H. R. 6395—687 
retrofit any Global Positioning System device or system, or network 
that uses the Global Positioning System, in order to mitigate harm-
ful interference from commercial terrestrial operations using the 
1526–1536 megahertz band, the 1627.5–1637.5 megahertz band, 
or the 1646.5–1656.5 megahertz band. 
(b) ACTIONS NOT PROHIBITED.—The prohibition in subsection 
(a) shall not apply to any action taken by the Secretary of Defense 
relating to— 
(1) conducting technical or information exchanges with the 
entity that operates the commercial terrestrial operations in 
the megahertz bands specified in such subsection; 
(2) seeking compensation for harmful interference from 
such entity; or 
(3) Global Positioning System receiver upgrades needed 
to address other resiliency requirements. 
SEC. 1662. LIMITATION ON AWARDING CONTRACTS TO ENTITIES OPER-
ATING 
COMMERCIAL 
TERRESTRIAL 
COMMUNICATION 
NETWORKS THAT CAUSE HARMFUL INTERFERENCE WITH 
THE GLOBAL POSITIONING SYSTEM. 
The Secretary of Defense may not enter into a contract, or 
extend or renew a contract, with an entity that engages in commer-
cial terrestrial operations using the 1525–1559 megahertz band 
or the 1626.5–1660.5 megahertz band unless the Secretary has 
certified to the congressional defense committees that such oper-
ations do not cause harmful interference to a Global Positioning 
System device of the Department of Defense. 
SEC. 1663. INDEPENDENT TECHNICAL REVIEW OF FEDERAL COMMU-
NICATIONS COMMISSION ORDER 20–48. 
(a) AGREEMENT.— 
(1) IN GENERAL.—The Secretary of Defense shall seek to 
enter into an agreement with the National Academies of 
Sciences, Engineering, and Medicine for the National Acad-
emies to perform the services covered by this section. 
(2) TIMING.—The Secretary shall seek to enter into the 
agreement described in paragraph (1) not later than 30 days 
after the date of the enactment of this Act. 
(b) INDEPENDENT TECHNICAL REVIEW.— 
(1) IN GENERAL.—Under an agreement between the Sec-
retary and the National Academies under subsection (a), the 
National Academies shall carry out an independent technical 
review of the Order and Authorization adopted by the Federal 
Communications Commission on April 19, 2020 (FCC 20–48), 
to the extent that such Order and Authorization affects the 
devices, operations, or activities of the Department of Defense. 
(2) ELEMENTS.—The independent technical review carried 
out under paragraph (1) shall include the following: 
(A) Comparison of the two different approaches on 
which the Commission relied for the Order and Authoriza-
tion described in paragraph (1) to evaluate the potential 
harmful interference concerns relating to Global Posi-
tioning System devices, with a recommendation on which 
method most effectively mitigates risks of harmful inter-
ference with Global Positioning System devices of the 
Department, or relating to or with the potential to affect 
the operations and activities of the Department.
H. R. 6395—688 
(B) Assessment of the potential for harmful inter-
ference to mobile satellite services, including commercial 
services and Global Positioning System services of the 
Department, or relating to or with the potential to affect 
the operations and activities of the Department. 
(C) Review of the feasibility, practicality, and effective-
ness of the proposed mitigation measures relating to, or 
with the potential to affect, the devices, operations, or 
activities of the Department. 
(D) Development of recommendations associated with 
the findings of the National Academies in carrying out 
the independent technical review. 
(E) Such other matters as the National Academies 
determines relevant. 
(c) REPORT.— 
(1) IN GENERAL.—Under an agreement between the Sec-
retary and the National Academies under subsection (a), the 
National Academies, not later than 270 days after the date 
of the execution of such agreement, shall submit to the Com-
mittee on Armed Services of the Senate and the Committee 
on Armed Services of the House of Representatives a report 
on the findings of the National Academies with respect to 
the independent technical review carried out under subsection 
(b) and the recommendations developed pursuant to such 
review. 
(2) FORM.—The report submitted under paragraph (1) shall 
be submitted in a publicly releasable and unclassified format, 
but may include a classified annex. 
SEC. 1664. ESTIMATE OF DAMAGES FROM FEDERAL COMMUNICATIONS 
COMMISSION ORDER 20–48. 
(a) LIMITATION, ESTIMATE, AND CERTIFICATION.—None of the 
funds authorized to be appropriated by this Act or otherwise made 
available for fiscal year 2021 may be obligated or expended by 
the Secretary of Defense to comply with the Order and Authoriza-
tion adopted by the Federal Communications Commission on April 
19, 2020 (FCC 20–48), until the Secretary— 
(1) submits to the congressional defense committees an 
estimate of the extent of covered costs and the range of eligible 
reimbursable costs associated with harmful interference 
resulting from such Order and Authorization to the Global 
Positioning System of the Department of Defense; and 
(2) certifies to the congressional defense committees that 
the estimate submitted under paragraph (1) is accurate with 
a high degree of certainty. 
(b) COVERED COSTS.—For purposes of this section, covered costs 
include costs that would be incurred— 
(1) to upgrade, repair, or replace potentially affected 
receivers of the Federal Government; 
(2) to modify, repair, or replace equipment, spares, associ-
ated 
ancillary 
equipment, 
software, 
facilities, 
operating 
manuals, training, or compliance with regulations, including 
with regard to the underlying platform or system in which 
a capability of the Global Positioning System is embedded; 
and
H. R. 6395—689 
(3) for personnel of the Department to engineer, validate, 
and verify that any required remediation provides the Depart-
ment with the same operational capability for the affected 
system prior to terrestrial operation in the 1525 to 1559 mega-
hertz or 1626.5 to 1660.5 megahertz bands of electromagnetic 
spectrum. 
(c) RANGE OF ELIGIBLE REIMBURSABLE COSTS.—For purposes 
of this section, the range of eligible reimbursable costs includes— 
(1) costs associated with engineering, equipment, software, 
site acquisition, and construction; 
(2) any transaction expense that the Secretary determines 
is legitimate and prudent; 
(3) costs relating to term-limited Federal civil servant and 
contractor staff; and 
(4) the costs of research, engineering studies, or other 
expenses the Secretary determines reasonably incurred. 
Subtitle F—Other Matters 
SEC. 1671. CONVENTIONAL PROMPT STRIKE. 
(a) INTEGRATION.—Section 1697(a) of the National Defense 
Authorization Act for Fiscal Year 2020 (Public Law 116–92; 133 
Stat. 1791) is amended by adding at the end the following new 
sentence: ‘‘The Secretary shall initiate efforts to integrate such 
technologies to DDG–1000 class destroyers during fiscal year 2021.’’. 
(b) REPORT ON STRATEGIC HYPERSONIC WEAPONS.— 
(1) REQUIREMENT.—Not later than 120 days after the date 
of the enactment of this Act, the Chairman of the Joint Chiefs 
of Staff, in coordination with the Under Secretary of Defense 
for Policy, shall submit to the congressional defense committees 
a report on strategic hypersonic weapons. 
(2) MATTERS INCLUDED.—The report under paragraph (1) 
shall include the following: 
(A) A discussion of the authority and policy processes 
to use hypersonic weapons and if, and how, such authorities 
would be delegated to the commanders of the combatant 
commands or to the Chiefs of the Armed Forces. 
(B) How escalation risks will be addressed with regards 
to the use of strategic hypersonic weapons, including— 
(i) whether any risk escalation exercises have been 
conducted or are planned for the potential use of 
hypersonic weapons; and 
(ii) an analysis of the escalation risks posed by 
foreign hypersonic systems that are potentially nuclear 
and conventional dual-use capable weapons. 
(C) The potential target sets for hypersonic weapons 
envisioned as of the date of the report and the required 
mission planning to support targeting by the United States 
Strategic Command and other combatant commands. 
(D) Identification of the process for the Department 
of Defense to establish targeting and release authority 
for conventional prompt strike hypersonic weapons. 
(E) A description of how the requirements for land- 
and sea-based hypersonic weapons will be addressed with 
the Joint Requirements Oversight Council, and how such 
requirements will be formally provided to the military
H. R. 6395—690 
departments procuring such weapons through an acquisi-
tion program described under section 804 of the National 
Defense Authorization Act for Fiscal Year 2016 (10 U.S.C. 
2302 note). 
(F) The required force structures, including necessary 
training, simulators, and range use needed by the Armed 
Forces, to support employment of such weapons against 
the classes of targets that will be held at risk. 
(G) With respect to the force structure of the Navy— 
(i) whether such weapons should be deployed on 
both submarines and surface combatants; and 
(ii) the number of such vessels that need to be 
so equipped. 
(H) A basing strategy for land-based launch platforms 
and a description of the actions needed to be taken for 
future deployment of such platforms. 
(3) FORM.—The report under paragraph (1) shall be sub-
mitted in unclassified form, but may include a classified annex. 
(c) ANNUAL REPORTS ON ACQUISITION.— 
(1) ARMY
AND
NAVY
PROGRAMS.—Except as provided by 
paragraph (3), not later than 30 days after the date on which 
the budget of the President for each of fiscal years 2022 through 
2025 is submitted to Congress pursuant to section 1105 of 
title 31, United States Code, the Secretary of the Army and 
the Secretary of the Navy shall jointly submit to the congres-
sional defense committees a report on the long-range hypersonic 
weapon program of the Army and the conventional prompt 
strike program of the Navy, including— 
(A) the total costs to the respective military depart-
ments for such programs; 
(B) the strategy for such programs with respect to 
manning, training, and equipping, including cost estimates; 
and 
(C) a testing strategy and schedule for such programs. 
(2) INDEPENDENT COST ESTIMATE.—Not later than 90 days 
after the date on which the budget of the President for fiscal 
year 2022 is submitted to Congress pursuant to section 1105 
of title 31, United States Code, the Director of Cost Assessment 
and Program Evaluation shall submit to the congressional 
defense committees an independent cost estimate for the long- 
range hypersonic weapon program of the Army and the conven-
tional prompt strike program of the Navy. 
(3) TERMINATION.—The requirement to submit a report 
under paragraph (1) shall terminate on the date on which 
the Secretary of Defense determines that the long-range 
hypersonic weapon program of the Army and the conventional 
prompt strike program of the Navy are unable to be acquired 
under the authority of section 804 of the National Defense 
Authorization Act for Fiscal Year 2016 (10 U.S.C. 2302 note). 
SEC. 1672. LIMITATION ON AVAILABILITY OF FUNDS RELATING TO 
REPORTS ON MISSILE SYSTEMS AND ARMS CONTROL 
TREATIES. 
