H. R. 5515—500 
(3) SPECIFICATION.—The Cybersecurity for Defense Indus-
trial Base Manufacturing Activity, if established, shall imple-
ment the requirements specified in subsections (a) through 
(c). 
(f) AUTHORITIES.—In carrying out this section, the Secretary 
may use the following authorities: 
(1) The Manufacturing Technology Program established 
under section 2521 of title 10, United States Code. 
(2) The Centers for Science, Technology, and Engineering 
Partnership program under section 2368 of title 10, United 
States Code. 
(3) The Manufacturing Engineering Education Program 
established under section 2196 of title 10, United States Code. 
(4) The Small Business Innovation Research program. 
(5) The mentor-prote´ge´ program. 
(6) Other legal authorities as the Secretary determines 
necessary to effectively and efficiently carry out this section. 
(g) DEFINITIONS.—In this section: 
(1) RESOURCES.—The term ‘‘resources’’ means guidelines, 
tools, best practices, standards, methodologies, and other ways 
of providing information. 
(2) SMALL BUSINESS CONCERN.—The term ‘‘small business 
concern’’ means a small business concern as that term is used 
in section 3 of the Small Business Act (15 U.S.C. 632). 
(3) SMALL
MANUFACTURER.—The term ‘‘small manufac-
turer’’ means a small business concern that is a manufacturer 
in the defense industrial supply chain. 
(4) STATE.—The term ‘‘State’’ means each of the several 
States, Territories, and possessions of the United States, the 
District of Columbia, and the Commonwealth of Puerto Rico. 
SEC. 1645. EMAIL AND INTERNET WEBSITE SECURITY AND AUTHEN-
TICATION. 
(a) IMPLEMENTATION OF PLAN REQUIRED.—Except as provided 
by subsection (b), the Secretary of Defense shall develop and imple-
ment the plan outlined in Binding Operational Directive 18–01, 
issued by the Secretary of Homeland Security on October 16, 2017, 
relating to email security and authentication and Internet website 
security, according to the schedule established by the Binding Oper-
ational Directive for the rest of the Executive Branch beginning 
with the date of enactment of this Act. 
(b) WAIVER.—The Secretary may waive the requirements of 
subsection (a) if the Secretary submits to the congressional defense 
committees, the Committee on Oversight and Government Reform 
of the House of Representatives, and the Committee on Homeland 
Security and Government Affairs of the Senate a certification that 
existing or planned security measures for the Department of 
Defense either meet or exceed the information security requirements 
of Binding Operational Directive 18–01. 
(c) FUTURE BINDING OPERATIONAL DIRECTIVES.—The Chief 
Information Officer of the Department of Defense shall notify the 
congressional defense committees, the Committee on Oversight and 
Government Reform of the House of Representatives, and the Com-
mittee on Homeland Security and Government Affairs of the Senate 
within 180 days of the issuance by the Secretary of Homeland 
Security after the date of the enactment of this Act of any Binding 
Operational Directive for cybersecurity whether the Department
H. R. 5515—501 
of Defense will comply with the Directive or how the Department 
of Defense plans to meet or exceed the security objectives of the 
Directive. 
SEC. 1646. SECURITY PRODUCT INTEGRATION FRAMEWORK. 
The Principal Cyber Adviser, the Chief Information Officer, 
and the Commander of the United States Cyber Command shall 
select a network or network segment and associated computer net-
work defense service provider to conduct a demonstration and 
evaluation of one or more existing security product integration 
frameworks, including modifying network security systems to enable 
such systems to ingest, publish, subscribe, tip and cue, and request 
information or services from each other. 
SEC. 1647. INFORMATION SECURITY CONTINUOUS MONITORING AND 
CYBERSECURITY SCORECARD. 
(a) LIMITATION.—After October 1, 2019, no funds may be obli-
gated or expended to prepare the cybersecurity scorecard for the 
Secretary of Defense unless the Department of Defense is imple-
menting a funded capability to meet the requirements— 
(1) established by the Chief Information Officer and the 
Commander of United States Cyber Command pursuant to 
section 1653 of the National Defense Authorization for Fiscal 
Year 2017 (Public Law 114–328; 10 U.S.C. 2224 note); and 
(2) as set forth in the Department of Defense’s policies 
on modernized, Department-wide automated information secu-
rity continuous monitoring. 
(b) REPORT.—Not later than January 10, 2019, the Director 
of Cost Assessment and Program Evaluation shall submit to the 
congressional defense committees a report— 
(1) comparing the current capabilities of the Department 
of Defense to— 
(A) the requirements described in subsection (a); 
(B) the capabilities deployed by the Department of 
Homeland Security and the General Services Administra-
tion under the Continuous Diagnostics and Mitigation pro-
gram across the non-Department of Defense departments 
and agencies of the Federal Government; and 
(2) that contains a review and determination of whether 
the current requirements and policies described in subsection 
(a) are adequate to address the current threat environment. 
(c) RISK THRESHOLDS.—The Chief Information Officer of the 
Department of Defense, in coordination with the Principal Cyber 
Advisor, the Director of Operations of the Joint Staff, and the 
Commander of United States Cyber Command, shall establish risk 
thresholds for systems and network operations that, when exceeded, 
would trigger heightened security measures, such as enhanced mon-
itoring and access policy changes. 
(d) ENTERPRISE GOVERNANCE, RISK, AND COMPLIANCE PLAN.— 
Not later than 180 days after the date of the enactment of this 
Act, the Chief Information Officer and the Principal Cyber Advisor 
shall develop a plan to implement an enterprise governance, risk, 
and compliance platform and process to maintain current status 
of all information and operational technology assets, vulnerabilities, 
threats, and mitigations.
