H. R. 5515—496 
(e) PARTNERSHIPS.—Any institute established under the pro-
gram authorized by subsection (a) may enter into a partnership 
with one or more local educational agencies to facilitate the develop-
ment of critical cyber skills. 
(f) SENIOR MILITARY COLLEGES DEFINED.—The term ‘‘senior 
military colleges’’ has the meaning given such term in section 
2111a(f) of title 10, United States Code. 
SEC. 1641. MATTERS PERTAINING TO THE SHARKSEER CYBERSECU-
RITY PROGRAM. 
(a) TRANSFER OF PROGRAM.—Not later than March 1, 2019, 
the Secretary of Defense shall transfer the operations and mainte-
nance for the Sharkseer cybersecurity program from the National 
Security Agency to the Defense Information Systems Agency, 
including all associated funding and, as the Secretary considers 
necessary, personnel. 
(b) LIMITATION ON FUNDING FOR THE INFORMATION SYSTEMS 
SECURITY PROGRAM.—Of the funds authorized to be appropriated 
by this Act or otherwise made available for fiscal year 2019 or 
any subsequent fiscal year for research, development, test, and 
evaluation for the Information Systems Security Program for the 
National Security Agency, not more than 90 percent may be obli-
gated or expended unless the Chief of Information Officer, in con-
sultation with the Principal Cyber Advisor, certifies to the congres-
sional defense committees that the operations and maintenance 
funding for the Sharkseer program for fiscal year 2019 and the 
subsequent fiscal years of the current Future Years Defense Pro-
gram are available or programmed. 
(c) REPORT.—Not later than 90 days after the date of the 
enactment of this Act, the Chief Information Officer shall provide 
to the congressional defense committees a report that assesses 
the transition of base operations of the SharkSeer program to 
the Defense Information Systems Agency, including with respect 
to staffing, acquisition, contracts, sensor management, and the 
ability to conduct cyber threat analyses and detect advanced 
malware. Such report shall also include a plan for continued capa-
bility development. 
(d) SHARKSEER BREAK AND INSPECT CAPABILITY.— 
(1) IN GENERAL.—The Secretary of Defense shall ensure 
that the decryption capability described in section 1636 of the 
Carl Levin and Howard P. ‘‘Buck’’ McKeon National Defense 
Authorization Act for Fiscal Year 2015 (Public Law 113–291) 
is provided by the break and inspect subsystem of the Sharkseer 
cybersecurity program, unless the Chief of Information Officer, 
in consultation with the Principal Cyber Advisor, notifies the 
congressional defense committees on or before the date that 
is 90 days after the date of the enactment of this Act that 
a superior enterprise solution will be operational before October 
1, 2019. 
(2) INTEGRATION OF CAPABILITY.—The Secretary shall take 
such actions as are necessary to integrate the break and inspect 
subsystem of the Sharkseer cybersecurity program with the 
Department of Defense public key infrastructure. 
(e) VISIBILITY TO ENDPOINTS.—The Secretary shall take such 
actions as are necessary to enable, by October 1, 2020, the 
Sharkseer cybersecurity program and computer network defense
H. R. 5515—497 
service providers to instantly and automatically determine the spe-
cific identity and location of computer hosts and other endpoints 
that received or sent malware detected by the Sharkseer cybersecu-
rity program or other network perimeter defenses. 
(f) SANDBOX
AS
A SERVICE.—The Secretary shall use the 
Sharkseer cybersecurity program sandbox-as-a-service capability as 
an enterprise solution and terminate all other such projects, unless 
the Chief of Information Officer, in consultation with the Principal 
Cyber Advisor, notifies the congressional defense committees on 
or before the date that is 90 days after the date of the enactment 
of this Act that a superior enterprise solution will be operational 
before October 1, 2019. 
SEC. 1642. ACTIVE DEFENSE AGAINST THE RUSSIAN FEDERATION, PEO-
PLE’S REPUBLIC OF CHINA, DEMOCRATIC PEOPLE’S 
REPUBLIC OF KOREA, AND ISLAMIC REPUBLIC OF IRAN 
ATTACKS IN CYBERSPACE. 