(a) LIMITATION.— 
(1) IN GENERAL.—Beginning on the date that is 60 days 
after the date of the enactment of this Act, if the Secretary 
of Defense has not submitted the covered reports, not more
H. R. 6395—691 
than 50 percent of the funds specified in paragraph (2) may 
be obligated or expended until the date on which the covered 
reports have been submitted. 
(2) FUNDS SPECIFIED.—The funds specified in this para-
graph are the funds authorized to be appropriated by this 
Act or otherwise made available for fiscal year 2021 for the 
Office of the Under Secretary of Defense for Policy. 
(b) COVERED REPORTS DEFINED.—In this section, the term ‘‘cov-
ered reports’’ means— 
(1) the report under section 1698(b) of the National Defense 
Authorization Act for Fiscal Year 2020 (Public Law 116–92; 
133 Stat. 1792); and 
(2) the assessment under section 1236(b) of the National 
Defense Authorization Act for Fiscal Year 2020 (Public Law 
116–92; 133 Stat. 1650). 
SEC. 1673. SUBMISSION OF REPORTS UNDER MISSILE DEFENSE 
REVIEW AND NUCLEAR POSTURE REVIEW. 
Not later than 30 days after the date of the enactment of 
this Act, the Secretary of Defense shall submit to the congressional 
defense committees— 
(1) each report, assessment, and guidance document pro-
duced by the Department of Defense pursuant to the Missile 
Defense Review published in 2019 or during subsequent actions 
taken to implement the conclusions of the Review; and 
(2) each report, assessment, and guidance document pro-
duced by the Department pursuant to the Nuclear Posture 
Review published in 2018 or during subsequent actions taken 
to implement the conclusions of the Review. 
TITLE XVII—CYBERSPACE-RELATED 
MATTERS 
Sec. 1701. Modification of mission of Cyber Command and assignment of cyber op-
erations forces. 
Sec. 1702. Modification of scope of notification requirements for sensitive military 
cyber operations. 
Sec. 1703. Modification of requirements for quarterly Department of Defense cyber 
operations briefings for Congress. 
Sec. 1704. Clarification relating to protection from liability of operationally critical 
contractors. 
Sec. 1705. Strengthening Federal networks; CISA cybersecurity support to agen-
cies. 
Sec. 1706. Improvements relating to the quadrennial cyber posture review. 
Sec. 1707. Modification of authority to use operation and maintenance funds for 
cyber operations-peculiar capability development projects. 
Sec. 1708. Personnel management authority for Commander of United States 
Cyber Command and development program for offensive cyber oper-
ations. 
Sec. 1709. Applicability of reorientation of Big Data Platform program to Depart-
ment of Navy. 
Sec. 1710. Report on Cyber Institutes program. 
Sec. 1711. Modification of acquisition authority of Commander of United States 
Cyber Command. 
Sec. 1712. Modification of requirements relating to the Strategic Cybersecurity Pro-
gram and the evaluation of cyber vulnerabilities of major weapon sys-
tems of the Department of Defense. 
Sec. 1713. Modification of position of Principal Cyber Advisor. 
Sec. 1714. Cyberspace Solarium Commission. 
Sec. 1715. Establishment in Department of Homeland Security of joint cyber plan-
ning office. 
Sec. 1716. Subpoena authority.
H. R. 6395—692 
Sec. 1717. Cybersecurity State Coordinator. 
Sec. 1718. Cybersecurity Advisory Committee. 
Sec. 1719. Cybersecurity education and training assistance program. 
Sec. 1720. Framework for cyber hunt forward operations. 
Sec. 1721. Rationalization and integration of parallel cybersecurity architectures 
and operations. 
Sec. 1722. Assessing risk to national security of quantum computing. 
Sec. 1723. Tailored cyberspace operations organizations. 
Sec. 1724. Responsibility for cybersecurity and critical infrastructure protection of 
the defense industrial base. 
Sec. 1725. Pilot program on remote provision by National Guard to National 
Guards of other States of cybersecurity technical assistance in training, 
preparation, and response to cyber incidents. 
Sec. 1726. Department of Defense cyber workforce efforts. 
Sec. 1727. Reporting requirements for cross domain incidents and exemptions to 
policies for information technology. 
Sec. 1728. Assessing private-public collaboration in cybersecurity. 
Sec. 1729. Cyber capabilities and interoperability of the National Guard. 
Sec. 1730. Evaluation of non-traditional cyber support to the Department of De-
fense. 
Sec. 1731. Integrated cybersecurity center plan. 
Sec. 1732. Assessment of cyber operational planning and deconfliction policies and 
processes. 
Sec. 1733. Pilot program on cybersecurity capability metrics. 
Sec. 1734. Assessment of effect of inconsistent timing and use of Network Address 
Translation in Department of Defense networks. 
Sec. 1735. Integration of Department of Defense user activity monitoring and cy-
bersecurity. 
Sec. 1736. Defense industrial base cybersecurity sensor architecture plan. 
Sec. 1737. Assessment on defense industrial base participation in a threat informa-
tion sharing program. 
Sec. 1738. Assistance for small manufacturers in the defense industrial supply 
chain on matters relating to cybersecurity. 
Sec. 1739. Assessment on defense industrial base cybersecurity threat hunting pro-
gram. 
Sec. 1740. Defense Digital Service. 
Sec. 1741. Matters concerning the College of Information and Cyberspace and limi-
tation of funding for National Defense University. 
Sec. 1742. Department of Defense cyber hygiene and Cybersecurity Maturity Model 
Certification framework. 
Sec. 1743. Extension of sunset for pilot program on regional cybersecurity training 
center for the Army National Guard. 
Sec. 1744. National cyber exercises. 
Sec. 1745. Cybersecurity and Infrastructure Security Agency review. 
Sec. 1746. Report on enabling United States Cyber Command resource allocation. 
Sec. 1747. Ensuring cyber resiliency of nuclear command and control system. 
Sec. 1748. Requirements for review of and limitations on the Joint Regional Secu-
rity Stacks activity. 
Sec. 1749. Implementation of information operations matters. 
Sec. 1750. Report on use of encryption by Department of Defense national security 
systems. 
Sec. 1751. Guidance and direction on use of direct hiring processes for artificial in-
telligence professionals and other data science and software develop-
ment personnel. 
Sec. 1752. National Cyber Director. 
SEC. 1701. MODIFICATION OF MISSION OF CYBER COMMAND AND 
ASSIGNMENT OF CYBER OPERATIONS FORCES. 
Title 10, United States Code, is amended— 
(1) in section 167b— 
(A) in subsection (a)— 
(i) in the first sentence, by inserting ‘‘(1)’’ before 
‘‘With the advice’’; 
(ii) in paragraph (1), as designated by clause (i), 
by striking the second sentence; and 
(iii) by adding at the end the following new para-
graph: 
‘‘(2) The principal mission of the Cyber Command is to 
direct, synchronize, and coordinate military cyberspace plan-
ning and operations to defend and advance national interests
H. R. 6395—693 
in collaboration with domestic and international partners.’’; 
and 
(B) by amending subsection (b) to read as follows: 
‘‘(b) ASSIGNMENT
OF FORCES.—(1) Active and reserve cyber 
forces of the armed forces shall be assigned to the Cyber Command 
through the Global Force Management Process, as approved by 
the Secretary of Defense. 
‘‘(2) Cyber forces not assigned to Cyber Command remain 
assigned to combatant commands or service-retained.’’; and 
(2) in section 238— 
(A) in subsection (a)— 
(i) in the matter preceding paragraph (1)— 
(I) by striking ‘‘2017’’ and inserting ‘‘2021’’; 
and 
(II) by inserting ‘‘, in electronic and print for-
mats,’’ after ‘‘display’’; 
(ii) in paragraph (1), by inserting ‘‘and the cyber-
space operations forces’’ before the semicolon; 
(iii) in paragraph (2), by inserting ‘‘and the cyber-
space operations forces’’ before the period; 
(B) in subsection (b)— 
(i) in the matter preceding paragraph (1), by 
striking ‘‘2017’’ and inserting ‘‘2021’’; 
(ii) in paragraph (1), by striking ‘‘2017’’ and 
inserting ‘‘2021’’; and 
(iii) in paragraph (2), by striking ‘‘2018’’ and 
inserting ‘‘2022’’; and 
(C) by adding at the end the following new subsection: 
‘‘(c) SUBMISSION.—The Secretary shall provide the displays 
described in subsection (a)— 
‘‘(1) in electronic format not later than five days after 
the submission by the President under section 1105(a) of title 
31 of the budget; and 
‘‘(2) in print format not later than 21 days after the submis-
sion by the President under section 1105(a) of title 31 of the 
budget.’’. 
SEC. 1702. MODIFICATION OF SCOPE OF NOTIFICATION REQUIRE-
MENTS FOR SENSITIVE MILITARY CYBER OPERATIONS. 
Subsection (c) of section 395 of title 10, United States Code, 
is amended to read as follows: 
‘‘(c) SENSITIVE MILITARY CYBER OPERATION DEFINED.—(1) In 
this section, the term ‘sensitive military cyber operation’ means 
an action described in paragraph (2) that— 
‘‘(A) is carried out by the armed forces of the United 
States; 
‘‘(B) is intended to achieve a cyber effect against a 
foreign terrorist organization or a country, including its 
armed forces and the proxy forces of that country located 
elsewhere— 
‘‘(i) with which the armed forces of the United 
States are not involved in hostilities (as that term 
is used in section 4 of the War Powers Resolution 
(50 U.S.C. 1543)); or 
‘‘(ii) with respect to which the involvement of the 
armed forces of the United States in hostilities has
H. R. 6395—694 
not been acknowledged publicly by the United States; 
and 
‘‘(C)(i) is determined to— 
‘‘(I) have a medium or high collateral effects 
estimate; 
‘‘(II) have a medium or high intelligence gain 
or loss; 
‘‘(III) have a medium or high probability of 
political retaliation, as determined by the political 
military assessment contained within the associ-
ated concept of operations; 
‘‘(IV) have a medium or high probability of 
detection when detection is not intended; or 
‘‘(V) result in medium or high collateral effects; 
or 
‘‘(ii) is a matter the Secretary determines to be 
appropriate. 
‘‘(2) The actions described in this paragraph are the fol-
lowing: 
‘‘(A) An offensive cyber operation. 
‘‘(B) A defensive cyber operation.’’. 
