H. R. 7776—1111 
(A) in the section heading, by striking ‘‘RESPONSE’’; 
and 
(B) in subsection (a), by striking ‘‘Response’’. 
(2) CLERICAL AMENDMENT.—The table of contents in the 
matter preceding section 2 of such Act is amended by striking 
the item relating to section 119C and inserting the following: 
‘‘Sec. 119C. Foreign Malign Influence Center.’’. 
(3) CONFORMING AMENDMENT.—Section 589E(d)(2) of the 
William M. (Mac) Thornberry National Defense Authorization 
Act for Fiscal Year 2021 (Public Law 116–283; 10 U.S.C. 2001 
note prec.) is amended by striking ‘‘Response’’. 
(4) REFERENCE.—Any reference in law, regulation, map, 
document, paper, or other record of the United States to the 
‘‘Foreign Malign Influence Response Center’’ shall be deemed 
to be a reference to the Foreign Malign Influence Center. 
(b) DIRECTOR OF NATIONAL INTELLIGENCE AUTHORITY TO TERMI-
NATE.—Section 119C of such Act (50 U.S.C. 3059) is further 
amended— 
(1) by redesignating subsection (e) as subsection (f); and 
(2) by inserting after subsection (d) the following: 
‘‘(e) TERMINATION.—After December 31, 2028, the Director of 
National Intelligence may terminate the Center, but only if the 
Director of National Intelligence submits to the congressional intel-
ligence committees, the Subcommittee on Defense of the Committee 
on Appropriations of the Senate, and the Subcommittee on Defense 
of the Committee on Appropriations of the House of Representatives 
a determination that the termination of the Center is appropriate, 
which includes— 
‘‘(1) a detailed description that other offices or entities 
within the intelligence community— 
‘‘(A) have the capabilities to perform the functions of 
the Center; and 
‘‘(B) will exercise the functions of the Center upon 
the termination of the Center; and 
‘‘(2) a detailed description of— 
‘‘(A) the actions the Director of National Intelligence 
will take to conduct an orderly wind-down of the activities 
of the Center; and 
‘‘(B) the proposed timeline for such actions.’’. 
(c) REPORT.— 
(1) DEFINITION
OF
APPROPRIATE
COMMITTEES
OF
CON-
GRESS.—In this subsection, the term ‘‘appropriate committees 
of Congress’’ means— 
(A) the congressional intelligence committees; 
(B) the Committee on Homeland Security and Govern-
mental Affairs, the Committee on Foreign Relations, the 
Committee on Armed Services, and the Subcommittee on 
Defense of the Committee on Appropriations of the Senate; 
and 
(C) the Committee on Homeland Security, the Com-
mittee on Foreign Affairs, the Committee on Armed Serv-
ices, and the Subcommittee on Defense of the Committee 
on Appropriations of the House of Representatives. 
(2) IN GENERAL.—Not later than December 31, 2025, the 
Director of National Intelligence shall submit to the appropriate 
committees of Congress a report assessing the continued need 
for operating the Foreign Malign Influence Center.
H. R. 7776—1112 
SEC. 6308. REQUIREMENT TO OFFER CYBER PROTECTION SUPPORT 
FOR PERSONNEL OF INTELLIGENCE COMMUNITY IN POSI-
TIONS HIGHLY VULNERABLE TO CYBER ATTACK. 
(a) IN GENERAL.—Section 6308(b) of the Damon Paul Nelson 
and Matthew Young Pollard Intelligence Authorization Act for 
Fiscal Years 2018, 2019, and 2020 (50 U.S.C. 3334d(b)) is 
amended— 
(1) in paragraph (1)— 
(A) by striking ‘‘may provide’’ and inserting ‘‘shall 
offer’’; 
(B) by inserting ‘‘and shall provide such support to 
any such personnel who request’’ before the period at the 
end; and 
(2) in the subsection heading, by striking ‘‘AUTHORITY’’ 
and inserting ‘‘REQUIREMENT’’. 
(b) PLAN.—Not later than 180 days after the date of the enact-
ment of this Act, the Director of National Intelligence shall submit 
to the congressional intelligence committees, the Committee on 
Appropriations of the Senate, and the Committee on Appropriations 
of the House of Representatives an implementation plan for pro-
viding the support described section 6308(b) of the Damon Paul 
Nelson and Matthew Young Pollard Intelligence Authorization Act 
for Fiscal Years 2018, 2019, and 2020 (50 U.S.C. 3334d(b)), as 
amended by subsection (a), including a description of the training 
and resources needed to implement the support and the method-
ology for determining the personnel described in paragraph (2) 
of such section. 
SEC. 6309. ENFORCEMENT OF CYBERSECURITY REQUIREMENTS FOR 
NATIONAL SECURITY SYSTEMS. 
(a) DEFINITIONS.—In this section: 
(1) CYBERSECURITY REQUIREMENTS FOR NATIONAL SECURITY 
SYSTEMS.—The term ‘‘cybersecurity requirements for national 
security systems’’ means the minimum cybersecurity require-
ments established by the National Manager, consistent with 
the direction of the President and in consultation with the 
Director of National Intelligence, that applies to all national 
security systems operated by, on the behalf of, or administered 
by the head of an element of the intelligence community. 
(2) NATIONAL
MANAGER.—The term ‘‘National Manager’’ 
means the National Manager for National Security Systems 
designated by the President. 
(3) NATIONAL SECURITY SYSTEMS.—The term ‘‘national secu-
rity systems’’ includes— 
(A) national security systems (as defined in section 
3552(b) of title 44, United States Code); and 
(B) information systems described in paragraph (2) 
or (3) of section 3553(e) of such title. 
(b) IMPLEMENTATION DEADLINE.—The cybersecurity require-
ments for national security systems shall include appropriate dead-
lines by which all elements of the intelligence community shall 
have fully implemented the requirements. 
(c) REEVALUATION AND UPDATES.—Not less frequently than once 
every 2 years, the National Manager shall reevaluate and update 
the cybersecurity requirements for national security systems. 
(d) RESOURCES.—Each head of an element of the intelligence 
community that owns or operates a national security system shall
H. R. 7776—1113 
update plans of the element to prioritize resources in such a manner 
as to fully implement the cybersecurity requirements for national 
security systems by the deadline established pursuant to subsection 
(b) for the next 10 fiscal years. 
(e) EXEMPTIONS.— 
(1) IN GENERAL.—The head of an element of the intelligence 
community may exempt a national security system owned or 
operated by the element from the cybersecurity requirements 
for national security systems if done so in accordance with 
the procedures established under paragraph (2). 
