
system is any critical information system or weapon system of 
the Department of Defense, including the following: 
(1) A major system, as that term is defined in section 
2302(5) of title 10, United States Code. 
(2) A national security system, as that term is defined 
in section 3542(b)(2) of title 44, United States Code. 
(3) Any Department of Defense information system cat-
egorized as Mission Assurance Category I. 
(4) Any Department of Defense information system cat-
egorized as Mission Assurance Category II in accordance with 
Department of Defense Directive 8500.01E. 
(c) ELEMENTS.—The strategy required by subsection (a) shall 
include the following: 
(1) Policy and regulations on the following: 
(A) Software assurance generally. 
(B) Contract requirements for software assurance for 
covered systems in development and production.
H. R. 6523—200 
(C) Inclusion of software assurance in milestone 
reviews and milestone approvals. 
(D) Rigorous test and evaluation of software assurance 
in development, acceptance, and operational tests. 
(E) Certification and accreditation requirements for 
software assurance for new systems and for updates for 
legacy systems, including mechanisms to monitor and 
enforce reciprocity of certification and accreditation proc-
esses among the military departments and Defense Agen-
cies. 
(F) Remediation in legacy systems of critical software 
assurance deficiencies that are defined as critical in accord-
ance with the Application Security Technical Implementa-
tion Guide of the Defense Information Systems Agency. 
(2) Allocation of adequate facilities and other resources 
for test and evaluation and certification and accreditation of 
software to meet applicable requirements for research and 
development, systems acquisition, and operations. 
(3) Mechanisms for protection against compromise of 
information systems through the supply chain or cyber attack 
by acquiring and improving automated tools for— 
(A) assuring the security of software and software 
applications during software development; 
(B) detecting vulnerabilities during testing of software; 
and 
(C) detecting intrusions during real-time monitoring 
of software applications. 
(4) Mechanisms providing the Department of Defense with 
the capabilities— 
(A) to monitor systems and applications in order to 
detect and defeat attempts to penetrate or disable such 
systems and applications; and 
(B) to ensure that such monitoring capabilities are 
integrated into the Department of Defense system of cyber 
defense-in-depth capabilities. 
(5) An update to Committee for National Security Systems 
Instruction No. 4009, entitled ‘‘National Information Assurance 
Glossary’’, to include a standard definition for software security 
assurance. 
(6) Either— 
(A) mechanisms to ensure that vulnerable Mission 
Assurance Category III information systems, if penetrated, 
cannot be used as a foundation for penetration of protected 
covered systems, and means for assessing the effectiveness 
of such mechanisms; or 
(B) plans to address critical vulnerabilities in Mission 
Assurance Category III information systems to prevent 
their use for intrusions of Mission Assurance Category 
I systems and Mission Assurance Category II systems. 
(7) A funding mechanism for remediation of critical soft-
ware assurance vulnerabilities in legacy systems. 
(d) REPORT.—Not later than October 1, 2011, the Secretary 
of Defense shall submit to the congressional defense committees 
a report on the strategy required by subsection (a). The report 
shall include the following: 
(1) A description of the current status of the strategy 
required by subsection (a) and of the implementation of the
H. R. 6523—201 
strategy, including a description of the role of the strategy 
in the risk management by the Department regarding the 
supply chain and in operational planning for cyber security. 
(2) A description of the risks, if any, that the Department 
will accept in the strategy due to limitations on funds or other 
applicable constraints. 
SEC. 933. STRATEGY FOR ACQUISITION AND OVERSIGHT OF DEPART-
MENT OF DEFENSE CYBER WARFARE CAPABILITIES. 
(a) STRATEGY REQUIRED.—The Secretary of Defense, in con-
sultation with the Secretaries of the military departments, shall 
develop a strategy to provide for the rapid acquisition of tools, 
applications, and other capabilities for cyber warfare for the United 
States Cyber Command and the cyber operations components of 
the military departments. 
(b) BASIC ELEMENTS.—The strategy required by subsection (a) 
shall include the following: 
(1) An orderly process for determining and approving oper-
ational requirements. 
(2) A well-defined, repeatable, transparent, and disciplined 
process for developing capabilities to meet such requirements, 
in accordance with the information technology acquisition 
process developed pursuant to section 804 of the National 
Defense Authorization Act for Fiscal Year 2010 (Public Law 
111–84; 10 U.S.C. 2225 note). 
(3) The allocation of facilities and other resources to thor-
oughly test such capabilities in development, before deployment, 
and before use in order to validate performance and take into 
account collateral damage and other so-called second-order 
effects. 