SEC. 1703. MODIFICATION OF REQUIREMENTS FOR QUARTERLY 
DEPARTMENT 
OF 
DEFENSE 
CYBER 
OPERATIONS 
BRIEFINGS FOR CONGRESS. 
Section 484 of title 10, United States Code, is amended by 
striking subsections (a) and (b) and inserting the following new 
subsections: 
‘‘(a) BRIEFINGS REQUIRED.—The Under Secretary of Defense 
for Policy, the Commander of United States Cyber Command, and 
the Chairman of the Joint Chiefs of Staff, or designees from each 
of their offices, shall provide to the congressional defense commit-
tees quarterly briefings on all offensive and significant defensive 
military operations in cyberspace, including clandestine cyber activi-
ties, carried out by the Department of Defense during the imme-
diately preceding quarter. 
‘‘(b) ELEMENTS.—Each briefing under subsection (a) shall 
include, with respect to the military operations in cyberspace 
described in such subsection, the following: 
‘‘(1) An update, set forth separately for each applicable 
geographic and functional command, that describes the oper-
ations carried out in the area of operations of that command 
or by that command. 
‘‘(2) An update, set forth for each applicable geographic 
and functional command, that describes defensive cyber oper-
ations executed to protect or defend forces, networks, and equip-
ment in the area of operations of that command. 
‘‘(3) An update on relevant authorities and legal issues 
applicable to operations, including any presidential directives 
and delegations of authority received since the last quarterly 
update. 
‘‘(4) An overview of critical operational challenges posed 
by major adversaries or encountered in operational activities 
conducted since the last quarterly update. 
‘‘(5) An overview of the readiness of the Cyber Mission 
Forces to perform assigned missions that—
H. R. 6395—695 
‘‘(A) addresses all of the abilities of such Forces to 
conduct cyberspace operations based on capability and 
capacity of personnel, equipment, training, and equipment 
condition— 
‘‘(i) using both quantitative and qualitative 
metrics; and 
‘‘(ii) in a way that is common to all military depart-
ments; and 
‘‘(B) is consistent with readiness reporting pursuant 
to section 482 of this title. 
‘‘(6) Any other matters that the briefers determine to be 
appropriate. 
‘‘(c) DOCUMENTS.—Each briefing under subsection (a) shall 
include a classified placemat, summarizing the elements specified 
in paragraphs (1), (2), (3), and (5) of subsection (b), and an unclassi-
fied memorandum, summarizing the briefing’s contents.’’. 
SEC. 
1704. 
CLARIFICATION 
RELATING 
TO 
PROTECTION 
FROM 
LIABILITY OF OPERATIONALLY CRITICAL CONTRACTORS. 
Paragraph (1) of section 391(d) of title 10, United States Code, 
is amended— 
(1) by inserting ‘‘and contract requirements established 
pursuant to Defense Federal Acquisition Regulation Supple-
ment clause 252.204-7012, Safeguarding Covered Defense 
Information and Cyber Incident Reporting,’’ after ‘‘compliance 
with this section’’; and 
(2) by inserting ‘‘and such contract requirements’’ before 
the period. 
SEC. 1705. STRENGTHENING FEDERAL NETWORKS; CISA CYBERSECU-
RITY SUPPORT TO AGENCIES. 
Section 3553 of title 44, United States Code, is amended— 
(1) in subsection (b)— 
(A) in paragraph (6)(D), by striking ‘‘and’’ after the 
semicolon; 
(B) by redesignating paragraph (7) as paragraph (9); 
and 
(C) by inserting after paragraph (6) the following new 
paragraphs: 
‘‘(7) hunting for and identifying, with or without advance 
notice to or authorization from agencies, threats and 
vulnerabilities within Federal information systems; 
‘‘(8) upon request by an agency, and at the Secretary’s 
discretion, with or without reimbursement— 
‘‘(A) providing services, functions, and capabilities, 
including operation of the agency’s information security 
program, to assist the agency with meeting the require-
ments set forth in section 3554(b); and 
‘‘(B) deploying, operating, and maintaining secure tech-
nology platforms and tools, including networks and common 
business applications, for use by the agency to perform 
agency functions, including collecting, maintaining, storing, 
processing, disseminating, and analyzing information; and’’; 
and 
(2) by adding at the end the following new subsection: 
‘‘(l) INFORMATION SHARING.— 
‘‘(1) IN GENERAL.—Notwithstanding any other provision of 
law, including any provision of law that would otherwise restrict
H. R. 6395—696 
or prevent the head of an agency from disclosing information 
to the Secretary, the Secretary in carrying out this section 
and title XXII of the Homeland Security Act of 2002 (6 U.S.C. 
651 et seq.) may access, use, retain, and disclose, and the 
head of an agency may disclose to the Secretary, information, 
for the purpose of protecting information and information sys-
tems from cybersecurity risks. 
‘‘(2) EXCEPTION.—Paragraph (1) shall not apply to national 
security systems or to information systems described in para-
graph (2) or (3) of subsection (e).’’. 
SEC. 1706. IMPROVEMENTS RELATING TO THE QUADRENNIAL CYBER 
POSTURE REVIEW. 
Section 1644(c) of the National Defense Authorization Act for 
Fiscal Year 2018 (Public Law 115–91), as amended by section 
1635 of the National Defense Authorization Act for Fiscal Year 
2020 (Public Law 116–92), is further amended— 
(1) by amending paragraph (1) to read as follows: 
‘‘(1) The assessment and definition of the role of cyber 
forces in the national defense and military strategies of the 
United States.’’; 
(2) by amending paragraph (2) to read as follows: 
‘‘(2) Review of the following: 
‘‘(A) The role of cyber operations in combatant com-
mander warfighting plans. 
‘‘(B) The ability of combatant commanders to respond 
to adversary cyber attacks. 
‘‘(C) The international partner cyber capacity-building 
programs of the Department.’’; 
(3) by amending paragraph (3) to read as follows: 
‘‘(3) A review of the law, policies, and authorities relating 
to, and necessary for, the United States to maintain a safe, 
reliable, and credible cyber posture for defending against and 
responding to cyber attacks and for deterrence in cyberspace, 
including the following: 
‘‘(A) An assessment of the need for further delegation 
of cyber-related authorities, including those germane to 
information warfare, to the Commander of United States 
Cyber Command. 
‘‘(B) An evaluation of the adequacy of mission authori-
ties for all cyber-related military components, defense agen-
cies, directorates, centers, and commands.’’; 
(4) in paragraph (4), by striking ‘‘A declaratory’’ and 
inserting ‘‘A review of the need for or for updates to a declara-
tory’’; 
(5) in paragraph (5), by striking ‘‘Proposed’’ and inserting 
‘‘A review of’’; 
(6) by amending paragraph (6) to read as follows: 
‘‘(6) A review of a strategy to deter, degrade, or defeat 
malicious cyber activity targeting the United States (which 
may include activities, capability development, and operations 
other than cyber activities, cyber capability development, and 
cyber operations), including— 
‘‘(A) a review and assessment of various approaches 
to competition and deterrence in cyberspace, determined 
in consultation with experts from Government, academia, 
and industry;
H. R. 6395—697 
‘‘(B) a comparison of the strengths and weaknesses 
of the approaches identified pursuant to subparagraph (A) 
relative to the threat of each other; and 
‘‘(C) an assessment as to how the cyber strategy will 
inform country-specific campaign plans focused on key 
leadership of Russia, China, Iran, North Korea, and any 
other country the Secretary considers appropriate.’’; 
(7) by striking paragraph (8) and inserting the following 
new paragraph (8): 
‘‘(8) A comprehensive force structure assessment of the 
Cyber Operations Forces of the Department for the posture 
review period, including the following: 
‘‘(A) A determination of the appropriate size and com-
position of the Cyber Mission Forces to accomplish the 
mission requirements of the Department. 
‘‘(B) An assessment of the Cyber Mission Forces’ per-
sonnel, capabilities, equipment, funding, operational con-
cepts, and ability to execute cyber operations in a timely 
fashion. 
‘‘(C) An assessment of the personnel, capabilities, 
equipment, funding, and operational concepts of Cybersecu-
rity Service Providers and other elements of the Cyber 
Operations Forces.’’; 
(8) by redesignating paragraphs (9) through (11) as sub-
sections (12) through (14), respectively; and 
(9) by inserting after paragraph (8), the following new 
paragraphs: 
‘‘(9) An assessment of whether the Cyber Mission Force 
has the appropriate level of interoperability, integration, and 
interdependence with special operations and conventional 
forces. 
‘‘(10) An evaluation of the adequacy of mission authorities 
for the Joint Force Provider and Joint Force Trainer responsibil-
ities of United States Cyber Command, including the adequacy 
of the units designated as Cyber Operations Forces to support 
such responsibilities. 
‘‘(11) An assessment of the missions and resourcing of 
the combat support agencies in support of cyber missions of 
the Department.’’. 
SEC. 1707. MODIFICATION OF AUTHORITY TO USE OPERATION AND 
MAINTENANCE 
FUNDS 
FOR 
CYBER 
OPERATIONS- 
PECULIAR CAPABILITY DEVELOPMENT PROJECTS. 
Section 1640 of the National Defense Authorization Act for 
Fiscal Year 2020 (Public Law 116–92) is amended— 
(1) by redesignating subsections (b) and (c) as subsections 
(c) and (d), respectively; 
(2) in subsection (a)— 
(A) by striking ‘‘The Secretary of Defense’’ and 
inserting ‘‘Subject to subsection (b), the Commander of 
the United States Cyber Command’’; 
(B) by striking ‘‘per service’’ and inserting ‘‘per use’’; 
and 
(C) by striking ‘‘through 2022’’ and inserting ‘‘through 
2025’’; 
(3) by inserting after subsection (a) the following:
H. R. 6395—698 
‘‘(b) LIMITATION.—(1) Each fiscal year, the Secretaries of the 
military departments concerned may each obligate and expend 
under subsection (a) not more than $10,000,000. 
‘‘(2) Each fiscal year, the Commander of the United States 
Cyber Command may obligate and expend under subsection 
(a) not more than $6,000,000.’’; and 
(4) in subsection (d), as so redesignated, by striking 
‘‘through 2022’’ and inserting ‘‘through 2025’’. 
SEC. 1708. PERSONNEL MANAGEMENT AUTHORITY FOR COMMANDER 
OF UNITED STATES CYBER COMMAND AND DEVELOP-
MENT PROGRAM FOR OFFENSIVE CYBER OPERATIONS. 