(2) EXEMPTION PROCEDURES.—The National Manager shall, 
consistent with the direction of the President, establish proce-
dures that govern— 
(A) the circumstances under which the head of an 
element of the intelligence community may exempt a 
national security system under paragraph (1); and 
(B) the process for implementing the exemption. 
(3) ANNUAL REPORTS ON EXEMPTIONS.— 
(A) IN GENERAL.—Each year, the National Manager 
and the Director of National Intelligence shall— 
(i) submit to the congressional intelligence commit-
tees an annual report documenting all exemptions 
made under paragraph (1) during the period covered 
by the report, along with the justifications for the 
exemptions; and 
(ii) in the case of an exemption made by the Assist-
ant Secretary of State for Intelligence and Research 
under such paragraph, submit to the Committee on 
Foreign Relations of the Senate and the Committee 
on Foreign Affairs of the House of Representatives 
a separate report describing the exemption and the 
justification for it. 
(B) MANNER.—Each report submitted under subpara-
graph (A) shall be submitted with such classification as 
the Director considers appropriate and with due regard 
for the protection of sensitive intelligence sources and 
methods. 
SEC. 6310. REVIEW AND BRIEFING ON INTELLIGENCE COMMUNITY 
ACTIVITIES UNDER EXECUTIVE ORDER 12333. 
(a) REVIEW AND BRIEFING REQUIRED.—No later than 180 days 
after the date of the enactment of this Act, the Director of National 
Intelligence shall— 
(1) conduct a review to ascertain the feasibility and advis-
ability of compiling and making public information relating 
to activities of the intelligence community under Executive 
Order 12333 (50 U.S.C. 3001 note; relating to United States 
intelligence activities); and 
(2) provide the congressional intelligence committees, the 
Committee on Appropriations of the Senate, and the Committee 
on Appropriations of the House of Representatives with a 
briefing on the findings of the Director with respect to the 
review conducted under paragraph (1). 
(b) MATTERS ADDRESSED.—The review and briefing required 
by subsection (a) shall address the feasibility and advisability of 
making available to the public information relating to the following:
H. R. 7776—1114 
(1) Data on activities described in subsection (a)(1), 
including the following: 
(A) The amount of United States person information 
collected pursuant to such activities. 
(B) Queries of United States persons pursuant to such 
activities. 
(C) Dissemination of United States person information 
pursuant to such activities, including masking and 
unmasking. 
(D) The use of United States person information in 
criminal proceedings. 
(2) Quantitative data and qualitative descriptions of 
incidents in which the intelligence community violated Execu-
tive Order 12333 and associated guidelines and procedures. 
(c) CONSIDERATIONS.—In conducting the review under sub-
section (a)(1), the Director shall consider— 
(1) the public transparency associated with the use by 
the intelligence community of the authorities provided under 
the Foreign Intelligence Surveillance Act of 1978 (50 U.S.C. 
1801 et seq.), including relevant data and compliance incidents; 
and 
(2) the application of the transparency model developed 
in connection with such Act to activities conducted under Execu-
tive Order 12333. 
(d) DISAGGREGATION FOR PUBLIC RELEASE.—In conducting the 
review under subsection (a)(1), the Director shall address whether 
the relevant data and compliance incidents associated with the 
different intelligence community entities can be disaggregated for 
public release. 
SEC. 6311. ASSESSING INTELLIGENCE COMMUNITY OPEN-SOURCE SUP-
PORT FOR EXPORT CONTROLS AND FOREIGN INVEST-
MENT SCREENING. 
(a) PILOT PROGRAM
TO ASSESS OPEN SOURCE SUPPORT
FOR 
EXPORT CONTROLS AND FOREIGN INVESTMENT SCREENING.— 
(1) PILOT PROGRAM AUTHORIZED.—The Director of National 
Intelligence shall designate an element of the intelligence 
community to carry out a pilot program to assess the feasibility 
and advisability of providing enhanced intelligence support, 
including intelligence derived from open source, publicly and 
commercially available information— 
(A) to the Department of Commerce to support the 
export control and investment screening functions of the 
Department; and 
(B) to the Department of Homeland Security to support 
the export control functions of the Department. 
(2) AUTHORITY.—In carrying out the pilot program required 
by paragraph (1), the element designated by the Director under 
such paragraph— 
(A) shall establish a process for the provision of 
information as described in such paragraph; and 
(B) may— 
(i) acquire and prepare data, consistent with 
applicable provisions of law and Executive orders; 
(ii) modernize analytic systems, including through 
the acquisition, development, or application of auto-
mated tools; and
H. R. 7776—1115 
(iii) establish standards and policies regarding the 
acquisition, treatment, and sharing of open source, 
publicly and commercially available information. 
(3) DURATION.—The pilot program required by paragraph 
(1) shall be carried out during a 3-year period. 
(b) PLAN AND REPORT REQUIRED.— 
(1) DEFINITION
OF
APPROPRIATE
COMMITTEES
OF
CON-
GRESS.—In this subsection, the term ‘‘appropriate committees 
of Congress’’ means— 
(A) the Select Committee on Intelligence, the Com-
mittee on Banking, Housing, and Urban Affairs, the Com-
mittee on Homeland Security and Governmental Affairs, 
and the Committee on Appropriations of the Senate; and 
(B) the Permanent Select Committee on Intelligence, 
the Committee on Foreign Affairs, the Committee on Finan-
cial Services, the Committee on Homeland Security, and 
the Committee on Appropriations of the House of Rep-
resentatives. 
(2) PLAN.— 
(A) IN GENERAL.—Not later than 90 days after the 
date of the enactment of this Act, the Director shall, in 
coordination with the Secretary of Commerce and the Sec-
retary of Homeland Security, submit to the appropriate 
committees of Congress a plan to carry out the pilot pro-
gram required by subsection (a)(1). 
(B) CONTENTS.—The plan submitted under subpara-
graph (A) shall include the following: 
(i) A list, developed in consultation with the Sec-
retary of Commerce and the Secretary of Homeland 
Security, of the activities of the Department of Com-
merce and the Department of Homeland Security that 
will be supported by the pilot program. 
(ii) A plan for measuring the effectiveness of the 
pilot program and the value of open source, publicly 
and commercially available information to the export 
control and investment screening missions. 
