H. R. 3979—346 
(b) INCLUSION OF GAPS.—The report required under subsection 
(a) shall include specific gaps in policy and statute to address 
the requirements placed on the Department by section 907(c) of 
the National Defense Authorization Act for Fiscal Year 2014 (Public 
Law 113–66) and Executive Order 13587. 
(c) 
STRATEGY
FOR
MODERNIZING
PERSONNEL
SECURITY 
DEFINED.—In this section, the term ‘‘strategy for modernizing per-
sonnel security’’ means the strategy developed under section 907(c) 
of the National Defense Authorization Act for Fiscal Year 2014 
(Public Law 113–66). 
SEC. 1629. MIGRATION OF DISTRIBUTED COMMON GROUND SYSTEM 
OF DEPARTMENT OF THE ARMY TO AN OPEN SYSTEM 
ARCHITECTURE. 
(a) MIGRATION REQUIRED.—Not later than three years after 
the date of the enactment of this Act, the Secretary of the Army 
shall migrate the Distributed Common Ground System of the 
Department of the Army, including the Red Disk initiative under 
development at the Intelligence and Security Command, to an open 
system architecture to enable— 
(1) competitive acquisition of components, services, and 
applications for the Distributed Common Ground System; and 
(2) rapid competitive development and integration of new 
capabilities for the Distributed Common Ground System. 
(b) COMPLIANCE WITH OPEN SYSTEM ARCHITECTURE STAND-
ARDS.—In carrying out the migration required by subsection (a), 
the Secretary shall ensure that the Distributed Common Ground 
System— 
(1) is in compliance with the open system architecture 
standards developed under the Defense Intelligence Information 
Enterprise by the Under Secretary of Defense for Intelligence; 
and 
(2) reuses services and components of the Defense Intel-
ligence Information Enterprise. 
(c) OPEN SYSTEM ARCHITECTURE DEFINED.—In this section, the 
term ‘‘open system architecture’’ means, with respect to an informa-
tion technology system, an integrated business and technical 
strategy that— 
(1) employs a modular design and uses widely supported 
and consensus-based standards for key interfaces; 
(2) is subjected to successful validation and verification 
tests to ensure key interfaces comply with widely supported 
and consensus-based standards; and 
(3) uses a system architecture that allows components to 
be added, modified, replaced, removed, or supported by different 
vendors throughout the life-cycle of the system to afford 
opportunities for enhanced competition and innovation while 
yielding— 
(A) significant cost and schedule savings; and 
(B) increased interoperability. 
Subtitle C—Cyberspace-Related Matters 
SEC. 1631. BUDGETING AND ACCOUNTING FOR CYBER MISSION 
FORCES. 
(a) BUDGETING.—
H. R. 3979—347 
(1) IN GENERAL.—Chapter 9 of title 10, United States Code, 
is amended by adding at the end the following new section: 
‘‘§ 238. Cyber mission forces: program elements 
‘‘(a) BUDGET JUSTIFICATION DISPLAY.—The Secretary of Defense 
shall submit to Congress, as a part of the defense budget materials 
for fiscal year 2017 and each fiscal year thereafter, a budget jus-
tification display that includes— 
‘‘(1) a major force program category for the five-year defense 
plan of the Department of Defense for the training, manning, 
and equipping of the cyber mission forces; and 
‘‘(2) program elements for the cyber mission forces. 
‘‘(b) WAIVER.—The Secretary may waive the requirement under 
subsection (a) for fiscal year 2017 if the Secretary— 
‘‘(1) determines the Secretary is unable to comply with 
such requirement for fiscal year 2017; and 
‘‘(2) establishes a plan to implement the requirement for 
fiscal year 2018.’’. 
(2) TABLE OF SECTIONS.—The table of sections at the begin-
ning of chapter 9 of such title is amended by adding at the 
end the following new item: 
‘‘238. Cyber mission forces: program elements.’’. 