(a) PERSONNEL MANAGEMENT AUTHORITY FOR COMMANDER OF 
UNITED STATES CYBER COMMAND TO ATTRACT EXPERTS IN SCIENCE 
AND ENGINEERING.—Section 1599h of title 10, United States Code, 
as amended by section 1602 of this Act, is further amended— 
(1) in subsection (a), by adding at the end the following: 
‘‘(8) UNITED
STATES
CYBER
COMMAND.—The Commander 
of United States Cyber Command may carry out a program 
of personnel management authority provided in subsection (b) 
in order to facilitate the recruitment of eminent experts in 
computer science, data science, engineering, mathematics, and 
computer network exploitation within the headquarters of 
United States Cyber Command and the Cyber National Mission 
Force.’’; and 
(2) in subsection (b)(1)— 
(A) in subparagraph (F), by striking ‘‘and’’ after the 
semicolon; 
(B) in subparagraph (G), by inserting ‘‘and’’ after the 
semicolon; and 
(C) by adding at the end the following new subpara-
graph: 
‘‘(H) in the case of United States Cyber Command, 
appoint computer scientists, data scientists, engineers, 
mathematicians, 
and 
computer 
network 
exploitation 
specialists to a total of not more than 10 scientific and 
engineering positions in the Command;’’. 
(b) 
PROGRAM
TO
DEVELOP
ACCESSES, 
DISCOVER 
VULNERABILITIES, AND ENGINEER CYBER TOOLS AND DEVELOP TAC-
TICS, TECHNIQUES, AND PROCEDURES FOR OFFENSIVE CYBER OPER-
ATIONS.— 
(1) IN GENERAL.—Pursuant to the authority provided under 
section 1599h(a)(8) of title 10, United States Code, as added 
by subsection (a), the Commander of United States Cyber Com-
mand shall establish a program or augment an existing pro-
gram within the Command to develop accesses, discover 
vulnerabilities, and engineer cyber tools and develop tactics, 
techniques, and procedures for the use of these assets and 
capabilities in offensive cyber operations. 
(2) ELEMENTS.—The program or augmented program 
required by paragraph (1) shall— 
(A) develop accesses, discover vulnerabilities, and engi-
neer cyber tools and develop tactics, techniques, and proce-
dures fit for Department of Defense military operations 
in cyberspace, such as reliability, meeting short develop-
ment and operational timelines, low cost, and expend-
ability;
H. R. 6395—699 
(B) aim to decrease the reliance of Cyber Command 
on accesses, tools, and expertise provided by the intelligence 
community; 
(C) be designed to provide technical and operational 
expertise on par with that of programs of the intelligence 
community; 
(D) enable the Commander to attract and retain exper-
tise resident in the private sector and other technologically 
elite government organizations; and 
(E) coordinate development activities with, and, as 
appropriate, facilitate transition of capabilities from, the 
Defense Advanced Research Projects Agency, the Strategic 
Capabilities Office, and components within the intelligence 
community. 
(3) INTELLIGENCE COMMUNITY DEFINED.—In this subsection, 
the term ‘‘intelligence community’’ has the meaning given such 
term in section 3 of the National Security Act of 1947 (50 
U.S.C. 3003). 
SEC. 1709. APPLICABILITY OF REORIENTATION OF BIG DATA PLAT-
FORM PROGRAM TO DEPARTMENT OF NAVY. 
(a) IN
GENERAL.—Section 1651 of the National Defense 
Authorization Act for Fiscal Year 2020 (Public Law 116–92) is 
amended by adding at the end the following new subsection: 
‘‘(f) APPLICABILITY.—The requirements of this section shall 
apply in full to the Department of the Navy, including the 
Sharkcage and associated programs.’’. 
(b) BRIEFING.—Not later than 90 days after the date of the 
enactment of this Act, the Secretary of the Navy, the program 
manager of the Unified Platform program, the Chief Information 
Officer, and the Principal Cyber Advisor shall jointly brief the 
congressional defense committees on the compliance of the Depart-
ment of the Navy with the requirements of such section, as amended 
by subsection (a). 
SEC. 1710. REPORT ON CYBER INSTITUTES PROGRAM. 
Section 1640 of the John S. McCain National Defense 
Authorization Act for Fiscal Year 2019 (Public Law 115–232; 132 
Stat. 2310; 10 U.S.C. 2200 note) is amended by adding at the 
end the following: 
‘‘(g) REPORT TO CONGRESS.—Not later than September 30, 2021, 
the Secretary of Defense shall submit to the Committees on Armed 
Services of the Senate and the House of Representatives a report 
on the effectiveness of the Cyber Institutes and on opportunities 
to expand the Cyber Institutes to additional select institutions 
of higher learning that have a Reserve Officers’ Training Corps 
program.’’. 
SEC. 1711. MODIFICATION OF ACQUISITION AUTHORITY OF COM-
MANDER OF UNITED STATES CYBER COMMAND. 
Section 807 of the National Defense Authorization Act for Fiscal 
Year 2016 (Public Law 114–92; 10 U.S.C. 2224 note) is amended— 
(1) by striking subsections (e) and (i); and 
(2) by redesignating subsections (f) through (h) as sub-
sections (e) through (g), respectively.
H. R. 6395—700 
SEC. 1712. MODIFICATION OF REQUIREMENTS RELATING TO THE STRA-
TEGIC CYBERSECURITY PROGRAM AND THE EVALUATION 
OF CYBER VULNERABILITIES OF MAJOR WEAPON SYS-
TEMS OF THE DEPARTMENT OF DEFENSE. 
(a) EVALUATION OF CYBER VULNERABILITIES OF MAJOR WEAPON 
SYSTEMS OF THE DEPARTMENT OF DEFENSE.— 
(1) IN
GENERAL.—Section 1647 of the National Defense 
Authorization Act for Fiscal Year 2016 (Public Law 114–92; 
10 U.S.C. 2224 note), as amended by section 1633 of the 
National Defense Authorization Act for Fiscal Year 2020 (Public 
Law 116–92), is further amended by adding at the end the 
following new subsections: 
‘‘(i) ESTABLISHING REQUIREMENTS FOR PERIODICITY OF VULNER-
ABILITY REVIEWS.—The Secretary of Defense shall establish policies 
and requirements for each major weapon system, and the priority 
critical infrastructure essential to the proper functioning of major 
weapon systems in broader mission areas, to be re-assessed for 
cyber vulnerabilities, taking into account upgrades or other modi-
fications to systems and changes in the threat landscape. 
‘‘(j) IDENTIFICATION OF SENIOR OFFICIAL.—Each secretary of 
a military department shall identify a senior official who shall 
be responsible for ensuring that cyber vulnerability assessments 
and mitigations for weapon systems and critical infrastructure are 
planned, funded, and carried out.’’. 
(2) TECHNICAL
CORRECTION.—Such section 1647 of the 
National Defense Authorization Act for Fiscal Year 2016 is 
further amended— 
(A) by redesignating subsection (g) as subsection (h); 
and 
(B) by redesignating the second subsection (f), as added 
by section 1633 of the National Defense Authorization Act 
for Fiscal Year 2020, as subsection (g). 
(b) STRATEGIC CYBERSECURITY PROGRAM.—Section 1640 of the 
National Defense Authorization Act for Fiscal Year 2018 (Public 
Law 115–91; 10 U.S.C. 2224 note), is amended by striking sub-
sections (a) through (e) and inserting the following new subsections: 
‘‘(a) IN GENERAL.—Not later than August 1, 2021, the Secretary 
of Defense shall, acting through the Under Secretary of Defense 
for Acquisition and Sustainment, the Chief Information Officer, 
the Vice Chairman of the Joint Chiefs of Staff, the Commander 
of United States Cyber Command, and the Director of the National 
Security Agency, establish a program to be known as the ‘Strategic 
Cybersecurity Program’ (in this section referred to as the ‘Program’) 
to ensure that the Department of Defense is always able to conduct 
the most important military missions of the Department. 
‘‘(b) PERSONNEL SUPPORT TO THE PROGRAM.— 
‘‘(1) IN GENERAL.—The Director of the National Security 
Agency shall establish a program office within the Cybersecu-
rity Directorate to support the Program by identifying threats 
to, vulnerabilities in, and remediations for the missions and 
mission elements described in paragraph (1) of subsection (c). 
Such program office shall be headed by a program manager 
selected by the Director. 
‘‘(2) NATIONAL SECURITY AGENCY PROGRAM OFFICE STAFF 
AUGMENTATION.—The Secretary may augment the personnel 
assigned to the program office required under paragraph (1) 
by assigning personnel as appropriate from among regular and
H. R. 6395—701 
reserve members of the Armed Forces, civilian employees of 
the Department of Defense (including the Defense intelligence 
agencies), and personnel of the research laboratories of the 
Department and the Department of Energy, who have par-
ticular expertise in the areas of responsibility described in 
subsection (c). 
‘‘(3) DEPARTMENT OF ENERGY PERSONNEL.—Any personnel 
assigned to the program office from among personnel of the 
Department of Energy shall be so assigned with the concurrence 
of the Secretary of Energy. 
‘‘(c) RESPONSIBILITIES.— 
‘‘(1) DESIGNATION OF MISSION ELEMENTS OF THE PROGRAM.— 
The Under Secretary of Defense for Policy, the Under Secretary 
of Defense for Acquisition and Sustainment, and the Vice Chair-
man of the Joint Chiefs of Staff shall identify and designate 
for inclusion in the Program all of the systems, critical infra-
structure, kill chains, and processes, including systems and 
components in development, that comprise the following mili-
tary missions of the Department of Defense: 
‘‘(A) Nuclear deterrence and strike. 
‘‘(B) Select long-range conventional strike missions ger-
mane to the warfighting plans of United States European 
Command and United States Indo-Pacific Command. 
‘‘(C) Offensive cyber operations. 
‘‘(D) Homeland missile defense. 
‘‘(2) OFFICE OF THE UNDER SECRETARY OF DEFENSE FOR 
ACQUISITION AND SUSTAINMENT.—The Office of the Under Sec-
retary of Defense for Acquisition and Sustainment shall serve 
as the office of primary responsibility for the Program, providing 
policy, direction, and oversight regarding the execution of the 
National Security Agency program manager’s responsibilities 
described in paragraph (5). 
‘‘(3) VICE CHAIRMAN OF THE JOINT CHIEFS OF STAFF.—The 
Vice Chairman of the Joint Chiefs of Staff shall coordinate 
the identification and prioritization of the missions and mission 
components, and the development and approval of requirements 
relating to the cybersecurity of the missions and mission compo-
nents, of the Program. 