(3) REPORT.— 
(A) IN GENERAL.—Not later than 540 days after the 
date on which the Director submits the plan under para-
graph (2)(A), the Director shall submit to the appropriate 
committees of Congress a report on the findings of the 
Director with respect to the pilot program. 
(B) CONTENTS.—The report submitted under subpara-
graph (A) shall include the following: 
(i) An assessment of the feasibility and advisability 
of providing information as described in subsection 
(a)(1). 
(ii) An assessment of the value of open source, 
publicly and commercially available information to the 
export control and investment screening missions, 
using the measures of effectiveness under paragraph 
(2)(B)(ii). 
(iii) Identification of opportunities for and barriers 
to more effective use of open source, publicly and 
commercially available information by the intelligence 
community.
H. R. 7776—1116 
SEC. 
6312. 
ANNUAL 
TRAINING 
REQUIREMENT 
AND 
REPORT 
REGARDING ANALYTIC STANDARDS. 
(a) POLICY FOR TRAINING PROGRAM REQUIRED.—Consistent with 
sections 1019 and 1020 of the Intelligence Reform and Terrorism 
Prevention Act of 2004 (50 U.S.C. 3364 and 3364 note), the Director 
of National Intelligence shall issue a policy that requires each 
head of an element of the intelligence community, that has not 
already done so, to create, before the date that is 180 days after 
the date of the enactment of this Act, an annual training program 
on the standards set forth in Intelligence Community Directive 
203, Analytic Standards (or successor directive). 
(b) CONDUCT OF TRAINING.—Training required pursuant to the 
policy required by subsection (a) may be conducted in conjunction 
with other required annual training programs conducted by the 
element of the intelligence community concerned. 
(c) CERTIFICATION OF COMPLETION OF TRAINING.—Each year, 
each head of an element of the intelligence community shall submit 
to the congressional intelligence committees a certification as to 
whether all of the analysts of that element have completed the 
training required pursuant to the policy required by subsection 
(a) and if the analysts have not, an explanation of why the training 
has not been completed. 
(d) REPORTS.— 
(1) ANNUAL
REPORT.—In conjunction with each briefing 
provided under section 1019(c) of the Intelligence Reform and 
Terrorism Prevention Act of 2004 (50 U.S.C. 3364(c)), the 
Director shall submit to the congressional intelligence commit-
tees, the Committee on Appropriations of the Senate, and the 
Committee on Appropriations of the House of Representatives 
a report on the number and themes of compliance incidents 
reported to intelligence community analytic ombudspersons 
relating to the standards set forth in Intelligence Community 
Directive 203 (relating to analytic standards), or successor 
directive. 
(2) REPORT ON PERFORMANCE EVALUATION.—Not later than 
90 days after the date of the enactment of this Act, the head 
of analysis at each element of the intelligence community that 
conducts all-source analysis shall submit to the congressional 
intelligence committees, the Committee on Appropriations of 
the Senate, and the Committee on Appropriations of the House 
of Representatives a report describing how compliance with 
the standards set forth in Intelligence Community Directive 
203 (relating to analytic standards), or successor directive, is 
considered in the performance evaluations and consideration 
for merit pay, bonuses, promotions, and any other personnel 
actions for analysts within the element. 
(e) RULE OF CONSTRUCTION.—Nothing in this section shall be 
construed to prohibit the Director from providing training described 
in this section as a service of common concern. 
(f) SUNSET.—This section shall cease to be effective on the 
date that is 5 years after the date of the enactment of this Act. 
SEC. 6313. REVIEW OF JOINT INTELLIGENCE COMMUNITY COUNCIL. 
(a) IN GENERAL.—The Director of National Intelligence shall 
conduct a review of the Joint Intelligence Community Council estab-
lished by section 101A of the National Security Act of 1947 (50 
U.S.C. 3022).
H. R. 7776—1117 
(b) ELEMENTS.—The review conducted under subsection (a) 
shall cover the following: 
(1) The number of meetings the Council has held, by year. 
(2) An analysis of the issues the Council has addressed. 
(3) The effect the Council has had on the decisionmaking 
of the Director of National Intelligence. 
(4) Potential revision to the membership or functions of 
the Council. 
(c) BRIEFING.—Not later than 180 days after the date of the 
enactment of this Act, the Director of National Intelligence shall 
provide the congressional intelligence committees and the sub-
committees on defense of the Committee on Appropriations of the 
Senate and the Committee on Appropriations of the House of Rep-
resentatives a briefing on the review conducted pursuant to sub-
section (a). 
SEC. 6314. REQUIRED POLICY FOR MINIMUM INSIDER THREAT STAND-
ARDS. 
(a) REQUIREMENT.—Section 102A(f) of the National Security 
Act of 1947 (50 U.S.C. 3024(f)) is amended— 
(1) by redesignating paragraphs (8) and (9) as paragraphs 
(9) and (10), respectively; and 
(2) by inserting after paragraph (7) the following new para-
graph: 
‘‘(8) The Director of National Intelligence shall ensure there 
is established a policy for minimum insider threat standards for 
the intelligence community and ensure compliance by the elements 
of the intelligence community with that policy.’’. 
(b) COMPLIANCE
AND REPORTING.—Title III of such Act (50 
U.S.C. 3071 et seq.) is amended by adding at the end the following 
new section: 
‘‘SEC. 313. INSIDER THREAT POLICY COMPLIANCE AND REPORTING. 
‘‘The head of each element of the intelligence community shall— 
‘‘(1) implement the policy established in accordance with 
section 102A(f)(8); and 
‘‘(2) concurrent with the submission to Congress of budget 
justification materials in support of the budget of the President 
for a fiscal year that is submitted to Congress under section 
1105(a) of title 31, United States Code, submit to Congress 
a certification as to whether the element is in compliance 
with such policy.’’. 
(c) CONFORMING AMENDMENT.—Section 102A(x)(3) of such Act 
(50 U.S.C. 3024(x)(3)) is amended by inserting ‘‘, including the 
policy under subsection (f)(8),’’ after ‘‘policies of the intelligence 
community’’. 
(d) CLERICAL AMENDMENT.—The table of contents preceding 
section 2 of such Act is amended by inserting after the item relating 
to section 312 the following new item: 
‘‘Sec. 313. Insider threat policy compliance and reporting.’’. 
SEC. 6315. UNFUNDED PRIORITIES OF THE INTELLIGENCE COMMU-
NITY. 
