H. R. 5515—487 
associated resource profiles of the elements described in para-
graph (1) for purposes of preventing imbalances in priorities, 
insufficient or misaligned resources, and the unauthorized 
expansion of mission parameters. 
(b) ELEMENTS.—The framework required by subsection (a) shall 
include the following: 
(1) A lexicon of relevant terms used by the Department 
of Defense and the Office of the Director of National Intelligence 
that— 
(A) ensures consistent definitions are used in deter-
minations about the balance described in subsection (a)(1); 
and 
(B) reconciles jointly used definitions. 
(2) A reevaluation of the intelligence components of the 
Department, including the Joint Intelligence Centers and Joint 
Intelligence Operations Centers within the combatant com-
mands, in order to determine which components should be 
formally designated as part of the intelligence community and 
any components not so designated conform to relevant 
tradecraft standards. 
(3) A repeatable process of the Department for evaluating 
the addition, transfer, or elimination of defense intelligence 
missions, roles, and functions, currently or to be performed 
by elements described in subsection (a)(1) that includes— 
(A) a justification for any proposed addition, transfer, 
or elimination of a mission, role, or function; 
(B) the identification of the elements in the Federal 
Government, if any, that currently perform the mission, 
role, or function concerned; 
(C) for any proposed addition of a mission, role, or 
function, an assessment of the most appropriate element 
of the Department to assume it, taking into account current 
resource profiles, scope of existing responsibilities, primary 
customers, and infrastructure necessary to support the 
addition; and 
(D) for any proposed addition or transfer of a mission, 
role, or function— 
(i) a determination of the appropriate resource pro-
file for such mission, role, or function; and 
(ii) the identification, in writing, for the Depart-
ment elements concerned of the resources anticipated 
to be needed and source of such resources during the 
period covered by the future-years defense program 
submitted to Congress under section 221 of title 10, 
United States Code, as in effect at the time of the 
proposed addition or transfer. 
(c) BRIEFING.—Not later than 180 days after the date of the 
enactment of this Act, the Secretary, in coordination with the 
Director, shall provide to the Committees on Armed Services of 
the House of Representatives and the Senate, and to any other 
appropriate congressional committee upon request, a briefing on 
the framework required by subsection (a). 
(d) POLICY.—Not later than 270 days after the date of the 
enactment of this Act, the Secretary, in coordination with the 
Director, shall submit to the appropriate congressional committees 
a report setting forth the policy establishing the framework required 
by subsection (a).
H. R. 5515—488 
(e) DEFINITIONS.—In this section: 
(1) The term ‘‘appropriate congressional committees’’ 
means— 
(A) the Committee on Armed Services, the Committee 
on Appropriations, and the Select Committee on Intel-
ligence of the Senate; and 
(B) the Committee on Armed Services, the Committee 
on Appropriations, and the Permanent Select Committee 
on Intelligence of the House of Representatives. 
(2) The term ‘‘combat support agency’’ has the meaning 
given that term in section 193 of title 10, United States Code. 
(3) The term ‘‘intelligence community’’ has the meaning 
given that term in section 3(4) of the National Security Act 
of 1947 (50 U.S.C. 3003(4)). 
Subtitle C—Cyberspace-Related Matters 
SEC. 1631. REORGANIZATION AND CONSOLIDATION OF CERTAIN 
CYBER PROVISIONS. 
(a) IN GENERAL.—Part I of subtitle A of title 10, United States 
Code, is amended— 
(1) by transferring sections 130g, 130j, and 130k to chapter 
19 of such part to appear after section 393 of such chapter; 
and 
(2) by redesignating such sections 130g, 130j, and 130k, 
as transferred by paragraph (1), as sections 394, 395, and 
396, respectively. 
(b) CONFORMING AMENDMENT.—Section 108(m) of the Cyberse-
curity Information Sharing Act of 2015 (6 U.S.C. 1507(m)) is 
amended by striking ‘‘under section 130g’’ and inserting ‘‘under 
section 394’’. 
(c) CLERICAL AMENDMENTS.—(1) The table of sections at the 
beginning of chapter 3 of title 10, United States Code, is amended 
by striking the items relating to sections 130g, 130j, and 130k. 