(b) ASSESSMENT
OF TRANSFER ACCOUNT
FOR CYBER ACTIVI-
TIES.— 
(1) IN GENERAL.—The Secretary shall assess the feasibility 
and advisability of establishing a transfer account to execute 
the funds contained in the major force program category 
required by subsection (a). 
(2) REPORT.— 
(A) IN GENERAL.—Not later than April 1, 2015, the 
Secretary shall submit to the congressional defense commit-
tees a report on the assessment carried out under para-
graph (1). 
(B) CONTENTS.—The report required by subparagraph 
(A) shall include the following: 
(i) The findings of the Secretary with respect to 
the assessment carried out under paragraph (1). 
(ii) A recommendation as to whether a transfer 
account should be established as described in such 
paragraph. 
SEC. 1632. REPORTING ON CYBER INCIDENTS WITH RESPECT TO NET-
WORKS AND INFORMATION SYSTEMS OF OPERATIONALLY 
CRITICAL CONTRACTORS. 
(a) REPORTING.—Part I of subtitle A of title 10, United States 
Code, is amended by inserting after chapter 18 the following new 
chapter: 
‘‘CHAPTER 19—CYBER MATTERS 
‘‘Sec. 
‘‘391. Reporting on cyber incidents with respect to networks and information sys-
tems of operationally critical contractors.
H. R. 3979—348 
‘‘§ 391. Reporting on cyber incidents with respect to networks 
and information systems of operationally critical 
contractors and certain other contractors 
‘‘(a) DESIGNATION
OF DEPARTMENT COMPONENT
TO RECEIVE 
REPORTS.—The Secretary of Defense shall designate a component 
of the Department of Defense to receive reports of cyber incidents 
from contractors in accordance with this section and with section 
941 of the National Defense Authorization Act for Fiscal Year 
2013 (10 U.S.C. 2224 note) or from other governmental entities. 
‘‘(b) PROCEDURES FOR REPORTING CYBER INCIDENTS.—The Sec-
retary of Defense shall establish procedures that require an oper-
ationally critical contractor to report in a timely manner to compo-
nent designated under subsection (a) each time a cyber incident 
occurs with respect to a network or information system of such 
operationally critical contractor. 
‘‘(c) PROCEDURE REQUIREMENTS.— 
‘‘(1) DESIGNATION
AND
NOTIFICATION.—The procedures 
established pursuant to subsection (a) shall include a process 
for— 
‘‘(A) designating operationally critical contractors; and 
‘‘(B) notifying a contractor that it has been designated 
as an operationally critical contractor. 
‘‘(2) RAPID REPORTING.—The procedures established pursu-
ant to subsection (a) shall require each operationally critical 
contractor to rapidly report to the component of the Department 
designated pursuant to subsection (d)(2)(A) on each cyber 
incident with respect to any network or information systems 
of such contractor. Each such report shall include the following: 
‘‘(A) An assessment by the contractor of the effect 
of the cyber incident on the ability of the contractor to 
meet the contractual requirements of the Department. 
‘‘(B) The technique or method used in such cyber 
incident. 
‘‘(C) A sample of any malicious software, if discovered 
and isolated by the contractor, involved in such cyber 
incident. 
‘‘(D) A summary of information compromised by such 
cyber incident. 
‘‘(3) DEPARTMENT ASSISTANCE AND ACCESS TO EQUIPMENT 
AND
INFORMATION
BY
DEPARTMENT
PERSONNEL.—The proce-
dures established pursuant to subsection (a) shall— 
‘‘(A) include mechanisms for Department personnel to, 
if requested, assist operationally critical contractors in 
detecting and mitigating penetrations; and 
‘‘(B) provide that an operationally critical contractor 
is only required to provide access to equipment or informa-
tion as described in subparagraph (A) to determine whether 
information created by or for the Department in connection 
with any Department program was successfully exfiltrated 
from a network or information system of such contractor 
and, if so, what information was exfiltrated. 
‘‘(4) PROTECTION OF TRADE SECRETS AND OTHER INFORMA-
TION.—The procedures established pursuant to subsection (a) 
shall provide for the reasonable protection of trade secrets, 
commercial or financial information, and information that can 
be used to identify a specific person.