Title V of the National Security Act of 1947 (50 U.S.C. 3091 
et seq.) is amended by adding at the end the following new section 
(and conforming the table of contents at the beginning of such 
Act accordingly):
H. R. 7776—1118 
‘‘SEC. 514. UNFUNDED PRIORITIES OF THE INTELLIGENCE COMMU-
NITY: ANNUAL REPORT. 
‘‘(a) ANNUAL REPORT.—Not later than 10 days after the date 
on which the budget of the President for a fiscal year is submitted 
to Congress pursuant to section 1105 of title 31, United States 
Code, the head of each element of the intelligence community shall 
submit to the Director of National Intelligence, the congressional 
intelligence committees, the Subcommittee on Defense of the Com-
mittee on Appropriations of the Senate, and the Subcommittee 
on Defense of the Committee on Appropriations of the House of 
Representatives a report on the unfunded priorities of the programs 
under the jurisdiction of such head. 
‘‘(b) ELEMENTS.— 
‘‘(1) IN GENERAL.—Each report under subsection (a) shall 
specify, for each unfunded priority covered by such report, 
the following: 
‘‘(A) A summary description of such priority, including 
the objectives to be achieved if such priority is funded 
(whether in whole or in part). 
‘‘(B) Whether such priority will satisfy a covert action 
or support collection against requirements identified in the 
National Intelligence Priorities Framework of the Office 
of the Director of National Intelligence (or any successor 
mechanism established for the prioritization of programs 
and activities), including a description of such requirements 
and the related prioritization level. 
‘‘(C) The additional amount of funds recommended in 
connection with the objectives under subparagraph (A). 
‘‘(D) Budget information with respect to the unfunded 
priority, including— 
‘‘(i) the appropriation account; 
‘‘(ii) the expenditure center; and 
‘‘(iii) the project and, if applicable, subproject. 
‘‘(2) PRIORITIZATION
OF
PRIORITIES.—Each report shall 
present the unfunded priorities covered by such report in overall 
order of urgency of priority among unfunded priorities. 
‘‘(c) UNFUNDED PRIORITY DEFINED.—In this section, the term 
‘unfunded priority’, in the case of a fiscal year, means a program, 
activity, or mission requirement of an element of the intelligence 
community that— 
‘‘(1) is not funded in the budget of the President for the 
fiscal year as submitted to Congress pursuant to section 1105 
of title 31, United States Code; 
‘‘(2) is necessary to fulfill a covert action or to satisfy 
an information requirement associated with the collection, anal-
ysis, or dissemination of intelligence that has been documented 
within the National Intelligence Priorities Framework; and 
‘‘(3) would have been recommended for funding by the 
head of the element of the intelligence community if— 
‘‘(A) additional resources had been available for the 
budget to fund the program, activity, or mission require-
ment; or 
‘‘(B) the program, activity, or mission requirement has 
emerged since the budget was formulated.’’.
H. R. 7776—1119 
SEC. 6316. SUBMISSION OF COVERED DOCUMENTS AND CLASSIFIED 
ANNEXES. 
(a) REQUIREMENT.—Title V of the National Security Act of 
1947 (50 U.S.C. 3091 et seq.), as amended by section 6315, is 
further amended by adding at the end the following new section 
(and conforming the table of contents at the beginning of such 
Act accordingly): 
‘‘SEC. 515. SUBMISSION OF COVERED DOCUMENTS AND CLASSIFIED 
ANNEXES. 
‘‘(a) COVERED DOCUMENT DEFINED.—In this section, the term 
‘covered document’ means any executive order, memorandum, or 
policy directive issued by the President, including national security 
Presidential memoranda and Presidential policy directives, or such 
successor memoranda and directives. 
‘‘(b) REQUIREMENT.—Not later than 7 days after the date on 
which the President issues or amends a covered document, the 
President, acting through the Director of National Intelligence, 
shall submit to the congressional intelligence committees, the Sub-
committee on Defense of the Committee on Appropriations of the 
Senate, and the Subcommittee on Defense of the Committee on 
Appropriations of the House of Representatives the covered docu-
ment and any classified annex accompanying that document if 
such covered document or annex contains a direction to, establishes 
a requirement for, or includes a restriction on any element of 
the intelligence community.’’. 
(b) INITIAL SUBMISSION.—Not later than 60 days after the date 
of the enactment of this Act, the Director of National Intelligence 
shall submit to the congressional intelligence committees, the Sub-
committee on Defense of the Committee on Appropriations of the 
Senate, and the Subcommittee on Defense of the Committee on 
Appropriations of the House of Representatives each covered docu-
ment and classified annex required under section 515 of the 
National Security Act of 1947, as added by subsection (a), in effect 
as of the date of enactment of this Act. 
(c) REPEAL.—Section 310 of the Intelligence Authorization Act 
for Fiscal Year 2017 (Public Law 115–31; 50 U.S.C. 3312) is hereby 
repealed. 
SEC. 6317. IMPROVEMENTS TO PROGRAM ON RECRUITMENT AND 
TRAINING. 
Section 1022 of the National Security Act of 1947 (50 U.S.C. 
3222) is amended to read as follows: 
‘‘SEC. 1022. PROGRAM ON RECRUITMENT AND TRAINING. 
‘‘(a) PROGRAM.— 
‘‘(1) REQUIREMENT.—The Director of National Intelligence, 
in consultation with the heads of the elements of the intel-
ligence community, shall carry out a program to ensure that 
selected individuals are provided funds for academic training 
(including with respect to both undergraduate and postgraduate 
education), or to reimburse for academic training previously 
obtained— 
‘‘(A) in capabilities, missions, or skillsets, especially 
in the fields of science, technology, math, and engineering, 
to address workforce requirements in which the intelligence 
community is deficient or likely to be deficient in the future; 
or
H. R. 7776—1120 
‘‘(B) for such individuals who have backgrounds or 
experiences that the Director has identified as— 
‘‘(i) contributing to capabilities, missions, or 
skillsets in which the intelligence community is defi-
cient or likely to be deficient in future; and 
‘‘(ii) being underrepresented in the intelligence 
community or likely to be underrepresented in the 
future. 
‘‘(2) COMMITMENT.—An individual selected for participation 
in the program shall commit to employment with an element 
of the intelligence community for a period that the Director 
determines is commensurate with the amount of funding pro-
vided to the individual under the program and under such 
terms and conditions as the Director considers appropriate. 
‘‘(3) DESIGNATION.—The program shall be known as the 
Pat Roberts Intelligence Scholars Program. 