(c) ADDITIONAL ELEMENTS.—The strategy required by sub-
section (a) shall also provide for the following: 
(1) Safeguards to prevent— 
(A) the circumvention of operational requirements and 
acquisition processes through informal relationships among 
the United States Cyber Command, the Armed Forces, 
the National Security Agency, and the Defense Information 
Systems Agency; and 
(B) the abuse of quick-reaction processes otherwise 
available for the rapid fielding of capabilities. 
(2) The establishment of reporting and oversight processes 
for requirements generation and approval for cyber warfare 
capabilities, the assignment of responsibility for providing 
capabilities to meet such requirements, and the execution of 
development and deployment of such capabilities, under the 
authority of the Chairman of the Joint Requirements Oversight 
Council, the Under Secretary of Defense for Policy, and other 
officials in the Office of the Secretary of Defense, as designated 
in the strategy. 
(3) The establishment and maintenance of test and evalua-
tion facilities and resources for cyber infrastructure to support 
research and development, operational test and evaluation, 
operational planning and effects testing, and training by repli-
cating or emulating networks and infrastructure maintained 
and operated by the military and political organizations of 
potential United States adversaries, by domestic and foreign
H. R. 6523—202 
telecommunications service providers, and by the Department 
of Defense. 
(4) An organization or organizations within the Department 
of Defense to be responsible for the operation and maintenance 
of cyber infrastructure for research, development, test, and 
evaluation purposes. 
(5) Appropriate disclosure regarding United States cyber 
warfare capabilities to the independent test and evaluation 
community, and the involvement of that community in the 
development and maintenance of such capabilities, regardless 
of classification. 
(6) The role of the private sector and appropriate Depart-
ment of Defense organizations in developing capabilities to 
operate in cyberspace, and a clear process for determining 
whether to allocate responsibility for responding to Department 
of Defense cyber warfare requirements through Federal Govern-
ment personnel, contracts with private sector entities, or a 
combination of both. 
(7) The roles of each military department, and of the combat 
support Defense Agencies, in the development of cyber warfare 
capabilities in support of offensive, defensive, and intelligence 
operational requirements. 
(8) Mechanisms to promote information sharing, coopera-
tive agreements, and collaboration with international, inter-
agency, academic, and industrial partners in the development 
of cyber warfare capabilities. 
(9) The manner in which the Department of Defense will 
promote interoperability, share innovation, and avoid unproduc-
tive duplication in cyber warfare capabilities through specializa-
tion among the components of the Department responsible for 
developing cyber capabilities. 
(d) REPORT ON STRATEGY.— 
(1) REPORT REQUIRED.—Not later than 180 days after the 
date of the enactment of this Act, the Secretary of Defense 
shall submit to the appropriate committees of Congress a report 
on the strategy required by subsection (a). The report shall 
include a comprehensive description of the strategy and plans 
(including a schedule) for the implementation of the strategy. 
(2) APPROPRIATE COMMITTEES OF CONGRESS DEFINED.—In 
this subsection, the term ‘‘appropriate committees of Congress’’ 
means— 
(A) the Committee on Armed Services, the Committee 
on Appropriations, and the Select Committee on Intel-
ligence of the Senate; and 
(B) the Committee on Armed Services, the Committee 
on Appropriations, and the Permanent Select Committee 
on Intelligence of the House of Representatives. 
SEC. 934. REPORT ON THE CYBER WARFARE POLICY OF THE DEPART-
MENT OF DEFENSE. 
(a) REPORT REQUIRED.—Not later than March 1, 2011, the 
Secretary of Defense shall submit to Congress a report on the 
cyber warfare policy of the Department of Defense. 
(b) ELEMENTS.—The report required under this section shall 
include the following: 
(1) A description of the policy and legal issues investigated 
and evaluated by the Department in considering the range
H. R. 6523—203 
of missions and activities that the Department may choose 
to conduct in cyberspace. 
(2) The decisions of the Secretary with respect to such 
issues, and the recommendations of the Secretary to the Presi-
dent for decisions on such of those issues as exceed the 
authority of the Secretary to resolve, together with the rationale 
and justification of the Secretary for such decisions and rec-
ommendations. 
(3) A description of the intentions of the Secretary with 
regard to modifying the National Military Strategy for Cyber-
space Operations. 
(4) The current use of, and potential applications of, mod-
eling and simulation tools to identify likely cybersecurity 
vulnerabilities, as well as new protective and remediation 
means, within the Department. 
(5) The application of modeling and simulation technology 
to develop strategies and programs to deter hostile or malicious 
activity intended to compromise Department information sys-
tems. 