(2) The table of sections at the beginning of chapter 19 of 
such title is amended by adding at the end the following new 
items: 
‘‘394. Authorities concerning military cyber operations. 
‘‘395. Notification requirements for sensitive military cyber operations. 
‘‘396. Notification requirements for cyber weapons.’’. 
SEC. 1632. AFFIRMING THE AUTHORITY OF THE SECRETARY OF 
DEFENSE TO CONDUCT MILITARY ACTIVITIES AND OPER-
ATIONS IN CYBERSPACE. 
Section 394 of title 10, United States Code (as transferred 
and redesignated pursuant to section 1631), is amended— 
(1) by striking ‘‘The Secretary’’ and inserting the following: 
‘‘(a) IN GENERAL.—The Secretary’’; 
(2) in subsection (a), as designated by paragraph (1)— 
(A) by striking ‘‘conduct, a military cyber operation 
in response’’ and inserting ‘‘conduct, military cyber activi-
ties or operations in cyberspace, including clandestine mili-
tary activities or operations in cyberspace, to defend the 
United States and its allies, including in response’’; and
H. R. 5515—489 
(B) by striking ‘‘(as such terms are defined in section 
101 of the Foreign Intelligence Surveillance Act of 1978 
(50 U.S.C. 1801))’’; and 
(3) by adding at the end the following new subsections: 
‘‘(b) AFFIRMATION OF AUTHORITY.—Congress affirms that the 
activities or operations referred to in subsection (a), when appro-
priately authorized, include the conduct of military activities or 
operations in cyberspace short of hostilities (as such term is used 
in the War Powers Resolution (Public Law 93–148; 50 U.S.C. 1541 
et seq.)) or in areas in which hostilities are not occurring, including 
for the purpose of preparation of the environment, information 
operations, force protection, and deterrence of hostilities, or counter-
terrorism operations involving the Armed Forces of the United 
States. 
‘‘(c) CLANDESTINE ACTIVITIES OR OPERATIONS.—A clandestine 
military activity or operation in cyberspace shall be considered 
a traditional military activity for the purposes of section 503(e)(2) 
of the National Security Act of 1947 (50 U.S.C. 3093(e)(2)). 
‘‘(d) CONGRESSIONAL OVERSIGHT.—The Secretary shall brief the 
congressional defense committees about any military activities or 
operations in cyberspace, including clandestine military activities 
or operations in cyberspace, occurring during the previous quarter 
during the quarterly briefing required by section 484 of this title. 
‘‘(e) RULE OF CONSTRUCTION.—Nothing in this section may be 
construed to limit the authority of the Secretary to conduct military 
activities or operations in cyberspace, including clandestine military 
activities or operations in cyberspace, to authorize specific military 
activities or operations, or to alter or otherwise affect the War 
Powers Resolution (50 U.S.C. 1541 et seq.), the Authorization for 
Use of Military Force (Public Law 107–40; 50 U.S.C. 1541 note), 
or reporting of sensitive military cyber activities or operations 
required by section 395 of this title. 
‘‘(f) DEFINITIONS.—In this section: 
‘‘(1) The term ‘clandestine military activity or operation 
in cyberspace’ means a military activity or military operation 
carried out in cyberspace, or associated preparatory actions, 
authorized by the President or the Secretary that— 
‘‘(A) is marked by, held in, or conducted with secrecy, 
where the intent is that the activity or operation will 
not be apparent or acknowledged publicly; and 
‘‘(B) is to be carried out— 
‘‘(i) as part of a military operation plan approved 
by the President or the Secretary in anticipation of 
hostilities or as directed by the President or the Sec-
retary; 
‘‘(ii) to deter, safeguard, or defend against attacks 
or malicious cyber activities against the United States 
or Department of Defense information, networks, sys-
tems, installations, facilities, or other assets; or 
‘‘(iii) in support of information related capabilities. 
‘‘(2) The term ‘foreign power’ has the meaning given such 
term in section 101 of the Foreign Intelligence Surveillance 
Act of 1978 (50 U.S.C. 1801). 
‘‘(3) The term ‘United States person’ has the meaning given 
such term in such section.’’.
H. R. 5515—490 
SEC. 1633. DEPARTMENT OF DEFENSE CYBER SCHOLARSHIP PROGRAM 
SCHOLARSHIPS AND GRANTS. 