H. R. 3979—349 
‘‘(5) DISSEMINATION
OF
INFORMATION.—The procedures 
established pursuant to subsection (a) shall limit the dissemina-
tion of information obtained or derived through the procedures 
to entities— 
‘‘(A) with missions that may be affected by such 
information; 
‘‘(B) that may be called upon to assist in the diagnosis, 
detection, or mitigation of cyber incidents; 
‘‘(C) that conduct counterintelligence or law enforce-
ment investigations; or 
‘‘(D) for national security purposes, including cyber 
situational awareness and defense purposes. 
‘‘(d) DEFINITIONS.—In this section: 
‘‘(1) CYBER
INCIDENT.—The term ‘cyber incident’ means 
actions taken through the use of computer networks that result 
in an actual or potentially adverse effect on an information 
system or the information residing therein. 
‘‘(2) OPERATIONALLY
CRITICAL
CONTRACTOR.—The term 
‘operationally critical contractor’ means a contractor designated 
by the Secretary for purposes of this section as a critical source 
of supply for airlift, sealift, intermodal transportation services, 
or logistical support that is essential to the mobilization, deploy-
ment, or sustainment of the Armed Forces in a contingency 
operation.’’. 
(b) ISSUANCE OF PROCEDURES.—The Secretary shall establish 
the procedures required by subsection (b) of section 391 of title 
10, United States Code, as added by subsection (a) of this section, 
not later than 90 days after the date of the enactment of this 
Act. 
(c) ASSESSMENT OF DEPARTMENT POLICIES.— 
(1) IN GENERAL.—Not later than 90 days after the date 
of the enactment of the Act, the Secretary of Defense shall 
complete an assessment of— 
(A) requirements that were in effect on the day before 
the date of the enactment of this Act for contractors to 
share information with Department components regarding 
cyber incidents (as defined in subsection (d) of such section 
391) with respect to networks or information systems of 
contractors; and 
(B) Department policies and systems for sharing 
information on cyber incidents with respect to networks 
or information systems of Department contractors. 
(2) ACTIONS FOLLOWING ASSESSMENT.—Upon completion of 
the assessment required by paragraph (1), the Secretary shall— 
(A) designate a Department component under sub-
section (a) of such section 391; and 
(B) issue or revise guidance applicable to Department 
components that ensures the rapid sharing by the compo-
nent designated pursuant to such section 391 or section 
941 of the National Defense Authorization Act for Fiscal 
Year 2013 (10 U.S.C. 2224 note) of information relating 
to cyber incidents with respect to networks or information 
systems of contractors with other appropriate Department 
components. 
(d) TABLE OF CHAPTERS AMENDMENT.—The table of chapters 
at the beginning of subtitle A of title 10, United States Code, 
and at the beginning of part I of such subtitle, are each amended
H. R. 3979—350 
by inserting after the item relating to chapter 18 the following 
new item: 
‘‘19. Cyber matters ............................................................................................
391’’. 
SEC. 1633. EXECUTIVE AGENTS FOR CYBER TEST AND TRAINING 
RANGES. 
(a) EXECUTIVE AGENT.—Chapter 19 of title 10, United States 
Code, as added by section 1632 of this Act, is amended by adding 
at the end the following new section: 
‘‘§ 392. Executive agents for cyber test and training ranges 
‘‘(a) EXECUTIVE AGENT.—The Secretary of Defense, in consulta-
tion with the Principal Cyber Advisor, shall— 
‘‘(1) designate a senior official from among the personnel 
of the Department of Defense to act as the executive agent 
for cyber and information technology test ranges; and 
‘‘(2) designate a senior official from among the personnel 
of the Department of Defense to act as the executive agent 
for cyber and information technology training ranges. 
‘‘(b) ROLES, RESPONSIBILITIES, AND AUTHORITIES.— 
‘‘(1) ESTABLISHMENT.—The Secretary of Defense shall pre-
scribe the roles, responsibilities, and authorities of the executive 
agents designated under subsection (a). Such roles, responsibil-
ities, and authorities shall include the development of a biennial 
integrated plan for cyber and information technology test and 
training resources. 