‘‘(4) CHIEF INFORMATION OFFICER.—The Chief Information 
Officer, in exercising authority, direction, and control over the 
Cybersecurity Directorate of the National Security Agency, shall 
ensure that the National Security Agency program office is 
responsive to the requirements and direction of the Under 
Secretary of Defense for Acquisition and Sustainment. 
‘‘(5) PROGRAM MANAGER.—The program manager shall be 
responsible for— 
‘‘(A) Conducting end-to-end vulnerability assessments 
of the missions of the Program and their constituent sys-
tems, infrastructure, kill chains, and processes. 
‘‘(B) Prioritizing and facilitating the remediation of 
identified vulnerabilities in the constituent systems, infra-
structure, kill chains, and processes of the missions of 
the Program. 
‘‘(C) Conducting, prior to the Milestone B approval 
for any such system or infrastructure, appropriate reviews 
of acquisition and system engineering plans for proposed 
systems and infrastructure germane to the missions of
H. R. 6395—702 
the Program, in accordance with the Under Secretary of 
Defense for Acquisition and Sustainment’s policy and guid-
ance regarding the components of such reviews and the 
range of systems and infrastructure to be reviewed. 
‘‘(D) Advising the military departments, combatant 
commands, and Joint Staff on the vulnerabilities and 
cyberattack vectors that pose substantial risk to the mis-
sions of the Program and their constituent systems, critical 
infrastructure, kill chains, or processes. 
‘‘(6) SECRETARY OF DEFENSE DIRECTIVE.—The Secretary of 
Defense shall define and issue guidance on the roles and respon-
sibilities for other components with respect to the Program, 
including— 
‘‘(A) 
the 
military 
departments’ 
acquisition 
and 
sustainment organizations in supporting and implementing 
remedial actions; 
‘‘(B) the alignment of Cyber Protection Teams with 
the prioritized missions of the Program; 
‘‘(C) the role of the Director of Operational Test and 
Evaluation in conducting periodic assessments, including 
through red teams, of the cybersecurity of missions in 
the Program; and 
‘‘(D) the role of the Principal Cyber Adviser in coordi-
nating and monitoring the Department’s execution of the 
Program. 
‘‘(d) INTEGRATION WITH OTHER EFFORTS.—The Under Secretary 
of Defense for Acquisition and Sustainment shall ensure that the 
Program builds upon, and does not duplicate, other efforts of the 
Department of Defense relating to cybersecurity, including the fol-
lowing: 
‘‘(1) The evaluation of cyber vulnerabilities of major weapon 
systems of the Department of Defense required under section 
1647 of the National Defense Authorization Act for Fiscal Year 
2016 (Public Law 114–92). 
‘‘(2) The evaluation of cyber vulnerabilities of Department 
of Defense critical infrastructure required under section 1650 
of the National Defense Authorization Act for Fiscal year 2017 
(Public Law 114–328; 10 U.S.C. 2224 note). 
‘‘(3) The activities of the cyber protection teams of the 
Department of Defense. 
‘‘(e) BRIEFING.—Not later than December 1, 2021, the Secretary 
of Defense shall provide to the congressional defense committees 
a briefing on the establishment of the Program, and the plans, 
funding, and staffing of the Program.’’. 
SEC. 1713. MODIFICATION OF POSITION OF PRINCIPAL CYBER 
ADVISOR. 
(a) IN GENERAL.—Subsection (c) of section 932 of the National 
Defense Authorization Act for Fiscal Year 2014 (Public Law 113– 
66; 10 U.S.C. 2224 note) is amended to read as follows: 
‘‘(c) PRINCIPAL CYBER ADVISOR.— 
‘‘(1) DESIGNATION.—The Secretary shall designate a Prin-
cipal Cyber Advisor from among those civilian officials of the 
Department of Defense who have been appointed to the posi-
tions in which they serve by the President, by and with the 
advice and consent of the Senate.
H. R. 6395—703 
‘‘(2) RESPONSIBILITIES.—The Principal Cyber Advisor shall 
be responsible for the following: 
‘‘(A) Acting as the principal advisor to the Secretary 
on military cyber forces and activities. 
‘‘(B) Overall integration of Cyber Operations Forces 
activities relating to cyberspace operations, including asso-
ciated policy and operational considerations, resources, per-
sonnel, technology development and transition, and acquisi-
tion. 
‘‘(C) Assessing and overseeing the implementation of 
the cyber strategy of the Department and execution of 
the cyber posture review of the Department on behalf of 
the Secretary. 
‘‘(D) Coordinating activities pursuant to subparagraphs 
(A) and (B) of subsection (c)(3) with the Principal Informa-
tion Operations Advisor, the Chief Information Officer of 
the Department, and other officials as determined by the 
Secretary of Defense, to ensure the integration of activities 
in support of cyber, information, and electromagnetic spec-
trum operations. 
‘‘(E) Such other matters relating to the offensive mili-
tary cyber forces of the Department as the Secretary shall 
specify for the purposes of this subsection. 
‘‘(3) CROSS-FUNCTIONAL TEAM.—Consistent with section 911 
of the National Defense Authorization Act for Fiscal Year 2017 
(Public Law 114–328; 10 U.S.C. 111 note), the Principal Cyber 
Advisor shall— 
‘‘(A) integrate the cyber expertise and perspectives of 
appropriate organizations within the Office of the Secretary 
of Defense, Joint Staff, military departments, the Defense 
Agencies and Field Activities, and combatant commands, 
by establishing and maintaining a full-time cross-functional 
team of subject matter experts from those organizations; 
and 
‘‘(B) select team members, and designate a team leader, 
from among those personnel nominated by the heads of 
such organizations.’’. 
(b) DESIGNATION OF DEPUTY PRINCIPAL CYBER ADVISOR.—Sec-
tion 905(a)(1) of the National Defense Authorization Act for Fiscal 
Year 2020 (Public Law 116–92) is amended by striking ‘‘Under 
Secretary of Defense for Policy’’ and inserting ‘‘Secretary of 
Defense’’. 
SEC. 1714. CYBERSPACE SOLARIUM COMMISSION. 
Section 1652 of the John S. McCain National Defense 
Authorization Act for Fiscal Year 2019 (Public Law 115–232), is 
amended— 
(1) in subsection (b)(1)— 
(A) in subparagraph (A), by— 
(i) striking clauses (i) through (iv); and 
(ii) redesignating clauses (v) through (viii) as 
clauses (i) through (iv), respectively; and 
(B) in subparagraph (B)(i), by striking ‘‘and who are 
appointed under clauses (iv) through (vii) of subparagraph 
(A)’’; 
(2) in subsection (d)(2), by striking ‘‘Seven’’ and inserting 
‘‘Six’’;
H. R. 6395—704 
(3) in subsection (h), by— 
(B) striking ‘‘(1) IN GENERAL.—’’; and 
(C) striking paragraph (2); 
(4) in subsection (i)(1)(B), by striking ‘‘officers or employees 
of the United States or’’; and 
(5) in subsection (k)(2)— 
(A) in subparagraph (A)— 
(i) by striking ‘‘at the end of the 120-day period 
beginning on’’ and inserting ‘‘20 months after’’; and 
(ii) by adding at the end the following new sen-
tence: ‘‘No extension of the Commission is permitted.’’; 
(B) in subparagraph (B), by— 
(i) striking ‘‘may use the 120-day’’ and inserting 
‘‘shall use the 20-month’’; 
(ii) striking ‘‘for the purposes of concluding its 
activities, including providing testimony to Congress 
concerning the final report referred to in that para-
graph and disseminating the report’’ and inserting the 
following: ‘‘for the purposes of—’’: 
‘‘(i) collecting and assessing comments and feed-
back from the Executive Branch, academia, and the 
public on the analysis and recommendations contained 
in the Commission’s report; 
‘‘(ii) collecting and assessing any developments in 
cybersecurity that may affect the analysis and rec-
ommendations contained in the Commission’s report; 
‘‘(iii) reviewing the implementation of the rec-
ommendations contained in the Commission’s report; 
‘‘(iv) revising, amending, or making new rec-
ommendations based on the assessments and reviews 
required under clauses (i)–(iii); 
‘‘(v) providing an annual update to the congres-
sional defense committees, the congressional intel-
ligence committees, the Committee on Homeland Secu-
rity of the House of Representatives, the Committee 
on Homeland Security and Governmental Affairs of 
the Senate, the Director of National Intelligence, the 
Secretary of Defense, and the Secretary of Homeland 
Security in a manner and format determined by the 
Commission regarding any such revisions, amend-
ments, or new recommendations; and 
‘‘(vi) concluding its activities, including providing 
testimony to Congress concerning the final report 
referred to in that paragraph and disseminating the 
report.’’; and 
(C) by adding at the end the following new subpara-
graph: 
‘‘(C) If the Commission is extended, and the effective 
date of such extension is after the date on which the 
Commission terminated, the Commission shall be deemed 
reconstituted with the same members and powers that 
existed on the day before such termination date, except 
that— 
‘‘(i) a member of the Commission may serve only 
if the member’s position continues to be authorized 
under subsection (b);
H. R. 6395—705 
‘‘(ii) no compensation or entitlements relating to 
a person’s status with the Commission shall be due 
for the period between the termination and reconstitu-
tion of the Commission; 
‘‘(iii) nothing in this subparagraph may be con-
strued as requiring the extension or reemployment 
of any staff member or contractor working for the 
Commission; 
‘‘(iv) the staff of the Commission shall be— 
‘‘(I) selected by the co-chairs of the Commission 
in accordance with subsection (h)(1); 
‘‘(II) comprised of not more than four individ-
uals, including a staff director; and 
‘‘(III) resourced in accordance with subsection 
(g)(4)(A); 
‘‘(v) with the approval of the co-chairs, may be 
provided by contract with a nongovernmental organiza-
tion; 
‘‘(vi) any unexpended funds made available for the 
use of the Commission shall continue to be available 
for use for the life of the Commission, as well as 
any additional funds appropriated to the Department 
of Defense that are made available to the Commission, 
provided that the total such funds does not exceed 
$1,000,000 from the reconstitution of the Commission 
to the completion of the Commission; and 
‘‘(vii) the requirement for an assessment of the 
final report in subsection (l) shall be updated to require 
every ten months for a period of 20 months further 
assessments of the Federal Government’s responses 
to the Commission’s recommendations contained in 
such final report.’’. 