(a) AUTHORITY
TO
DISRUPT, DEFEAT, AND
DETER
CYBER 
ATTACKS.— 
(1) IN GENERAL.—In the event that the National Command 
Authority determines that the Russian Federation, People’s 
Republic of China, Democratic People’s Republic of Korea, or 
Islamic Republic of Iran is conducting an active, systematic, 
and ongoing campaign of attacks against the Government or 
people of the United States in cyberspace, including attempting 
to influence American elections and democratic political proc-
esses, the National Command Authority may authorize the 
Secretary of Defense, acting through the Commander of the 
United States Cyber Command, to take appropriate and propor-
tional action in foreign cyberspace to disrupt, defeat, and deter 
such attacks under the authority and policy of the Secretary 
of Defense to conduct cyber operations and information oper-
ations as traditional military activities. 
(2) NOTIFICATION AND REPORTING.— 
(A) NOTIFICATION OF OPERATIONS.—In exercising the 
authority provided in paragraph (1), the Secretary shall 
provide notices to the congressional defense committees 
in accordance with section 395 of title 10, United States 
Code (as transferred and redesignated pursuant to section 
1631). 
(B) QUARTERLY REPORTS BY COMMANDER OF THE UNITED 
STATES CYBER COMMAND.— 
(i) IN GENERAL.—In any fiscal year in which the 
Commander of the United States Cyber Command car-
ries out an action under paragraph (1), the Secretary 
of Defense shall, not less frequently than quarterly, 
submit to the congressional defense committees a 
report on the actions of the Commander under such 
paragraph in such fiscal year. 
(ii) MANNER
OF
REPORTING.—Reports submitted 
under clause (i) shall be submitted in a manner that 
is consistent with the recurring quarterly report 
required by section 484 of title 10, United States Code. 
(b) PRIVATE SECTOR COOPERATION.—The Secretary may make 
arrangements with private sector entities, on a voluntary basis, 
to share threat information related to malicious cyber actors, and 
any associated false online personas or compromised infrastructure,
H. R. 5515—498 
associated with a determination under subsection (a)(1), consistent 
with the protection of sources and methods and classification guide-
lines, as necessary. 
(c) ANNUAL REPORT.—Not less frequently than once each year, 
the Secretary shall submit to the congressional defense committees, 
the congressional intelligence committees (as defined in section 
3 of the National Security Act of 1947 (50 U.S.C. 3003)), the Com-
mittee on Foreign Affairs of the House of Representatives, and 
the Committee on Foreign Relations of the Senate a report on— 
(1) the scope and intensity of the information operations 
and attacks through cyberspace by the countries specified in 
subsection (a)(1) against the government or people of the United 
States observed by the cyber mission forces of the United States 
Cyber Command and the National Security Agency; and 
(2) adjustments of the Department of Defense in the 
response directed or recommended by the Secretary with respect 
to such operations and attacks. 
(d) RULE OF CONSTRUCTION.—Nothing in this section may be 
construed to— 
(1) limit the authority of the Secretary to conduct military 
activities or operations in cyberspace, including clandestine 
activities or operations in cyberspace; or 
(2) affect the War Powers Resolution (Public Law 93–148; 
50 U.S.C. 1541 et seq.) or the Authorization for Use of Military 
Force (Public Law 107–40; 50 U.S.C. 1541 note). 
SEC. 1643. DESIGNATION OF OFFICIAL FOR MATTERS RELATING TO 
INTEGRATING CYBERSECURITY AND INDUSTRIAL CON-
TROL SYSTEMS WITHIN THE DEPARTMENT OF DEFENSE. 
(a) DESIGNATION OF INTEGRATING OFFICIAL.—Not later than 
180 days after the date of the enactment of this Act, the Secretary 
of Defense shall designate one official to be responsible for matters 
relating to integrating cybersecurity and industrial control systems 
for the Department of Defense. 