‘‘(2) BIENNIAL INTEGRATED PLAN.—The biennial integrated 
plan required under paragraph (1) shall include plans for the 
following: 
‘‘(A) Developing and maintaining a comprehensive list 
of cyber and information technology ranges, test facilities, 
test beds, and other means of testing, training, and devel-
oping software, personnel, and tools for accommodating 
the mission of the Department. Such list shall include 
resources from both governmental and nongovernmental 
entities. 
‘‘(B) Organizing and managing designated cyber and 
information technology test ranges, including— 
‘‘(i) establishing the priorities for cyber and 
information technology ranges to meet Department 
objectives; 
‘‘(ii) enforcing standards to meet requirements 
specified by the United States Cyber Command, the 
training community, and the research, development, 
testing, and evaluation community; 
‘‘(iii) identifying and offering guidance on the 
opportunities for integration amongst the designated 
cyber and information technology ranges regarding 
test, training, and development functions; 
‘‘(iv) finding opportunities for cost reduction, 
integration, and coordination improvements for the 
appropriate cyber and information technology ranges; 
‘‘(v) adding or consolidating cyber and information 
technology ranges in the future to better meet the 
evolving needs of the cyber strategy and resource 
requirements of the Department;
H. R. 3979—351 
‘‘(vi) finding opportunities to continuously enhance 
the quality and technical expertise of the cyber and 
information technology test workforce through training 
and personnel policies; and 
‘‘(vii) coordinating with interagency and industry 
partners on cyber and information technology range 
issues. 
‘‘(C) Defining a cyber range architecture that— 
‘‘(i) may add or consolidate cyber and information 
technology ranges in the future to better meet the 
evolving needs of the cyber strategy and resource 
requirements of the Department; 
‘‘(ii) coordinates with interagency and industry 
partners on cyber and information technology range 
issues; 
‘‘(iii) allows for integrated closed loop testing in 
a secure environment of cyber and electronic warfare 
capabilities; 
‘‘(iv) supports science and technology development, 
experimentation, testing and training; and 
‘‘(v) provides for interconnection with other 
existing cyber ranges and other kinetic range facilities 
in a distributed manner. 
‘‘(D) Certifying all cyber range investments of the 
Department of Defense. 
‘‘(E) Performing such other assessments or analyses 
as the Secretary considers appropriate. 
‘‘(3) STANDARD
FOR
CYBER
EVENT
DATA.—The executive 
agents designated under subsection (a), in consultation with 
the Chief Information Officer of the Department of Defense, 
shall jointly select a standard language from open-source can-
didates for representing and communicating cyber event and 
threat data. Such language shall be machine-readable for the 
Joint Information Environment and associated test and training 
ranges. 
‘‘(c) SUPPORT WITHIN DEPARTMENT OF DEFENSE.—The Secretary 
of Defense shall ensure that the military departments, Defense 
Agencies, and other components of the Department of Defense pro-
vide the executive agents designated under subsection (a) with 
the appropriate support and resources needed to perform the roles, 
responsibilities, and authorities of the executive agents. 
‘‘(d) COMPLIANCE WITH EXISTING DIRECTIVE.—The Secretary 
shall carry out this section in compliance with Directive 5101.1. 
‘‘(e) DEFINITIONS.—In this section: 
‘‘(1) The term ‘designated cyber and information technology 
range’ includes the National Cyber Range, the Joint Informa-
tion Operations Range, the Defense Information Assurance 
Range, and the C4 Assessments Division of J6 of the Joint 
Staff. 
‘‘(2) The term ‘Directive 5101.1’ means Department of 
Defense Directive 5101.1, or any successor directive relating 
to the responsibilities of an executive agent of the Department 
of Defense. 
‘‘(3) The term ‘executive agent’ has the meaning given 
the term ‘DoD Executive Agent’ in Directive 5101.1.’’. 