(a) ADDITIONAL CONSIDERATIONS.—Section 2200c of title 10, 
United States Code, is amended— 
(1) by inserting before ‘‘In the selection’’ the following: 
‘‘(a) CENTERS
OF
ACADEMIC
EXCELLENCE
IN
CYBER
EDU-
CATION.—’’; and 
(2) by adding at the end the following new subsection: 
‘‘(b) CERTAIN INSTITUTIONS
OF HIGHER EDUCATION.—In the 
selection of a recipient for the award of a scholarship or grant 
under this chapter, consideration shall be given to whether— 
‘‘(1) in the case of a scholarship, the institution of higher 
education at which the recipient pursues a degree is an institu-
tion described in section 371(a) of the Higher Education Act 
of 1965 (20 U.S.C. 1067q(a)); and 
‘‘(2) in the case of a grant, the recipient is an institution 
described in such section.’’. 
(b) CLERICAL AMENDMENTS.— 
(1) SECTION HEADING.—The heading of section 2200c of 
title 10, United States Code, is amended to read as follows: 
‘‘§ 2200c. Special considerations in awarding scholarships 
and grants’’. 
(2) TABLE OF SECTIONS.—The table of sections at the begin-
ning of chapter 112 of title 10, United States Code, is amended 
by striking the item relating to section 2200c and inserting 
the following new item: 
‘‘2200c. Special considerations in awarding scholarships and grants.’’. 
SEC. 1634. AMENDMENTS TO PILOT PROGRAM REGARDING CYBER 
VULNERABILITIES OF DEPARTMENT OF DEFENSE CRIT-
ICAL INFRASTRUCTURE. 
Subsection (b) of section 1650 of the National Defense 
Authorization Act for Fiscal Year 2017 (10 U.S.C. 2224 note) is 
amended— 
(1) in paragraph (1), in the matter preceding subparagraph 
(A), by inserting ‘‘and the Defense Digital Service’’ after ‘‘cov-
ered research laboratory’’; 
(2) in paragraph (4), in the matter preceding subparagraph 
(A), by striking ‘‘2019’’ and inserting ‘‘2020’’; and 
(3) in paragraph (5), by striking ‘‘2019’’ and inserting 
‘‘2020’’. 
SEC. 1635. MODIFICATION OF ACQUISITION AUTHORITY OF THE COM-
MANDER OF THE UNITED STATES CYBER COMMAND. 
(a) MODIFICATION OF LIMITATION ON USE OF CYBER OPERATIONS 
PROCUREMENT FUND.—Subsection (e) of section 807 of the National 
Defense Authorization Act for Fiscal Year 2016 (Public Law 114– 
92; 10 U.S.C. 2224 note) is amended by striking ‘‘2021’’ and inserting 
‘‘2025’’. 
(b) EXTENSION ON SUNSET.—Subsection (i)(1) of such section 
is amended by striking ‘‘September 30, 2021’’ and inserting ‘‘Sep-
tember 30, 2025’’.
H. R. 5515—491 
SEC. 1636. POLICY OF THE UNITED STATES ON CYBERSPACE, CYBERSE-
CURITY, CYBER WARFARE, AND CYBER DETERRENCE. 
(a) IN GENERAL.—It shall be the policy of the United States, 
with respect to matters pertaining to cyberspace, cybersecurity, 
and cyber warfare, that the United States should employ all 
instruments of national power, including the use of offensive cyber 
capabilities, to deter if possible, and respond to when necessary, 
all cyber attacks or other malicious cyber activities of foreign powers 
that target United States interests with the intent to— 
(1) cause casualties among United States persons or per-
sons of United States allies; 
(2) significantly disrupt the normal functioning of United 
States democratic society or government (including attacks 
against critical infrastructure that could damage systems used 
to provide key services to the public or government); 
(3) threaten the command and control of the Armed Forces, 
the freedom of maneuver of the Armed Forces, or the industrial 
base or other infrastructure on which the United States Armed 
Forces rely to defend United States interests and commitments; 
or 
(4) achieve an effect, whether individually or in aggregate, 
comparable to an armed attack or imperil a vital interest of 
the United States. 