SEC. 1715. ESTABLISHMENT IN DEPARTMENT OF HOMELAND SECU-
RITY OF JOINT CYBER PLANNING OFFICE. 
(a) AMENDMENT.—Subtitle A of title XXII of the Homeland 
Security Act of 2002 (6 U.S.C. 651 et seq.) is amended by adding 
at the end the following new section: 
‘‘SEC. 2215. JOINT CYBER PLANNING OFFICE. 
‘‘(a) ESTABLISHMENT OF OFFICE.—There is established in the 
Agency an office for joint cyber planning (in this section referred 
to as the ‘Office’) to develop, for public and private sector entities, 
plans for cyber defense operations, including the development of 
a set of coordinated actions to protect, detect, respond to, and 
recover from cybersecurity risks or incidents or limit, mitigate, 
or defend against coordinated, malicious cyber operations that pose 
a potential risk to critical infrastructure or national interests. The 
Office shall be headed by a senior official of the Agency selected 
by the Director. 
‘‘(b) PLANNING AND EXECUTION.—In leading the development 
of plans for cyber defense operations pursuant to subsection (a), 
the head of the Office shall— 
‘‘(1) coordinate with relevant Federal departments and 
agencies to establish processes and procedures necessary to 
develop and maintain ongoing coordinated plans for cyber 
defense operations;
H. R. 6395—706 
‘‘(2) leverage cyber capabilities and authorities of partici-
pating Federal departments and agencies, as appropriate, in 
furtherance of plans for cyber defense operations; 
‘‘(3) ensure that plans for cyber defense operations are, 
to the greatest extent practicable, developed in collaboration 
with relevant private sector entities, particularly in areas in 
which such entities have comparative advantages in limiting, 
mitigating, or defending against a cybersecurity risk or incident 
or coordinated, malicious cyber operation; 
‘‘(4) ensure that plans for cyber defense operations, as 
appropriate, are responsive to potential adversary activity con-
ducted in response to United States offensive cyber operations; 
‘‘(5) facilitate the exercise of plans for cyber defense oper-
ations, including by developing and modeling scenarios based 
on an understanding of adversary threats to, vulnerability of, 
and potential consequences of disruption or compromise of crit-
ical infrastructure; 
‘‘(6) coordinate with and, as necessary, support relevant 
Federal departments and agencies in the establishment of 
procedures, development of additional plans, including for offen-
sive and intelligence activities in support of cyber defense oper-
ations, and creation of agreements necessary for the rapid 
execution of plans for cyber defense operations when a cyberse-
curity risk or incident or malicious cyber operation has been 
identified; and 
‘‘(7) support public and private sector entities, as appro-
priate, in the execution of plans developed pursuant to this 
section. 
‘‘(c) COMPOSITION.—The Office shall be composed of— 
‘‘(1) a central planning staff; and 
‘‘(2) appropriate representatives of Federal departments 
and agencies, including— 
‘‘(A) the Department; 
‘‘(B) United States Cyber Command; 
‘‘(C) the National Security Agency; 
‘‘(D) the Federal Bureau of Investigation; 
‘‘(E) the Department of Justice; and 
‘‘(F) the Office of the Director of National Intelligence. 
‘‘(d) CONSULTATION.—In carrying out its responsibilities 
described in subsection (b), the Office shall regularly consult with 
appropriate representatives of non-Federal entities, such as— 
‘‘(1) State, local, federally-recognized Tribal, and territorial 
governments; 
‘‘(2) information sharing and analysis organizations, 
including information sharing and analysis centers; 
‘‘(3) owners and operators of critical information systems; 
‘‘(4) private entities; and 
‘‘(5) other appropriate representatives or entities, as deter-
mined by the Secretary. 
‘‘(e) INTERAGENCY AGREEMENTS.—The Secretary and the head 
of a Federal department or agency referred to in subsection (c) 
may enter into agreements for the purpose of detailing personnel 
on a reimbursable or non-reimbursable basis. 
‘‘(f) DEFINITIONS.—In this section: 
‘‘(1) CYBER DEFENSE OPERATION.—The term ‘cyber defense 
operation’ means defensive activities performed for a cybersecu-
rity purpose.
H. R. 6395—707 
‘‘(2) CYBERSECURITY
PURPOSE.—The term ‘cybersecurity 
purpose’ has the meaning given such term in section 102 of 
the Cybersecurity Act of 2015 (contained in division N of the 
Consolidated Appropriations Act, 2016 (Public Law 114–113; 
6 U.S.C. 1501)). 
‘‘(3) CYBERSECURITY RISK; INCIDENT.—The terms ‘cybersecu-
rity risk’ and ‘incident’ have the meanings given such terms 
in section 2209. 
‘‘(4) INFORMATION SHARING AND ANALYSIS ORGANIZATION.— 
The term ‘information sharing and analysis organization’ has 
the meaning given such term in section 2222(5).’’. 
(b) TECHNICAL AND CONFORMING AMENDMENT.—The table of 
contents in section 1(b) of the Homeland Security Act of 2002 
is amended by inserting after the item relating to section 2214 
the following new item: 
‘‘Sec. 2215. Joint cyber planning office.’’. 
SEC. 1716. SUBPOENA AUTHORITY. 
(a) IN GENERAL.—Section 2209 of the Homeland Security Act 
of 2002 (6 U.S.C. 659) is amended— 
(1) in subsection (a)— 
(A) by redesignating paragraphs (1) through (6) as 
paragraphs (2) through (7), respectively; 
(B) by inserting before paragraph (2), as so redesig-
nated, the following new paragraph: 
‘‘(1) the term ‘cybersecurity purpose’ has the meaning given 
that term in section 102 of the Cybersecurity Information 
Sharing Act of 2015 (6 U.S.C. 1501);’’; 
(C) in paragraph (6), as so redesignated, by striking 
‘‘and’’ at the end; 
(D) by redesignating paragraph (7), as so redesignated, 
as paragraph (8); and 
(E) by inserting after paragraph (6), as so redesignated, 
the following new paragraph: 
‘‘(7) the term ‘security vulnerability’ has the meaning given 
that term in section 102 of the Cybersecurity Information 
Sharing Act of 2015 (6 U.S.C. 1501); and’’; 
(2) in subsection (c)— 
(A) in paragraph (10), by striking ‘‘and’’ at the end; 
(B) in paragraph (11), by striking the period at the 
end and inserting ‘‘; and’’; and 
(C) by adding at the end the following new paragraph: 
‘‘(12) detecting, identifying, and receiving information for 
a cybersecurity purpose about security vulnerabilities relating 
to critical infrastructure in information systems and devices.’’; 
and 
(3) by adding at the end the following new subsection: 
‘‘(o) SUBPOENA AUTHORITY.— 
‘‘(1) DEFINITION.—In this subsection, the term ‘covered 
device or system’— 
‘‘(A) means a device or system commonly used to per-
form industrial, commercial, scientific, or governmental 
functions or processes that relate to critical infrastructure, 
including operational and industrial control systems, 
distributed control systems, and programmable logic 
controllers; and
H. R. 6395—708 
‘‘(B) does not include personal devices and systems, 
such as consumer mobile devices, home computers, residen-
tial wireless routers, or residential internet enabled con-
sumer devices. 
‘‘(2) AUTHORITY.— 
‘‘(A) IN GENERAL.—If the Director identifies a system 
connected to the internet with a specific security vulner-
ability and has reason to believe such security vulnerability 
relates to critical infrastructure and affects a covered device 
or system, and the Director is unable to identify the entity 
at risk that owns or operates such covered device or system, 
the Director may issue a subpoena for the production of 
information necessary to identify and notify such entity 
at risk, in order to carry out a function authorized under 
subsection (c)(12). 
‘‘(B) LIMIT
ON
INFORMATION.—A subpoena issued 
pursuant to subparagraph (A) may seek information— 
‘‘(i) only in the categories set forth in subpara-
graphs (A), (B), (D), and (E) of section 2703(c)(2) of 
title 18, United States Code; and 
‘‘(ii) for not more than 20 covered devices or sys-
tems. 
‘‘(C) LIABILITY
PROTECTIONS
FOR
DISCLOSING
PRO-
VIDERS.—The provisions of section 2703(e) of title 18, 
United States Code, shall apply to any subpoena issued 
pursuant to subparagraph (A). 
‘‘(3) COORDINATION.— 
‘‘(A) IN GENERAL.—If the Director exercises the sub-
poena authority under this subsection, and in the interest 
of avoiding interference with ongoing law enforcement 
investigations, the Director shall coordinate the issuance 
of any such subpoena with the Department of Justice, 
including the Federal Bureau of Investigation, pursuant 
to interagency procedures which the Director, in coordina-
tion with the Attorney General, shall develop not later 
than 60 days after the date of the enactment of this sub-
section. 
‘‘(B) CONTENTS.—The inter-agency procedures devel-
oped under this paragraph shall provide that a subpoena 
issued by the Director under this subsection shall be— 
‘‘(i) issued to carry out a function described in 
subsection (c)(12); and 
‘‘(ii) subject to the limitations specified in this sub-
section. 
‘‘(4) NONCOMPLIANCE.—If any person, partnership, corpora-
tion, association, or entity fails to comply with any duly served 
subpoena issued pursuant to this subsection, the Director may 
request that the Attorney General seek enforcement of such 
subpoena in any judicial district in which such person, partner-
ship, corporation, association, or entity resides, is found, or 
transacts business. 
‘‘(5) NOTICE.—Not later than seven days after the date 
on which the Director receives information obtained through 
a subpoena issued pursuant to this subsection, the Director 
shall notify any entity identified by information obtained pursu-
ant to such subpoena regarding such subpoena and the identi-
fied vulnerability.
H. R. 6395—709 
‘‘(6) AUTHENTICATION.— 
‘‘(A) IN GENERAL.—Any subpoena issued pursuant to 
this subsection shall be authenticated with a cryptographic 
digital signature of an authorized representative of the 
Agency, or other comparable successor technology, that 
allows the Agency to demonstrate that such subpoena was 
issued by the Agency and has not been altered or modified 
since such issuance. 
‘‘(B) INVALID IF NOT AUTHENTICATED.—Any subpoena 
issued pursuant to this subsection that is not authenticated 
in accordance with subparagraph (A) shall not be consid-
ered to be valid by the recipient of such subpoena. 