(b) DESIGNATION AND ROLES AND RESPONSIBILITIES.—The Sec-
retary of Defense shall—
H. R. 3979—352 
(1) not later than 120 days after the date of the enactment 
of this Act, designate the executive agents required under sub-
section (a) of section 392 of title 10, United States Code, as 
added by subsection (a) of this section; and 
(2) not later than one year after the date of the enactment 
of this Act, prescribe the roles, responsibilities, and authorities 
required under subsection (b) of such section 392. 
(c) SELECTION OF STANDARD LANGUAGE.—Not later than June 
1, 2015, the executive agents designated under subsection (a) of 
section 392 of title 10, United States Code, as added by subsection 
(a) of this section, shall select the standard language under sub-
section (b)(3) of such section 392. 
(d) TABLE OF SECTIONS AMENDMENT.—The table of sections 
at the beginning of chapter 19 of title 10, United States Code, 
as added by section 1632 of this Act, is amended by adding at 
the end the following new item: 
‘‘392. Executive agents for cyber test and training ranges.’’. 
SEC. 1634. CYBERSPACE MAPPING. 
(a) DESIGNATION OF NETWORK.—Not later than 60 days after 
the date of the enactment of this Act, the Secretary of Defense 
shall develop a plan to use a controlled laboratory environment 
or an existing network or network segment within the Department 
of Defense to identify network mapping capabilities to meet require-
ments of the United States Cyber Command. 
(b) RECOMMENDATIONS.—Not later than 180 days after the date 
of the enactment of this Act, the Principal Cyber Advisor shall 
submit to the Secretary policy recommendations regarding the map-
ping of cyberspace to support the operational requirements of the 
United States Cyber Command. 
SEC. 1635. REVIEW OF CROSS DOMAIN SOLUTION POLICY AND 
REQUIREMENT 
FOR 
CROSS 
DOMAIN 
SOLUTION 
STRATEGY. 
(a) REVIEW OF POLICY.—The Secretary of Defense shall review 
the policies and guidance of the Department of Defense concerning 
the procurement, approval, and use of cross domain solutions by 
the Department of Defense. 
(b) STRATEGY FOR CROSS DOMAIN SOLUTIONS.— 
(1) IN GENERAL.—Not later than 180 days after the date 
of the enactment of this Act, the Secretary shall develop a 
strategy for procurement, approval, and use of cross domain 
solutions by the Department. 
(2) ELEMENTS.—The strategy required by paragraph (1) 
shall include the following: 
(A) Identification and assessment of the current cross 
domain solutions in use throughout the Department of 
Defense, including the relative capabilities of such solutions 
and any gaps in current capabilities. 
(B) A determination of the requirements for cross 
domain solutions for enterprise applications as well as 
deployed warfighting operations, including operations with 
coalition partners. 
(C) A plan to enable verification of compliance with 
Department of Defense policies regarding the use of cross 
domain solutions.
H. R. 3979—353 
(D) A review of the current Department of Defense 
Information Assurance Certification and Accreditation 
Process for the applicability of such process to future 
virtualized cross domain technology. 
(E) A plan to meet the cross domain solution require-
ments for the Defense Intelligence Information Enterprise 
that must operate within the Joint Information Environ-
ment and the Intelligence Community Information Tech-
nology Environment. 
SEC. 1636. REQUIREMENT FOR STRATEGY TO DEVELOP AND DEPLOY 
DECRYPTION SERVICE FOR THE JOINT INFORMATION 
ENVIRONMENT. 
(a) STRATEGY
REQUIRED.—The Secretary of Defense shall 
develop a strategy to develop and deploy a decryption service that 
enables the efficient decryption and re-encryption of encrypted 
communications within the Joint Information Environment and 
through the Internet access points of the Joint Information Environ-
ment in a manner that allows the Secretary to inspect the content 
of such communications to detect cyber threats and insider threat 
activity. 
(b) ELEMENTS.—The strategy required developed pursuant to 
subsection (a) shall include the following: 
(1) Requirements. 
(2) An estimate of the cost. 
(3) An assessment of the added security benefit. 