(b) RESPONSE OPTIONS.—In carrying out the policy set forth 
in subsection (a), the United States shall plan, develop, and, when 
appropriate, demonstrate response options to address the full range 
of potential cyber attacks on United States interests that could 
be conducted by potential adversaries of the United States. 
(c) DENIAL OPTIONS.—In carrying out the policy set forth in 
subsection (a) through response options developed pursuant to sub-
section (b), the United States shall, to the greatest extent prac-
ticable, prioritize the defensibility and resiliency against cyber 
attacks and malicious cyber activities described in subsection (a) 
of infrastructure critical to the political integrity, economic security, 
and national security of the United States. 
(d) COST-IMPOSITION OPTIONS.—In carrying out the policy set 
forth in subsection (a) through response options developed pursuant 
to subsection (b), the United States shall develop and, when appro-
priate, demonstrate, or otherwise make known to adversaries the 
existence of, cyber capabilities to impose costs on any foreign power 
targeting the United States or United States persons with a cyber 
attack or malicious cyber activity described in subsection (a). 
(e) MULTI-PRONG RESPONSE.—In carrying out the policy set 
forth in subsection (a) through response options developed pursuant 
to subsection (b), the United States shall leverage all instruments 
of national power. 
(f) UPDATE ON PRESIDENTIAL POLICY.— 
(1) IN GENERAL.—Not later than 180 days after the date 
of the enactment of this Act, the President shall transmit, 
in unclassified and classified forms, as appropriate, to the 
appropriate congressional committees a report containing an 
update to the report provided to the Congress on the policy 
of the United States on cyberspace, cybersecurity, and cyber 
warfare pursuant to section 1633 of the National Defense 
Authorization Act for Fiscal Year 2018 (Public Law 115–91; 
10 U.S.C. 130g note).
H. R. 5515—492 
(2) CONTENTS.—The report required under paragraph (1) 
shall include the following: 
(A) An assessment of the current posture in cyberspace, 
including assessments of— 
(i) whether past responses to major cyber attacks 
have had the desired deterrent effect; and 
(ii) how adversaries have responded to past United 
States responses. 
(B) Updates on the Administration’s efforts in the 
development of— 
(i) cost imposition strategies; 
(ii) varying levels of cyber incursion and steps 
taken to date to prepare for the imposition of the 
consequences referred to in clause (i); and 
(iii) the Cyber Deterrence Initiative. 
(C) Information relating to the Administration’s plans, 
including specific planned actions, regulations, and legisla-
tive action required, for— 
(i) advancing technologies in attribution, inher-
ently secure technology, and artificial intelligence 
society-wide; 
(ii) improving cybersecurity in and cooperation 
with the private sector; 
(iii) improving international cybersecurity coopera-
tion; and 
(iv) implementing the policy referred to in para-
graph (1), including any realignment of government 
or government responsibilities required, writ large. 
(f) RULE OF CONSTRUCTION.—Nothing in this subsection may 
be construed to limit the authority of the President or Congress 
to authorize the use of military force. 
(g) DEFINITIONS.—In this section: 
(1) APPROPRIATE CONGRESSIONAL COMMITTEES.—The term 
‘‘appropriate congressional committees’’ means— 
(A) the congressional defense committees; 
(B) the Permanent Select Committee on Intelligence 
of the House of Representatives; 
(C) the Select Committee on Intelligence of the Senate; 
(D) the Committee on Foreign Affairs, the Committee 
on Homeland Security, and the Committee on the Judiciary 
of the House of Representatives; and 
(E) the Committee on Foreign Relations, the Com-
mittee on Homeland Security and Governmental Affairs, 
and the Committee on the Judiciary of the Senate. 
(2) FOREIGN POWER.—The term ‘‘foreign power’’ has the 
meaning given such term in section 101 of the Foreign Intel-
ligence Surveillance Act of 1978 (50 U.S.C. 1801). 
SEC. 1637. BUDGET DISPLAY FOR CYBER VULNERABILITY EVALUA-
TIONS AND MITIGATION ACTIVITIES FOR MAJOR WEAPON 
SYSTEMS OF THE DEPARTMENT OF DEFENSE. 