‘‘(4) OUTREACH.—The Director, in consultation with the 
heads of the elements of the intelligence community, shall 
maintain a publicly available internet website on the program 
that describes— 
‘‘(A) the intent of the program; 
‘‘(B) the conditions and requirements for selection and 
participation; 
‘‘(C) application instructions; 
‘‘(D) the areas covered by the program pursuant to 
the review conducted under subsection (b)(2); and 
‘‘(E) any other details the Director determines appro-
priate. 
‘‘(b) ELEMENTS.—In carrying out the program under subsection 
(a), the Director shall— 
‘‘(1) establish such requirements relating to the academic 
training of participants as the Director considers appropriate 
to ensure that participants are prepared for employment as 
intelligence professionals; and 
‘‘(2) on an annual basis, review the areas that will con-
tribute to the capabilities, missions, and skillsets in which 
the intelligence community is deficient or is likely to be deficient 
in the future. 
‘‘(c) USE OF FUNDS.—Funds made available for the program 
under subsection (a) shall be used— 
‘‘(1) to provide a monthly stipend for each month that 
a participant is pursuing a course of study; 
‘‘(2) to pay the partial or full tuition of a participant for 
the completion of such course of study; 
‘‘(3) to reimburse a participant for tuition paid by the 
participant before becoming an employee of an element of the 
intelligence community, including with respect to providing 
payments for student loans used for such tuition; 
‘‘(4) to pay for books and materials that the participant 
requires or required to complete such course of study; 
‘‘(5) to pay the expenses of the participant for travel 
requested by an element of the intelligence community in rela-
tion to such program; or 
‘‘(6) for such other purposes the Director considers reason-
ably appropriate to carry out such program.’’.
H. R. 7776—1121 
SEC. 6318. MEASURES TO MITIGATE COUNTERINTELLIGENCE THREATS 
FROM PROLIFERATION AND USE OF FOREIGN COMMER-
CIAL SPYWARE. 
(a) DEFINITIONS.—In this section: 
(1) COVERED DEVICE.—The term ‘‘covered device’’ means 
any electronic mobile device including smartphones, tablet com-
puting devices, or laptop computing devices, that is issued 
by an element of the intelligence community for official use. 
(2) FOREIGN
COMMERCIAL
SPYWARE; FOREIGN
COMPANY; 
SPYWARE.—The terms ‘‘foreign commercial spyware’’, ‘‘foreign 
company’’, and ‘‘spyware’’ have the meanings given those terms 
in section 1102A of the National Security Act of 1947 (50 
U.S.C. 3231 et seq.), as added by this section. 
(b) STATEMENT OF POLICY.—It shall be the policy of the United 
States to act decisively against counterintelligence threats posed 
by foreign commercial spyware, as well as the individuals who 
lead entities selling foreign commercial spyware and who are 
reasonably believed to be involved, have been involved, or pose 
a significant risk to being or becoming involved, in activities con-
trary to the national security or foreign policy interests of the 
United States. 
(c) MEASURES TO MITIGATE COUNTERINTELLIGENCE THREATS.— 
Title XI of the National Security Act of 1947 (50 U.S.C. 3231 
et seq.) is amended by inserting after section 1102 the following 
new section (and conforming the table of contents at the beginning 
of such Act accordingly): 
‘‘SEC. 
1102A. 
MEASURES 
TO 
MITIGATE 
COUNTERINTELLIGENCE 
THREATS FROM PROLIFERATION AND USE OF FOREIGN 
COMMERCIAL SPYWARE. 
‘‘(a) DEFINITIONS.—In this section: 
‘‘(1) APPROPRIATE CONGRESSIONAL COMMITTEES.—The term 
‘appropriate congressional committees’ means— 
‘‘(A) the Select Committee on Intelligence, the Com-
mittee on Foreign Relations, the Committee on Armed Serv-
ices, the Committee on Banking, Housing, and Urban 
Affairs, the Committee on the Judiciary, the Committee 
on Appropriations, and the Committee on Homeland Secu-
rity and Governmental Affairs of the Senate; and 
‘‘(B) the Permanent Select Committee on Intelligence, 
the Committee on Foreign Affairs, the Committee on Armed 
Services, the Committee on Financial Services, the Com-
mittee on the Judiciary, the Committee on Appropriations, 
the Committee on Homeland Security, and the Committee 
on Oversight and Reform of the House of Representatives. 
‘‘(2) COVERED
ENTITY.—The term ‘covered entity’ means 
any foreign company that either directly or indirectly develops, 
maintains, owns, operates, brokers, markets, sells, leases, 
licenses, or otherwise makes available spyware. 
‘‘(3) FOREIGN
COMMERCIAL
SPYWARE.—The term ‘foreign 
commercial spyware’ means spyware that is developed (solely 
or in partnership with a foreign company), maintained, sold, 
leased, licensed, marketed, sourced (in whole or in part), or 
otherwise provided, either directly or indirectly, by a foreign 
company. 
‘‘(4) FOREIGN COMPANY.—The term ‘foreign company’ means 
a company that is incorporated or domiciled outside of the
H. R. 7776—1122 
United States, including any subsidiaries or affiliates wherever 
such subsidiaries or affiliates are domiciled or incorporated. 
‘‘(5) SPYWARE.—The term ‘spyware’ means a tool or set 
of tools that operate as an end-to-end system of software to 
provide an unauthorized user remote access to information 
stored on or transiting through an electronic device connected 
to the Internet and not owned or operated by the unauthorized 
user, including end-to-end systems that— 
‘‘(A) allow an unauthorized user to remotely infect 
electronic devices with malicious software, including with-
out any action required by the user of the device; 
‘‘(B) can record telecommunications or other audio cap-
tured on a device not owned by the unauthorized user; 
‘‘(C) undertake geolocation, collect cell site location 
information, or otherwise track the location of a device 
or person using the internal sensors of an electronic device 
not owned by the unauthorized user; 
‘‘(D) allow an unauthorized user access to and the 
ability to retrieve information on the electronic device, 
including text messages, files, e-mails, transcripts of chats, 
contacts, photos, and browsing history; or 
‘‘(E) any additional criteria described in publicly avail-
able documents published by the Director of National Intel-
ligence, such as whether the end-to-end system is used 
outside the context of a codified lawful intercept system. 