(b) RESPONSIBILITIES.—The official designated pursuant to sub-
section (a) shall be responsible for matters described in such sub-
section at all levels of command, from the Department’s leadership 
to the facilities owned by or operated on behalf of the Department 
of Defense using industrial control systems, including developing 
Department-wide certification standards for integration of indus-
trial control systems and taking into consideration frameworks 
set forth by the National Institute of Standards and Technology 
for the cybersecurity of such systems. 
SEC. 1644. ASSISTANCE FOR SMALL MANUFACTURERS IN THE 
DEFENSE INDUSTRIAL SUPPLY CHAIN AND UNIVERSITIES 
ON MATTERS RELATING TO CYBERSECURITY. 
(a) DISSEMINATION OF CYBERSECURITY RESOURCES.— 
(1) IN GENERAL.—The Secretary of Defense, in consultation 
with the Director of the National Institute of Standards and 
Technology, shall take such actions as may be necessary to 
enhance awareness of cybersecurity threats among small manu-
facturers and universities working on Department of Defense 
programs and activities. 
(2) PRIORITY.—The Secretary of Defense shall prioritize 
efforts to increase awareness to help reduce cybersecurity risks 
faced by small manufacturers and universities referred to in 
paragraph (1).
H. R. 5515—499 
(3) SECTOR FOCUS.—The Secretary of Defense shall carry 
out this subsection with a focus on such small manufacturers 
and universities as the Secretary considers critical. 
(4) OUTREACH EVENTS.—Under paragraph (1), the Secretary 
of Defense shall conduct outreach to support activities con-
sistent with this section. Such outreach may include live events 
with a physical presence and outreach conducted through Inter-
net websites. Such outreach may include training, including 
via courses and classes, to help small manufacturers and 
universities improve their cybersecurity. 
(5) ROADMAPS
AND
ASSESSMENTS.—The Secretary of 
Defense shall ensure that cybersecurity for defense industrial 
base manufacturing is included in appropriate research and 
development roadmaps and threat assessments. 
(b) VOLUNTARY CYBERSECURITY SELF-ASSESSMENTS.—The Sec-
retary of Defense shall develop mechanisms to provide assistance 
to help small manufacturers and universities conduct voluntary 
self-assessments in order to understand operating environments, 
cybersecurity requirements, and existing vulnerabilities, including 
through the Mentor Prote´ge´ Program, small business programs, 
and engagements with defense laboratories and test ranges. 
(c) TRANSFER OF RESEARCH FINDINGS AND EXPERTISE.— 
(1) IN GENERAL.—The Secretary of Defense shall promote 
the transfer of appropriate technology, threat information, and 
cybersecurity techniques developed in the Department of 
Defense to small manufacturers and universities throughout 
the United States to implement security measures that are 
adequate to protect covered defense information, including con-
trolled unclassified information. 
(2) COORDINATION
WITH
OTHER
FEDERAL
EXPERTISE
AND 
CAPABILITIES.—The Secretary of Defense shall coordinate 
efforts, when appropriate, with the expertise and capabilities 
that exist in Federal agencies and federally sponsored labora-
tories. 
(3) AGREEMENTS.—In carrying out this subsection, the Sec-
retary of Defense may enter into agreements with private 
industry, institutes of higher education, or a State, United 
States territory, local, or tribal government to ensure breadth 
and depth of coverage to the United States defense industrial 
base and to leverage resources. 
(d) DEFENSE ACQUISITION WORKFORCE CYBER TRAINING PRO-
GRAM.—The Secretary of Defense shall establish a cyber counseling 
certification program, or approve a similar existing program, to 
certify small business professionals and other relevant acquisition 
staff within the Department of Defense to provide cyber planning 
assistance to small manufacturers and universities. 
(e) ESTABLISHMENT OF CYBERSECURITY FOR DEFENSE INDUS-
TRIAL BASE MANUFACTURING ACTIVITY.— 
(1) AUTHORITY.—The Secretary of Defense may establish 
an activity to assess and strengthen the cybersecurity resiliency 
of the defense industrial base, if the Secretary determines 
such is appropriate. 
(2) DESIGNATION.—The activity described in paragraph (1), 
if established, shall be known as the ‘‘Cybersecurity for Defense 
Industrial Base Manufacturing Activity’’.