(a) BUDGET REQUIRED.—Beginning in fiscal year 2021 and in 
each fiscal year thereafter, the Secretary of Defense shall submit 
to Congress, as a part of the documentation that supports the
H. R. 5515—493 
President’s annual budget for the Department of Defense, a consoli-
dated Cyber Vulnerability Evaluation and Mitigation budget jus-
tification display for each major weapons system of the Department 
of Defense that includes the following: 
(1) CYBER VULNERABILITY EVALUATIONS.— 
(A) STATUS.—Whether, in accordance with paragraph 
(1) of section 1647(a) of the National Defense Authorization 
Act for Fiscal Year 2016 (Public Law 114–92; 129 Stat. 
1118), the cyber vulnerability evaluation for each such 
major weapon system is pending, in progress, complete, 
or, pursuant to paragraph (2) of such section, waived. 
(B) FUNDING.—The funding required for the fiscal year 
with respect to which the budget is submitted and for 
at least the four succeeding fiscal years required to com-
plete the pending or in progress cyber vulnerability evalua-
tion of each such major weapon system. 
(C) DESCRIPTION.—A description of the activities 
planned in the fiscal year with respect to which the budget 
is submitted and at least the four succeeding fiscal years 
to complete the required evaluation for each such major 
weapon system. 
(D) RISK
ANALYSIS.—A description of operational or 
security risks associated with cyber vulnerabilities identi-
fied as a result of such cyber vulnerability evaluations 
that require mitigation. 
(2) MITIGATION ACTIVITIES.— 
(A) STATUS.—Whether activities to address identified 
cyber vulnerabilities of such major weapon systems 
resulting in operational or security risks requiring mitiga-
tion are pending, in progress, or complete. 
(B) FUNDING.—The funding required for the fiscal year 
with respect to which the budget is submitted and for 
at least the four succeeding fiscal years required to com-
plete the pending or in progress mitigation activities 
referred to in subparagraph (A) related to such major 
weapon systems. 
(C) DESCRIPTION.—A description of the activities 
planned in the fiscal year with respect to which the budget 
is submitted and at least the four succeeding fiscal years 
to complete any necessary mitigation. 
(b) FORM.—The display required under subsection (a) should, 
to the extent practicable, be submitted in an unclassified form, 
and shall include a classified annex as required. 
SEC. 1638. DETERMINATION OF RESPONSIBILITY FOR THE DEPART-
MENT OF DEFENSE INFORMATION NETWORKS. 
(a) IN GENERAL.—Not later than March 1, 2019, the Secretary 
of Defense shall submit to the congressional defense committees 
a report containing a determination regarding the roles, missions, 
and responsibilities of the Commander, Joint Force Headquarters– 
Department of Defense Information Networks (JFHQ–DODIN) of 
the Defense Information Support Agency. 
(b) ELEMENTS.—The report required under subsection (a) shall 
include the following: 
(1) An assessment of the current JFHQ-DODIN command 
and control structure, adequacy of the Defense Information
H. R. 5515—494 
Support Agency’s institutional support for the JFHQ-DODIN 
mission, resource requirements, and mission effectiveness. 
(2)(A) A determination and justification regarding— 
(i) a transfer to the Commander, United States Cyber 
Command, from the JFHQ-DODIN of some or all roles, 
missions, and responsibilities of the JFHQ-DODIN; or 
(ii) retention in the JFHQ-DODIN of such roles, mis-
sions, and responsibilities. 
(B) If a determination under subparagraph (A)(i) is made 
in the affirmative regarding a transfer to the Commander, 
United States Cyber Command, from the JFHQ-DODIN of some 
or all roles, missions, and responsibilities of the JFHQ-DODIN, 
such report shall include the following: 
(i) An identification of roles, missions, and responsibil-
ities to be transferred. 
(ii) A timeline for any such transfers. 
(iii) A strategy for mitigating risk and ensuring no 
mission degradation. 
SEC. 1639. PROCEDURES AND REPORTING REQUIREMENT ON CYBER-
SECURITY BREACHES AND LOSS OF PERSONALLY IDENTI-
FIABLE INFORMATION AND CONTROLLED UNCLASSIFIED 
INFORMATION. 
(a) IN GENERAL.—In the event of a significant loss of personally 
identifiable information of civilian or uniformed members of the 
Armed Forces, or a significant loss of controlled unclassified 
information by a cleared defense contractor, the Secretary of 
Defense shall promptly submit to the congressional defense commit-
tees notice in writing of such loss. Such notice may be submitted 
in classified or unclassified formats. 