‘‘(b) 
ANNUAL
ASSESSMENTS
OF
COUNTERINTELLIGENCE 
THREATS.— 
‘‘(1) REQUIREMENT.—Not later than 90 days after the enact-
ment of the Intelligence Authorization Act for Fiscal Year 2023, 
and annually thereafter, the Director of National Intelligence, 
in coordination with the Director of the Central Intelligence 
Agency, the Director of the National Security Agency, and 
the Director of the Federal Bureau of Investigation, shall 
submit to the appropriate congressional committees a report 
with an accompanying classified annex containing an assess-
ment of the counterintelligence threats and other risks to the 
national security of the United States posed by the proliferation 
of foreign commercial spyware. The assessment shall incor-
porate all credible data, including open-source information. 
‘‘(2) ELEMENTS.—Each report under paragraph (1) shall 
include the following, if known: 
‘‘(A) A list of the most significant covered entities. 
‘‘(B) A description of the foreign commercial spyware 
marketed by the covered entities identified under subpara-
graph (A) and an assessment by the intelligence community 
of the foreign commercial spyware. 
‘‘(C) An assessment of the counterintelligence risk to 
the intelligence community or personnel of the intelligence 
community posed by foreign commercial spyware. 
‘‘(D) For each covered entity identified in subparagraph 
(A), details of any subsidiaries, resellers, or other agents 
acting on behalf of the covered entity. 
‘‘(E) Details of where each covered entity identified 
under subparagraphs (A) and (D) is domiciled. 
‘‘(F) A description of how each covered entity identified 
under subparagraphs (A) and (D) is financed, where the 
covered entity acquired its capital, and the organizations
H. R. 7776—1123 
and individuals having substantial investments or other 
equities in the covered entity. 
‘‘(G) An assessment by the intelligence community of 
any relationship between each covered entity identified 
in subparagraphs (A) and (D) and any foreign government, 
including any export controls and processes to which the 
covered entity is subject. 
‘‘(H) A list of the foreign customers of each covered 
entity identified in subparagraphs (A) and (D), including 
the understanding by the intelligence community of the 
organizations and end-users within any foreign govern-
ment. 
‘‘(I) With respect to each foreign customer identified 
under subparagraph (H), an assessment by the intelligence 
community regarding how the foreign customer is using 
the spyware, including whether the foreign customer has 
targeted personnel of the intelligence community. 
‘‘(J) With respect to the first report required under 
paragraph (1), a mitigation plan to reduce the exposure 
of personnel of the intelligence community to foreign 
commercial spyware. 
‘‘(K) With respect to each report following the first 
report required under paragraph (1), details of steps taken 
by the intelligence community since the previous report 
to implement measures to reduce the exposure of personnel 
of the intelligence community to foreign commercial 
spyware. 
‘‘(3) CLASSIFIED ANNEX.—In submitting the report under 
subsection (2), the Director shall also include an accompanying 
but separate classified annex, providing a watchlist of compa-
nies selling, leasing, or otherwise providing foreign commercial 
spyware that the Director determines are engaged in activities 
that pose a counterintelligence risk to personnel of the intel-
ligence community. 
‘‘(4) FORM.—Each report under paragraph (1) shall be sub-
mitted in classified form. 
‘‘(5) DISSEMINATION.—The Director of National Intelligence 
shall separately distribute each report under paragraph (1) 
and each annex under paragraph (3) to the President, the 
heads of all elements of the intelligence community, the Sec-
retary of State, the Attorney General, the Secretary of Com-
merce, the Secretary of Homeland Security, the National Cyber 
Director, and the heads of any other departments or agencies 
the Director of National Intelligence determines appropriate. 
‘‘(c) AUTHORITY
TO PROHIBIT PURCHASE
OR USE
BY INTEL-
LIGENCE COMMUNITY.— 
‘‘(1) FOREIGN COMMERCIAL SPYWARE.— 
‘‘(A) IN
GENERAL.—The Director of National Intel-
ligence may prohibit any element of the intelligence 
community from procuring, leasing, or otherwise acquiring 
on the commercial market, or extending or renewing a 
contract to procure, lease, or otherwise acquire, foreign 
commercial spyware. 
‘‘(B) CONSIDERATIONS.—In determining whether and 
how to exercise the authority under subparagraph (A), 
the Director of National Intelligence shall consider—
H. R. 7776—1124 
‘‘(i) the assessment of the intelligence community 
of the counterintelligence threats or other risks to the 
United States posed by foreign commercial spyware; 
‘‘(ii) the assessment of the intelligence community 
of whether the foreign commercial spyware has been 
used to target United States Government personnel. 
‘‘(iii) whether the original owner or developer 
retains any of the physical property or intellectual 
property associated with the foreign commercial 
spyware; 
‘‘(iv) whether the original owner or developer has 
verifiably destroyed all copies of the data collected 
by or associated with the foreign commercial spyware; 
‘‘(v) whether the personnel of the original owner 
or developer retain any access to data collected by 
or associated with the foreign commercial spyware; 
‘‘(vi) whether the use of the foreign commercial 
spyware requires the user to connect to an information 
system of the original owner or developer or informa-
tion system of a foreign government; and 
‘‘(vii) whether the foreign commercial spyware 
poses a counterintelligence risk to the United States 
or any other threat to the national security of the 
United States. 
‘‘(2) COMPANY THAT HAS ACQUIRED FOREIGN COMMERCIAL 
SPYWARE.— 
‘‘(A) AUTHORITY.—The Director of National Intelligence 
may prohibit any element of the intelligence community 
from entering into any contract or other agreement for 
any purpose with a company that has acquired, in whole 
or in part, any foreign commercial spyware. 
‘‘(B) CONSIDERATIONS.—In considering whether and 
how to exercise the authority under subparagraph (A), 
the Director of National Intelligence shall consider— 
‘‘(i) whether the original owner or developer of 
the foreign commercial spyware retains any of the 
physical property or intellectual property associated 
with the spyware; 
‘‘(ii) whether the original owner or developer of 
the 
foreign 
commercial 
spyware 
has 
verifiably 
destroyed all data, and any copies thereof, collected 
by or associated with the spyware; 
‘‘(iii) whether the personnel of the original owner 
or developer of the foreign commercial spyware retain 
any access to data collected by or associated with the 
foreign commercial spyware; 
‘‘(iv) whether the use of the foreign commercial 
spyware requires the user to connect to an information 
system of the original owner or developer or informa-
tion system of a foreign government; and 
‘‘(v) whether the foreign commercial spyware poses 
a counterintelligence risk to the United States or any 
other threat to the national security of the United 
States. 