(4) An architecture. 
(5) A concept of operations. 
(c) CONGRESSIONAL BRIEFING.—Not later than October 1, 2015, 
the Secretary shall brief the congressional defense committees and 
the congressional intelligence committees (as defined in section 
3 of the National Security Act of 1947 (50 U.S.C. 3003)) on the 
strategy developed under subsection (a). 
SEC. 1637. ACTIONS TO ADDRESS ECONOMIC OR INDUSTRIAL ESPIO-
NAGE IN CYBERSPACE. 
(a) REPORT REQUIRED.— 
(1) IN GENERAL.—Not later than 180 days after the date 
of the enactment of this Act, and annually thereafter through 
2020, the President shall submit to the appropriate congres-
sional committees a report on foreign economic and industrial 
espionage in cyberspace during the 12-month period preceding 
the submission of the report that— 
(A) identifies— 
(i) foreign countries that engage in economic or 
industrial espionage in cyberspace with respect to trade 
secrets or proprietary information owned by United 
States persons; 
(ii) foreign countries identified under clause (i) 
that the President determines engage in the most egre-
gious economic or industrial espionage in cyberspace 
with respect to such trade secrets or proprietary 
information (to be known as ‘‘priority foreign coun-
tries’’); 
(iii) categories of technologies or proprietary 
information developed by United States persons that— 
(I) are targeted for economic or industrial 
espionage in cyberspace; and
H. R. 3979—354 
(II) to the extent practicable, have been appro-
priated through such espionage; 
(iv) articles manufactured or otherwise produced 
using technologies or proprietary information described 
in clause (iii)(II); and 
(v) to the extent practicable, services provided 
using such technologies or proprietary information; 
(B) describes the economic or industrial espionage 
engaged in by the foreign countries identified under clauses 
(i) and (ii) of subparagraph (A); and 
(C) describes— 
(i) actions taken by the President to decrease the 
prevalence of economic or industrial espionage in cyber-
space; and 
(ii) the progress made in decreasing the prevalence 
of such espionage. 
(2) DETERMINATION OF FOREIGN COUNTRIES ENGAGING IN 
ECONOMIC OR INDUSTRIAL ESPIONAGE IN CYBERSPACE.—For pur-
poses of clauses (i) and (ii) of paragraph (1)(A), the President 
shall identify a foreign country as a foreign country that 
engages in economic or industrial espionage in cyberspace with 
respect to trade secrets or proprietary information owned by 
United States persons if the government of the foreign 
country— 
(A) engages in economic or industrial espionage in 
cyberspace with respect to trade secrets or proprietary 
information owned by United States persons; or 
(B) facilitates, supports, fails to prosecute, or otherwise 
permits such espionage by— 
(i) individuals who are citizens or residents of the 
foreign country; or 
(ii) entities that are organized under the laws of 
the foreign country or are otherwise subject to the 
jurisdiction of the government of the foreign country. 
(3) FORM OF REPORT.—Each report required by paragraph 
(1) shall be submitted in unclassified form but may contain 
a classified annex. 
(b) IMPOSITION OF SANCTIONS.— 
(1) IN GENERAL.—The President may, pursuant to the Inter-
national Emergency Economic Powers Act (50 U.S.C. 1701 et 
seq.), block and prohibit all transactions in all property and 
interests in property of each person described in paragraph 
(2), if such property and interests in property are in the United 
States, come within the United States, or are or come within 
the possession or control of a United States person. 
(2) PERSONS DESCRIBED.—A person described in this para-
graph is a foreign person the President determines knowingly 
requests, engages in, supports, facilitates, or benefits from the 
significant appropriation, through economic or industrial espio-
nage in cyberspace, of technologies or proprietary information 
developed by United States persons. 
(3) EXCEPTION.—The authority to impose sanctions under 
paragraph (1) shall not include the authority to impose sanc-
tions on the importation of goods. 
(4) IMPLEMENTATION; PENALTIES.— 
(A) IMPLEMENTATION.—The President may exercise all 
authorities provided under sections 203 and 205 of the