(b) PROCEDURES.—Not later than 180 days after the date of 
the enactment of this Act, the Secretary of Defense shall establish 
and submit to the congressional defense committees procedures 
for complying with the requirement of subsection (a). Such proce-
dures shall be consistent with the national security of the United 
States, the protection of operational integrity, the protection of 
personally identifiable information of civilian and uniformed mem-
bers of the Armed Forces, and the protection of controlled unclassi-
fied information. 
(c) DEFINITIONS.—In this section: 
(1) SIGNIFICANT
LOSS
OF
CONTROLLED
UNCLASSIFIED 
INFORMATION.—The term ‘‘significant loss of controlled unclassi-
fied information’’ means an intentional, accidental, or otherwise 
known theft, loss, or disclosure of Department of Defense pro-
grammatic or technical controlled unclassified information the 
loss of which would have significant impact or consequence 
to a program or mission of the Department of Defense, or 
the loss of which is of substantial volume. 
(2) 
SIGNIFICANT
LOSS
OF
PERSONALLY
IDENTIFIABLE 
INFORMATION.—The term ‘‘significant loss of personally identifi-
able information’’ means an intentional, accidental, or otherwise 
known disclosure of information that can be used to distinguish 
or trace an individual’s identity, such as the name, Social 
Security number, date and place of birth, biometric records, 
home or other phone numbers, or other demographic, personnel, 
medical, or financial information, involving 250 or more civilian 
or uniformed members of the Armed Forces.
H. R. 5515—495 
SEC. 1640. PROGRAM TO ESTABLISH CYBER INSTITUTES AT INSTITU-
TIONS OF HIGHER LEARNING. 
(a) PROGRAM AUTHORIZED.—The Secretary of Defense may carry 
out a program to establish a Cyber Institute at institutions of 
higher learning selected under subsection (b) for purposes of accel-
erating and focusing the development of foundational expertise 
in critical cyber operational skills for future military and civilian 
leaders of the Armed Forces and the Department of Defense, 
including such leaders of the reserve components. 
(b) SELECTED INSTITUTIONS OF HIGHER LEARNING.— 
(1) IN
GENERAL.—The Secretary of Defense shall select 
institutions of higher learning for purposes of the program 
established under subsection (a) from among institutions of 
higher learning that have a Reserve Officers’ Training Corps 
program. 
(2) CONSIDERATION
OF
SENIOR
MILITARY
COLLEGES.—In 
selecting institutions of higher learning under paragraph (1), 
the Secretary shall consider the senior military colleges with 
Reserve Officers’ Training Corps programs. 
(c) ELEMENTS.—Each institute established under the program 
authorized by subsection (a) shall include the following: 
(1) Programs to provide future military and civilian leaders 
of the Armed Forces or the Department of Defense who possess 
cyber operational expertise from beginning through advanced 
skill levels. Such programs shall include instruction and prac-
tical experiences that lead to recognized certifications and 
degrees in the cyber field. 
(2) Programs of targeted strategic foreign language pro-
ficiency training for such future leaders that— 
(A) are designed to significantly enhance critical cyber 
operational capabilities; and 
(B) are tailored to current and anticipated readiness 
requirements. 
(3) Programs related to mathematical foundations of 
cryptography and courses in cryptographic theory and practice 
designed to complement and reinforce cyber education along 
with the strategic language programs critical to cyber oper-
ations. 
(4) Programs related to data science and courses in data 
science theory and practice designed to complement and 
reinforce cyber education along with the strategic language 
programs critical to cyber operations. 
(5) Programs designed to develop early interest and cyber 
talent through summer programs, dual enrollment opportuni-
ties for cyber, strategic language, data science, and cryptog-
raphy related courses. 
(6) Training and education programs to expand the pool 
of qualified cyber instructors necessary to support cyber edu-
cation in regional school systems. 
(d) PARTNERSHIPS WITH DEPARTMENT OF DEFENSE AND THE 
ARMED FORCES.—Any institute established under the program 
authorized by subsection (a) may enter into a partnership with 
one or more components of the Armed Forces, active or reserve, 
or any agency of the Department of Defense to facilitate the develop-
ment of critical cyber skills for students who may pursue a military 
career.