‘‘(7) PROCEDURES.—Not later than 90 days after the date 
of the enactment of this subsection, the Director shall establish 
internal procedures and associated training, applicable to 
employees and operations of the Agency, regarding subpoenas 
issued pursuant to this subsection, which shall address the 
following: 
‘‘(A) The protection of and restriction on dissemination 
of nonpublic information obtained through such a subpoena, 
including a requirement that the Agency not disseminate 
nonpublic information obtained through such a subpoena 
that identifies the party that is subject to such subpoena 
or the entity at risk identified by information obtained, 
except that the Agency may share the nonpublic informa-
tion with the Department of Justice for the purpose of 
enforcing such subpoena in accordance with paragraph (4), 
and may share with a Federal agency the nonpublic 
information of the entity at risk if— 
‘‘(i) the Agency identifies or is notified of a cyberse-
curity incident involving such entity, which relates 
to the vulnerability which led to the issuance of such 
subpoena; 
‘‘(ii) the Director determines that sharing the non-
public information with another Federal department 
or agency is necessary to allow such department or 
agency to take a law enforcement or national security 
action, consistent with the interagency procedures 
under paragraph (3)(A), or actions related to mitigating 
or otherwise resolving such incident; 
‘‘(iii) the entity to which the information pertains 
is notified of the Director’s determination, to the extent 
practicable consistent with national security or law 
enforcement interests, consistent with such interagency 
procedures; and 
‘‘(iv) the entity consents, except that the entity’s 
consent shall not be required if another Federal depart-
ment or agency identifies the entity to the Agency 
in connection with a suspected cybersecurity incident. 
‘‘(B) The restriction on the use of information obtained 
through such a subpoena for a cybersecurity purpose. 
‘‘(C) The retention and destruction of nonpublic 
information obtained through such a subpoena, including— 
‘‘(i) destruction of such information that the 
Director determines is unrelated to critical infrastruc-
ture immediately upon providing notice to the entity 
pursuant to paragraph (5); and
H. R. 6395—710 
‘‘(ii) destruction of any personally identifiable 
information not later than 6 months after the date 
on which the Director receives information obtained 
through such a subpoena, unless otherwise agreed to 
by 
the 
individual 
identified 
by 
the 
subpoena 
respondent. 
‘‘(D) The processes for providing notice to each party 
that is subject to such a subpoena and each entity identified 
by information obtained under such a subpoena. 
‘‘(E) The processes and criteria for conducting critical 
infrastructure security risk assessments to determine 
whether a subpoena is necessary prior to being issued 
pursuant to this subsection. 
‘‘(F) The information to be provided to an entity at 
risk at the time of the notice of the vulnerability, which 
shall include— 
‘‘(i) a discussion or statement that responding to, 
or subsequent engagement with, the Agency, is vol-
untary; and 
‘‘(ii) 
to 
the 
extent 
practicable, 
information 
regarding the process through which the Director 
identifies security vulnerabilities. 
‘‘(8) LIMITATION ON PROCEDURES.—The internal procedures 
established pursuant to paragraph (7) may not require an owner 
or operator of critical infrastructure to take any action as 
a result of a notice of vulnerability made pursuant to this 
Act. 
‘‘(9) REVIEW OF PROCEDURES.—Not later than 1 year after 
the date of the enactment of this subsection, the Privacy Officer 
of the Agency shall— 
‘‘(A) review the internal procedures established pursu-
ant to paragraph (7) to ensure that— 
‘‘(i) such procedures are consistent with fair 
information practices; and 
‘‘(ii) the operations of the Agency comply with such 
procedures; and 
‘‘(B) notify the Committee on Homeland Security and 
Governmental Affairs of the Senate and the Committee 
on Homeland Security of the House of Representatives 
of the results of the review under subparagraph (A). 
‘‘(10) PUBLICATION OF INFORMATION.—Not later than 120 
days after establishing the internal procedures under paragraph 
(7), the Director shall publish information on the website of 
the Agency regarding the subpoena process under this sub-
section, including information regarding the following: 
‘‘(A) Such internal procedures. 
‘‘(B) The purpose for subpoenas issued pursuant to 
this subsection. 
‘‘(C) The subpoena process. 
‘‘(D) The criteria for the critical infrastructure security 
risk assessment conducted prior to issuing a subpoena. 
‘‘(E) Policies and procedures on retention and sharing 
of data obtained by subpoenas. 
‘‘(F) Guidelines on how entities contacted by the 
Director may respond to notice of a subpoena.
H. R. 6395—711 
‘‘(11) ANNUAL
REPORTS.—The Director shall annually 
submit to the Committee on Homeland Security and Govern-
mental Affairs of the Senate and the Committee on Homeland 
Security of the House of Representatives a report (which may 
include a classified annex but with the presumption of declas-
sification) on the use of subpoenas issued pursuant to this 
subsection, which shall include the following: 
‘‘(A) A discussion of the following: 
‘‘(i) The effectiveness of the use of such subpoenas 
to 
mitigate 
critical 
infrastructure 
security 
vulnerabilities. 
‘‘(ii) The critical infrastructure security risk assess-
ment process conducted for subpoenas issued under 
this subsection. 
‘‘(iii) The number of subpoenas so issued during 
the preceding year. 
‘‘(iv) To the extent practicable, the number of 
vulnerable covered devices or systems mitigated under 
this subsection by the Agency during the preceding 
year. 
‘‘(v) The number of entities notified by the Director 
under this subsection, and their responses, during the 
preceding year. 
‘‘(B) For each subpoena issued pursuant to this sub-
section, the following: 
‘‘(i) Information relating to the source of the secu-
rity vulnerability detected, identified, or received by 
the Director. 
‘‘(ii) Information relating to the steps taken to 
identify the entity at risk prior to issuing the subpoena. 
‘‘(iii) A description of the outcome of the subpoena, 
including discussion on the resolution or mitigation 
of the critical infrastructure security vulnerability. 
‘‘(12) PUBLICATION OF THE ANNUAL REPORTS.—The Director 
shall publish a version of the annual report required under 
paragraph (11) on the website of the Agency, which shall, 
at a minimum, include the findings described in clauses (iii), 
(iv), and (v) of subparagraph (A) of such paragraph. 
‘‘(13) PROHIBITION ON USE OF INFORMATION FOR UNAUTHOR-
IZED PURPOSES.—Any information obtained pursuant to a sub-
poena issued under this subsection may not be provided to 
any other Federal department or agency for any purpose other 
than a cybersecurity purpose or for the purpose of enforcing 
a subpoena issued pursuant to this subsection.’’. 
(b) RULES OF CONSTRUCTION.— 
(1) PROHIBITION ON NEW REGULATORY AUTHORITY.—Nothing 
in this section or the amendments made by this section may 
be construed to grant the Secretary of Homeland Security, 
or the head of any another Federal agency or department, 
any authority to promulgate regulations or set standards 
relating to the cybersecurity of private sector critical infrastruc-
ture that was not in effect on the day before the date of 
the enactment of this Act. 
(2) PRIVATE
ENTITIES.—Nothing in this section or the 
amendments made by this section may be construed to require 
any private entity to—
H. R. 6395—712 
(A) request assistance from the Director of the Cyberse-
curity and Infrastructure Security Agency of the Depart-
ment of Homeland Security; or 
(B) implement any measure or recommendation sug-
gested by the Director. 
SEC. 1717. CYBERSECURITY STATE COORDINATOR. 
(a) CYBERSECURITY STATE COORDINATOR.— 
(1) IN GENERAL.—Subtitle A of title XXII of the Homeland 
Security Act of 2002 (6 U.S.C. 651 et seq.) is amended— 
(A) in section 2202(c) (6 U.S.C. 652(c))— 
(i) in paragraph (10), by striking ‘‘and’’ at the 
end; 
(ii) by redesignating paragraph (11) as paragraph 
(12); and 
(iii) by inserting after paragraph (10) the following: 
‘‘(11) appoint a Cybersecurity State Coordinator in each 
State, as described in section 2215; and’’; and 
(B) by adding at the end the following new section: 
‘‘SEC. 2215. CYBERSECURITY STATE COORDINATOR. 
‘‘(a) APPOINTMENT.—The Director shall appoint an employee 
of the Agency in each State, with the appropriate cybersecurity 
qualifications and expertise, who shall serve as the Cybersecurity 
State Coordinator. 
‘‘(b) DUTIES.—The duties of a Cybersecurity State Coordinator 
appointed under subsection (a) shall include— 
‘‘(1) building strategic public and, on a voluntary basis, 
private sector relationships, including by advising on estab-
lishing governance structures to facilitate the development and 
maintenance of secure and resilient infrastructure; 
‘‘(2) serving as the Federal cybersecurity risk advisor and 
supporting preparation, response, and remediation efforts 
relating to cybersecurity risks and incidents; 
‘‘(3) facilitating the sharing of cyber threat information 
to improve understanding of cybersecurity risks and situational 
awareness of cybersecurity incidents; 
‘‘(4) raising awareness of the financial, technical, and oper-
ational resources available from the Federal Government to 
non-Federal entities to increase resilience against cyber threats; 
‘‘(5) supporting training, exercises, and planning for con-
tinuity of operations to expedite recovery from cybersecurity 
incidents, including ransomware; 
‘‘(6) serving as a principal point of contact for non-Federal 
entities to engage, on a voluntary basis, with the Federal 
Government on preparing, managing, and responding to cyber-
security incidents; 
‘‘(7) assisting non-Federal entities in developing and coordi-
nating vulnerability disclosure programs consistent with Fed-
eral and information security industry standards; 
‘‘(8) assisting State, local, Tribal, and territorial govern-
ments, on a voluntary basis, in the development of State cyber-
security plans; 
‘‘(9) coordinating with appropriate officials within the 
Agency; and 
‘‘(10) performing such other duties as determined necessary 
by the Director to achieve the goal of managing cybersecurity
H. R. 6395—713 
risks in the United States and reducing the impact of cyber 
threats to non-Federal entities. 
‘‘(c) FEEDBACK.—The Director shall consult with relevant State, 
local, Tribal, and territorial officials regarding the appointment, 
and State, local, Tribal, and territorial officials and other non- 
Federal entities regarding the performance, of the Cybersecurity 
State Coordinator of a State.’’. 
(2) COORDINATION
PLAN.—Not later than 60 days after 
the date of the enactment of this Act, the Director of the 
Cybersecurity and Infrastructure Security Agency of the 
Department of Homeland Security shall establish and submit 
to the Committee on Homeland Security and Governmental 
Affairs in the Senate and the Committee on Homeland Security 
in the House of Representatives a plan describing the reporting 
structure and coordination processes and procedures of Cyberse-
curity State Coordinators within the Cybersecurity and Infra-
structure Security Agency under section 2215 of the Homeland 
Security Act of 2002, as added by paragraph (1)(B). 