‘‘(3) NOTIFICATIONS
OF
PROHIBITION.—Not later than 30 
days after the date on which the Director of National Intel-
ligence exercises the authority to issue a prohibition under
H. R. 7776—1125 
subsection (c), the Director of National Intelligence shall notify 
the congressional intelligence committees of such exercise of 
authority. Such notice shall include— 
‘‘(A) a description of the circumstances under which 
the prohibition was issued; 
‘‘(B) an identification of the company or product covered 
by the prohibition; 
‘‘(C) any information that contributed to the decision 
of the Director of National Intelligence to exercise the 
authority, including any information relating to counter-
intelligence or other risks to the national security of the 
United States posed by the company or product, as assessed 
by the intelligence community; and 
‘‘(D) an identification of each element of the intelligence 
community to which the prohibition has been applied. 
‘‘(4) WAIVER AUTHORITY.— 
‘‘(A) IN GENERAL.—The head of an element of the intel-
ligence community may request from the Director of 
National Intelligence the waiver of a prohibition made 
under paragraph (1) or (2). 
‘‘(B) DIRECTOR OF NATIONAL INTELLIGENCE DETERMINA-
TION.—The Director of National Intelligence, upon receiving 
the waiver request in subparagraph (A), may issue a waiver 
for a period not to exceed one year in response to the 
request from the head of an element of the intelligence 
community if such waiver is in the national security 
interest of the United States. 
‘‘(C) NOTICE.—Not later than 30 days after approving 
a waiver request pursuant to subparagraph (B), the 
Director of National Intelligence shall submit to the 
congressional intelligence committees, the Subcommittee 
on Defense of the Committee on Appropriations of the 
Senate, and the Subcommittee on Defense of the Committee 
on Appropriations of the House of Representatives a written 
notification. The notification shall include— 
‘‘(i) an identification of the head of the element 
of the intelligence community that requested the 
waiver; 
‘‘(ii) the details of the waiver request, including 
the national security interests of the United States; 
‘‘(iii) the rationale and basis for the determination 
that the waiver is in the national security interests 
of the United States; 
‘‘(iv) the considerations that informed the ultimate 
determination of the Director of National Intelligence 
to issue the wavier; and 
‘‘(v) and any other considerations contributing to 
the determination, made by the Director of National 
Intelligence. 
‘‘(D) WAIVER TERMINATION.—The Director of National 
Intelligence may revoke a previously granted waiver at 
any time. Upon revocation of a waiver, the Director of 
National Intelligence shall submit a written notification 
to the congressional intelligence committees, the Sub-
committee on Defense of the Committee on Appropriations 
of the Senate, and the Subcommittee on Defense of the
H. R. 7776—1126 
Committee on Appropriations of the House of Representa-
tives not later than 30 days after making a revocation 
determination. 
‘‘(5) TERMINATION
OF
PROHIBITION.—The Director of 
National Intelligence may terminate a prohibition made under 
paragraph (1) or (2) at any time. Upon termination of a prohibi-
tion, the Director of National Intelligence shall submit a 
notification of the termination to the congressional intelligence 
committees, the Subcommittee on Defense of the Committee 
on Appropriations of the Senate, and the Subcommittee on 
Defense of the Committee on Appropriations of the House of 
Representatives not later than 30 days after terminating a 
prohibition, detailing the basis for the termination, including 
any United States national security interests that may be 
affected by such termination.’’. 
(d) PROTECTION OF COVERED DEVICES.— 
(1) REQUIREMENT.—Not later than 120 days after the date 
of the enactment of this Act, the Director of National Intel-
ligence shall— 
(A) issue standards, guidance, best practices, and poli-
cies for elements of the intelligence community to protect 
covered devices from being compromised by foreign 
commercial spyware; 
(B) survey elements of the intelligence community 
regarding the processes used by the elements to routinely 
monitor covered devices for indicators of compromise associ-
ated with foreign commercial spyware; and 
(C) submit to the congressional intelligence committees 
a report on the sufficiency of the measures in place to 
routinely monitor covered devices for indicators of com-
promise associated with foreign commercial spyware. 
(2) FORM.—The report under paragraph (1)(C) may be sub-
mitted in classified form. 
(3) COUNTERINTELLIGENCE NOTIFICATIONS.—Not later than 
30 days after the date on which an element of the intelligence 
community becomes aware that a covered device was targeted 
or compromised by foreign commercial spyware, the Director 
of National Intelligence, in coordination with the Director of 
the Federal Bureau of Investigation, shall notify the congres-
sional intelligence committees, the Subcommittee on Defense 
of the Committee on Appropriations of the Senate, and the 
Subcommittee on Defense of the Committee on Appropriations 
of the House of Representatives of such determination, 
including— 
(A) the component of the element and the location 
of the personnel whose covered device was targeted or 
compromised; 
(B) the number of covered devices compromised or 
targeted; 
(C) an assessment by the intelligence community of 
the damage to national security of the United States 
resulting from any loss of data or sensitive information; 
(D) an assessment by the intelligence community of 
any foreign government, or foreign organization or entity, 
and, to the extent possible, the foreign individuals, who 
directed and benefitted from any information acquired from 
the targeting or compromise; and
H. R. 7776—1127 
(E) as appropriate, an assessment by the intelligence 
community of the capacity and will of such governments 
or individuals to continue targeting personnel of the United 
States Government. 
(4) PRIVATE
SECTOR
PARTNERSHIPS.—Section 904(d)(7) of 
the Counterintelligence Enhancement Act of 2002 (50 U.S.C. 
3383(d)(7)) is amended by adding at the end the following 
new paragraph: 
‘‘(E) VULNERABILITIES
FROM
FOREIGN
COMMERCIAL 
SPYWARE.— 
‘‘(i) CONSULTATION.—In carrying out efforts to 
secure covered devices, to consult with the private 
sector of the United States and reputable third-party 
researchers to identify vulnerabilities from foreign 
commercial spyware (as defined in section 1102A(a) 
of the National Security Act of 1947) and maintain 
effective security measures for such devices. 
‘‘(ii) COVERED DEVICE DEFINED.—In this subpara-
graph, the term ‘covered device’ means any electronic 
mobile device including smartphones, tablet computing 
devices, or laptop computing devices, that is issued 
by an element of the intelligence community for official 
use.’’. 
(e) NO ENHANCED AUTHORITIES.—Nothing in this section or 
an amendment made by this section shall be construed as 
enhancing, or otherwise changing, the authorities of the intelligence 
community to target, collect, process, or disseminate information 
regarding United States Government personnel. 