H. R. 5515—502 
SEC. 1648. TIER 1 EXERCISE OF SUPPORT TO CIVIL AUTHORITIES FOR 
A CYBER INCIDENT. 
(a) IN GENERAL.—The Commander of the United States Cyber 
Command, the Commander of United States Northern Command, 
and such other commands or components of the Department of 
Defense as the Secretary of Defense considers appropriate, shall, 
consistent with the recommendations made by the Comptroller Gen-
eral of the United States in the Government Accountability Office 
report GAO–16–574, conduct a tier 1 exercise of support to civil 
authorities for a cyber incident. 
(b) ELEMENTS.—The exercise required by subsection (a) shall 
include the following: 
(1) Department level leadership and decision-making for 
providing cyber support to civil authorities. 
(2) Testing of the policy, guidance, doctrine and other ele-
ments in the Department of Defense Cyber Incident Coordi-
nating Procedure. 
(3) Operational planning and execution by the Joint Staff 
and supported and supporting combatant commands. 
(4) Coordination with, and incorporation of, as appropriate, 
the Department of Homeland Security, the Federal Bureau 
of Investigation, and elements across Federal and State govern-
ments and the private sector. 
SEC. 1649. PILOT PROGRAM ON MODELING AND SIMULATION IN SUP-
PORT OF MILITARY HOMELAND DEFENSE OPERATIONS 
IN CONNECTION WITH CYBER ATTACKS ON CRITICAL 
INFRASTRUCTURE. 
(a) PILOT PROGRAM REQUIRED.— 
(1) IN GENERAL.—The Assistant Secretary of Defense for 
Homeland Defense and Global Security shall carry out a pilot 
program to model cyber attacks on critical infrastructure in 
order to identify and develop means of improving Department 
of Defense responses to requests for defense support to civil 
authorities for such attacks. 
(2) RESEARCH EXERCISES.—The pilot program shall source 
data from and include consideration of the ‘‘Jack Voltaic’’ 
research exercises conducted by the Army Cyber Institute, 
industry partners of the Institute, and the cities of New York, 
New York, and Houston, Texas. 
(b) PURPOSE.—The purpose of the pilot program shall be to 
accomplish the following: 
(1) The development and demonstration of risk analysis 
methodologies, and the application of commercial simulation 
and modeling capabilities, based on artificial intelligence and 
hyperscale cloud computing technologies, as applicable— 
(A) 
to 
assess 
defense 
critical 
infrastructure 
vulnerabilities and interdependencies to improve military 
resiliency; 
(B) to determine the likely effectiveness of attacks 
described in subsection (a)(1), and countermeasures, tactics, 
and tools supporting responsive military homeland defense 
operations; 
(C) to train personnel in incident response; 
(D) to conduct exercises and test scenarios;
H. R. 5515—503 
(E) to foster collaboration and learning between and 
among departments and agencies of the Federal Govern-
ment, State and local governments, and private entities 
responsible for critical infrastructure; and 
(F) improve intra-agency and inter-agency coordination 
for consideration and approval of requests for defense sup-
port to civil authorities. 
(2) The development and demonstration of the foundations 
for establishing and maintaining a program of record for a 
shared high-fidelity, interactive, affordable, cloud-based mod-
eling and simulation of critical infrastructure systems and 
incident response capabilities that can simulate complex cyber 
and physical attacks and disruptions on individual and multiple 
sectors on national, regional, State, and local scales. 
(c) REPORT.— 
(1) IN GENERAL.—At the same time the budget of the Presi-
dent for fiscal year 2021 is submitted to Congress pursuant 
to section 1105(a) of title 31, United States Code, the Assistant 
Secretary shall, in consultation with the Secretary of Homeland 
Security, submit to the congressional defense committees a 
report on the pilot program. 
(2) CONTENTS.—The report required by paragraph (1) shall 
include the following: 
(A) A description of the results of the pilot program 
as of the date of the report. 
(B) A description of the risk analysis methodologies 
and modeling and simulation capabilities developed and 
demonstrated pursuant to the pilot program, and an assess-
ment of the potential for future growth of commercial tech-
nology in support of the homeland defense mission of the 
Department of Defense. 
(C) Such recommendations as the Secretary considers 
appropriate regarding the establishment of a program of 
record for the Department on further development and 
sustainment of risk analysis methodologies and advanced, 
large-scale modeling and simulation on critical infrastruc-
ture and cyber warfare. 
(D) Lessons learned from the use of novel risk analysis 
methodologies and large-scale modeling and simulation car-
ried out under the pilot program regarding vulnerabilities, 
required capabilities, and reconfigured force structure, 
coordination practices, and policy. 
(E) Planned steps for implementing the lessons 
described in subparagraph (D). 
(F) Any other matters the Secretary determines appro-
priate. 
SEC. 1650. PILOT PROGRAM AUTHORITY TO ENHANCE CYBERSECURITY 
AND RESILIENCY OF CRITICAL INFRASTRUCTURE. 
(a) AUTHORITY.—The Secretary of Defense, in coordination with 
the Secretary of Homeland Security, is authorized to provide, detail, 
or assign technical personnel to the Department of Homeland Secu-
rity on a non-reimbursable basis to enhance cybersecurity coopera-
tion, collaboration, and unity of Government efforts. 
(b) SCOPE OF ASSISTANCE.—The authority under subsection (a) 
shall be limited in any fiscal year to the provision of not more 
than 50 technical cybersecurity personnel from the Department