(c) FORM.—The report required under this section shall be 
submitted in unclassified form, but may include a classified annex. 
SEC. 935. REPORTS ON DEPARTMENT OF DEFENSE PROGRESS IN 
DEFENDING THE DEPARTMENT AND THE DEFENSE INDUS-
TRIAL BASE FROM CYBER EVENTS. 
(a) REPORTS ON PROGRESS REQUIRED.—Not later than 180 days 
after the date of the enactment of this Act, and March 1 every 
year thereafter through 2015, the Secretary of Defense shall submit 
to the congressional defense committees a report on the progress 
of the Department of Defense in defending the Department and 
the defense industrial base from cyber events (such as attacks, 
intrusions, and theft). 
(b) ELEMENTS.—Each report under subsection (a) shall include 
the following: 
(1) In the case of the first report, a baseline for measuring 
the progress of the Department of Defense in defending the 
Department and the defense industrial base from cyber events, 
including definitions of significant cyber events, an appropriate 
categorization of various types of cyber events, the basic 
methods used in various cyber events, the vulnerabilities 
exploited in such cyber events, and the metrics to be utilized 
to determine whether the Department is or is not making 
progress against an evolving cyber threat. 
(2) An ongoing assessment of such baseline against key 
cyber defense strategies (described in subsection (c)) to deter-
mine implementation progress. 
(3)(A) A description of the nature and scope of significant 
cyber events against the Department and the defense industrial 
base during the preceding year, including, for each such event, 
a description of the intelligence or other Department data 
acquired, the extent of the corruption or compromise of Depart-
ment information or weapon systems, and the impact of such 
event on the Department generally and on operational capabili-
ties. 
(B) For any such event that has been investigated by 
or on behalf of the Damage Assessment Management Office,
H. R. 6523—204 
a synopsis of each damage assessment report, with emphasis 
on actions needing remediation. 
(4) A comparative assessment of the offensive cyber warfare 
capabilities of current representative potential United States 
adversaries and nations with advanced cyber warfare capabili-
ties with the capacity of the United States to defend— 
(A) military networks and mission capabilities; and 
(B) critical infrastructure. 
(5) A comparative assessment of the offensive cyber warfare 
capabilities of the United States with the capacity of current 
representative potential United States adversaries and nations 
with advanced cyber warfare capabilities to defend against 
cyber attacks. 
(6) A comparative assessment of the degree of dependency 
of current representative potential United States adversaries, 
nations with advanced cyber warfare capabilities, and the 
United States on networks that can be attacked through cyber-
space. 
(7) A description of known or suspected identified supply 
chain vulnerabilities, including known or suspected supply 
chain attacks, and actions to remediate such vulnerabilities. 
(c) KEY CYBER DEFENSE STRATEGIES.—For purposes of sub-
section (b)(2), key cyber defense strategies include the following: 
(1) Relevant valid Homeland Security Presidential Direc-
tives and National Security Presidential Directives. 
(2) The Comprehensive National Cybersecurity Initiative. 
(3) The National Military Strategy for Cyberspace Oper-
ations implementation plan. 
(d) PERFORMANCE OF CERTAIN ASSESSMENTS.—The comparative 
assessment of critical infrastructure required by subsection (b)(4)(B) 
shall be performed by the Secretary of Homeland Security, in 
coordination with the Secretary of Defense and the heads of other 
agencies of the Government with specific responsibility for critical 
infrastructure. 
(e) FORM.—Each report under this section shall be submitted 
in unclassified form, but may include a classified annex. 
Subtitle E—Other Matters 
SEC. 941. TWO-YEAR EXTENSION OF AUTHORITIES RELATING TO TEM-
PORARY WAIVER OF REIMBURSEMENT OF COSTS OF 
ACTIVITIES FOR NONGOVERNMENTAL PERSONNEL AT 
DEPARTMENT OF DEFENSE REGIONAL CENTERS FOR 
SECURITY STUDIES. 
(a) EXTENSION OF WAIVER.—Paragraph (1) of section 941(b) 
of the Duncan Hunter National Defense Authorization Act for Fiscal 
Year 2009 (Public Law 110–417; 122 Stat. 4577; 10 U.S.C. 184 
note) is amended by striking ‘‘fiscal years 2009 and 2010’’ and 
inserting ‘‘fiscal years 2009 through 2012’’. 
(b) ANNUAL REPORT.—Paragraph (3) of such section is amended 
by striking ‘‘in 2010 and 2011’’ and inserting ‘‘in each year through 
2013’’.