(f) REPORT ON HARMONIZATION AMONG ALLIED COUNTRIES.— 
(1) REQUIREMENT.—Not later than 30 days after the date 
of the enactment of this Act, the Director of National Intel-
ligence shall submit to the congressional intelligence commit-
tees, the Subcommittee on Defense of the Committee on Appro-
priations of the Senate, and the Subcommittee on Defense 
of the Committee on Appropriations of the House of Representa-
tives a report on the potential for the United States to lead 
an effort to devise and implement a common approach with 
allied countries as the Director determines appropriate, 
including the Five Eyes Partnership, to mitigate the counter-
intelligence risks posed by the proliferation of foreign commer-
cial spyware, including by seeking commitments to implement 
measures similar to the requirements under this section and 
section 1102A of the National Security Act of 1947 (50 U.S.C. 
3231 et seq.), as added by this section. 
(2) FORM.—The report under paragraph (1) shall be sub-
mitted in unclassified form, but may contain a classified annex, 
consistent with the protection of intelligence sources and 
methods. 
SEC. 6319. PERSONNEL VETTING PERFORMANCE MEASURES. 
(a) DEFINITIONS OF CONTINUING VETTING; COUNCIL; SECURITY 
EXECUTIVE AGENT.—In this section, the terms ‘‘continuous vetting’’, 
‘‘Council’’, and ‘‘Security Executive Agent’’ have the meanings given 
those terms in section 6601 of the Damon Paul Nelson and Matthew 
Young Pollard Intelligence Authorization Act for Fiscal Years 2018, 
2019, and 2020 (50 U.S.C. 3352).
H. R. 7776—1128 
(b) MEASURES.—Not later than 180 days after the date of 
the enactment of this Act and consistent with section 807 of the 
Intelligence Authorization Act for Fiscal Year 2022 (Public Law 
117–103), the Director of National Intelligence, acting as the Secu-
rity Executive Agent, and in coordination with the Chair and other 
principals of the Council, shall develop performance measures to 
assess the vetting of personnel, including measures to assess contin-
uous vetting and the quality of each phase of the personnel vetting 
process, including the initiation, investigation, and adjudication 
phases. 
(c) REPORT.— 
(1) REQUIREMENT.—Not later than 180 days after the date 
of the enactment of this Act, the Director of National Intel-
ligence shall submit to Congress a report describing the 
performance measures developed under subsection (b). 
(2) ELEMENTS.—The report under paragraph (1) shall 
include the following: 
(A) A description of how departments and agencies 
of the United States Government have implemented Secu-
rity Executive Agent Directive 6 titled ‘‘Continuous Evalua-
tion’’ and related personnel vetting performance measures 
to ensure that implementation is efficient and effective, 
including the resources expended by each department or 
agency for continuous vetting and whether departments 
and agencies are identifying security-relevant information 
in a timely manner. 
(B) A description of the performance measures the 
Director of National Intelligence and the Secretary of 
Defense use to assess the quality of each phase of the 
personnel vetting process, including initiation, investiga-
tion, adjudication, reinvestigation, and continuous vetting. 
(C) How such performance measures meet key 
attributes for successful performance measures as described 
in the report of the Comptroller General of the United 
States titled ‘‘Personnel Vetting: Actions Needed to Imple-
ment Reforms, Address Challenges, and Improve Planning’’ 
(GAO–22–104093). 
(D) Any impediments or constraints relating to the 
implementation of Security Executive Agent Directive 6 
or the development of such performance measures to assess 
the quality of the personnel vetting process. 
SEC. 6320. PROACTIVE CYBERSECURITY. 
(a) SURVEY OF ELEMENTS.—Pursuant to section 103G(b)(1) of 
the National Security Act (50 U.S.C. 3032(b)(1)), not later than 
1 year after the date of the enactment of this Act, the Chief 
Information Officer of the Intelligence Community shall conduct 
a survey of each element of the intelligence community on the 
use by that element of proactive cybersecurity initiatives, contin-
uous activity security testing, and active defense techniques. 
(b) REPORT BY CHIEF INFORMATION OFFICER.— 
(1) REPORT.—Not later than 1 year after the date of the 
completion of the survey under subsection (a), the Chief 
Information Officer of the Intelligence Community shall submit 
to the congressional intelligence committees, the Subcommittee 
on Defense of the Committee on Appropriations of the Senate,
H. R. 7776—1129 
and the Subcommittee on Defense of the Committee on Appro-
priations of the House of Representatives a report on proactive 
cybersecurity initiatives, continuous activity security testing, 
and active defense techniques. Such report shall include the 
following: 
(A) The results of the survey of each element of the 
intelligence community conducted under subsection (a), 
including— 
(i) examples of any successes against attackers 
who breached an information system of an element 
of the intelligence community; and 
(ii) concerns, limitations, and associated rec-
ommendations relating to innovative uses of proactive 
cybersecurity initiatives. 
(B) An analysis of the feasibility, costs, and benefits 
of consolidating oversight and implementation of such 
methods within the intelligence community, including 
whether such consolidation would significantly enhance 
defense. 
(C) An analysis of any statutory or policy limitations 
on the ability of the Director of National Intelligence, or 
the head of any element of the intelligence community, 
to carry out such methods on behalf of an element of 
the intelligence community or multiple such elements. 
(D) An analysis of the relationships between and 
among the intelligence community, the Department of 
Defense, the Cybersecurity and Infrastructure Security 
Agency of the Department of Homeland Security, national 
laboratories, and the private sector, and whether such rela-
tionships should be enhanced to protect national security 
systems of the intelligence community through proactive 
cybersecurity measures. 
(E) With respect to active defense techniques, a discus-
sion of the effectiveness of such techniques to protect the 
information systems of the elements of the intelligence 
community, any constraints that hinder such techniques, 
and associated recommendations. 
(F) With respect to continuous activity security testing, 
a discussion of— 
(i) how an information system operates under 
normal and intended use, compared to how such system 
operates under a variety of adverse conditions and 
scenarios; and 
(ii) the feasibility of the adoption of continuous 
activity security testing among the intelligence commu-
nity. 
(G) Recommendations for legislative action and further 
resources relating to the successful use of proactive cyberse-
curity initiatives, deception environments, and continuous 
activity security testing. 
(2) FORM.—The report under paragraph (1) may be sub-
mitted in classified form. 
(c) DEFINITIONS.—In this section: 
(1) ACTIVE DEFENSE TECHNIQUE.—The term ‘‘active defense 
technique’’ means an action taken on an information system 
of an element of the intelligence community to increase the 
security of such system against an attacker, including—