(3) OVERSIGHT.—The Director of the Cybersecurity and 
Infrastructure Security Agency of the Department of Homeland 
Security shall provide to the Committee on Homeland Security 
and Governmental Affairs of the Senate and the Committee 
on Homeland Security of the House of Representatives a 
briefing on the placement and efficacy of the Cybersecurity 
State Coordinators appointed under section 2215 of the Home-
land Security Act of 2002, as added by paragraph (1)(B), and 
the coordination plan required under paragraph (2)— 
(A) not later than one year after the date of enactment 
of this Act; and 
(B) not later than two years after providing the first 
briefing under this paragraph. 
(4) RULE OF CONSTRUCTION.—Nothing in this subsection 
or the amendments made by this subsection may be construed 
to affect or otherwise modify the authority of Federal law 
enforcement agencies with respect to investigations relating 
to cybersecurity incidents. 
(5) CLERICAL AMENDMENT.—The table of contents in section 
1(b) of the Homeland Security Act of 2002 is amended by 
inserting after the item relating to section 2214 the following 
new item: 
‘‘Sec. 2215. Cybersecurity State Coordinator.’’. 
(b) STAKEHOLDER OUTREACH AND OPERATIONAL ENGAGEMENT 
STRATEGY AND IMPLEMENTATION PLAN.— 
(1) STRATEGY.—Not later than one year after the date 
of the enactment of this Act, the Director of the Cybersecurity 
and Infrastructure Security Agency of the Department of Home-
land 
Security 
shall 
issue 
a 
strategy 
and 
subsequent 
implementation plan to improve stakeholder outreach and oper-
ational engagement, including the Agency’s strategic and oper-
ational goals and priorities for carrying out stakeholder engage-
ment activities. 
(2) CONTENTS.—The stakeholder outreach and operational 
engagement strategy and implementation plan issued pursuant 
to paragraph (1) shall include the following: 
(A) A catalogue of the stakeholder engagement services 
delivered by the Cybersecurity and Infrastructure Security 
Agency of the Department of Homeland Security, including
H. R. 6395—714 
the regions of the stakeholder services delivered and the 
critical infrastructure sectors (as such term is defined in 
section 2001(3) of the Homeland Security Act of 2002 (6 
U.S.C. 601(3)) involved. 
(B) An assessment of the capacity of programs of the 
Agency to deploy personnel, including the adequacy of such 
personnel to meet service requests and the ability of such 
personnel to engage with and deliver services to stake-
holders in urban, suburban, and rural areas. 
(C) Long-term objectives of such personnel, including 
training of the workforce to optimize the capabilities of 
such programs and capacity goals. 
(D) A description of programs, policies, and activities 
used to carry out such stakeholder engagement services 
under subparagraph (A). 
(E) Resources and personnel necessary to effectively 
support critical infrastructure owners and operators and, 
as 
appropriate, 
other 
entities, 
including 
non-profit 
organizations, based on current and projected demand for 
Agency services. 
(F) Guidance on how outreach to critical infrastructure 
owners and operators in a region should be prioritized. 
(G) Plans to ensure that stakeholder engagement per-
sonnel of the Agency have a clear understanding of expecta-
tions for engagement within each critical infrastructure 
sector and subsector, whether during steady state or surge 
capacity. 
(H) Metrics for measuring how effective stakeholder 
engagement services under subparagraph (A) are at fur-
thering the Agency’s strategic and operational goals and 
priorities. 
(I) Mechanisms to track regional engagement by per-
sonnel of the Agency with critical infrastructure owners 
and operators, and how frequently such engagement takes 
place. 
(J) Plans for awareness campaigns to familiarize crit-
ical infrastructure owners and operators with security 
resources and support offered by the Cybersecurity and 
Infrastructure Security Agency. 
(K) A description of how to prioritize engagement with 
critical infrastructure sectors based on threat information 
and the capacity of such sectors to mitigate such threats 
(L) Projected timelines, benchmarks, and resource 
requirements to implement the Agency’s strategic goals 
and priorities. 
(3) STAKEHOLDER INPUT.—In issuing the stakeholder out-
reach and operational engagement strategy required under 
paragraph (1), the Director of the Cybersecurity and Infrastruc-
ture Security Agency of the Department of Homeland Security 
shall, to the extent practicable, solicit input from stakeholders 
representing the following: 
(A) Each of the critical infrastructure sectors. 
(B) Critical infrastructure owners and operators located 
in each region in which the Agency maintains a field office. 
(4) OVERSIGHT.—Upon issuance of the stakeholder outreach 
and operational engagement strategy and implementation plan 
required under paragraph (1), the Director of the Cybersecurity
H. R. 6395—715 
and Infrastructure Security Agency of the Department of Home-
land Security shall submit to the Committee on Homeland 
Security of the House of Representatives and the Committee 
on Homeland Security and Governmental Affairs of the Senate 
such strategy and plan, together with any associated legislative 
or budgetary proposals relating thereto. 
SEC. 1718. CYBERSECURITY ADVISORY COMMITTEE. 
(a) IN GENERAL.—Subtitle A of title XXII of the Homeland 
Security Act of 2002 (6 U.S.C. 651 et seq.), as amended by section 
1715 of this Act, is further amended by adding at the end the 
following new section: 
‘‘SEC. 2216. CYBERSECURITY ADVISORY COMMITTEE. 
‘‘(a) ESTABLISHMENT.—The Secretary shall establish within the 
Agency a Cybersecurity Advisory Committee (referred to in this 
section as the ‘Advisory Committee’). 
‘‘(b) DUTIES.— 
‘‘(1) IN GENERAL.—The Advisory Committee shall advise, 
consult with, report to, and make recommendations to the 
Director, as appropriate, on the development, refinement, and 
implementation of policies, programs, planning, and training 
pertaining to the cybersecurity mission of the Agency. 
‘‘(2) RECOMMENDATIONS.— 
‘‘(A) IN
GENERAL.—The Advisory Committee shall 
develop, at the request of the Director, recommendations 
for improvements to advance the cybersecurity mission of 
the Agency and strengthen the cybersecurity of the United 
States. 
‘‘(B) RECOMMENDATIONS
OF
SUBCOMMITTEES.—Rec-
ommendations agreed upon by subcommittees established 
under subsection (d) for any year shall be approved by 
the Advisory Committee before the Advisory Committee 
submits to the Director the annual report under paragraph 
(4) for that year. 
‘‘(3) PERIODIC
REPORTS.—The Advisory Committee shall 
periodically submit to the Director— 
‘‘(A) reports on matters identified by the Director; and 
‘‘(B) reports on other matters identified by a majority 
of the members of the Advisory Committee. 
‘‘(4) ANNUAL REPORT.— 
‘‘(A) IN
GENERAL.—The Advisory Committee shall 
submit to the Director an annual report providing informa-
tion on the activities, findings, and recommendations of 
the Advisory Committee, including its subcommittees, for 
the preceding year. 
‘‘(B) PUBLICATION.—Not later than 180 days after the 
date on which the Director receives an annual report for 
a year under subparagraph (A), the Director shall publish 
a public version of the report describing the activities of 
the Advisory Committee and such related matters as would 
be informative to the public during that year, consistent 
with section 552(b) of title 5, United States Code. 
‘‘(5) FEEDBACK.—Not later than 90 days after receiving 
any recommendation submitted by the Advisory Committee 
under paragraph (2), (3), or (4), the Director shall respond 
in writing to the Advisory Committee with feedback on the 
recommendation. Such a response shall include—
H. R. 6395—716 
‘‘(A) with respect to any recommendation with which 
the Director concurs, an action plan to implement the rec-
ommendation; and 
‘‘(B) with respect to any recommendation with which 
the Director does not concur, a justification for why the 
Director does not plan to implement the recommendation. 
‘‘(6) CONGRESSIONAL
NOTIFICATION.—Not less frequently 
than once per year after the date of enactment of this section, 
the Director shall provide to the Committee on Homeland Secu-
rity and Governmental Affairs and the Committee on Appro-
priations of the Senate and the Committee on Homeland Secu-
rity, the Committee on Energy and Commerce, and the Com-
mittee on Appropriations of the House of Representatives a 
briefing on feedback from the Advisory Committee. 
‘‘(7) GOVERNANCE
RULES.—The Director shall establish 
rules for the structure and governance of the Advisory Com-
mittee and all subcommittees established under subsection (d). 
‘‘(c) MEMBERSHIP.— 
‘‘(1) APPOINTMENT.— 
‘‘(A) IN GENERAL.—Not later than 180 days after the 
date of enactment of the Cybersecurity Advisory Committee 
Authorization Act of 2020, the Director shall appoint the 
members of the Advisory Committee. 
‘‘(B) COMPOSITION.—The membership of the Advisory 
Committee shall consist of not more than 35 individuals. 
‘‘(C) REPRESENTATION.— 
‘‘(i) IN GENERAL.—The membership of the Advisory 
Committee shall satisfy the following criteria: 
‘‘(I) Consist of subject matter experts. 
‘‘(II) Be geographically balanced. 
‘‘(III) Include representatives of State, local, 
and Tribal governments and of a broad range of 
industries, which may include the following: 
‘‘(aa) Defense. 
‘‘(bb) Education. 
‘‘(cc) Financial services and insurance. 
‘‘(dd) Healthcare. 
‘‘(ee) Manufacturing. 
‘‘(ff) Media and entertainment. 
‘‘(gg) Chemicals. 
‘‘(hh) Retail. 
‘‘(ii) Transportation. 
‘‘(jj) Energy. 
‘‘(kk) Information Technology. 
‘‘(ll) Communications. 
‘‘(mm) Other relevant fields identified by 
the Director. 
‘‘(ii) PROHIBITION.—Not fewer than one member 
nor more than three members may represent any one 
category under clause (i)(III). 
‘‘(iii) PUBLICATION
OF
MEMBERSHIP
LIST.—The 
Advisory Committee shall publish its membership list 
on a publicly available website not less than once per 
fiscal year and shall update the membership list as 
changes occur. 
‘‘(2) TERM OF OFFICE.—
H. R. 6395—717 
‘‘(A) TERMS.—The term of each member of the Advisory 
Committee shall be two years, except that a member may 
continue to serve until a successor is appointed. 
‘‘(B) REMOVAL.—The Director may review the participa-
tion of a member of the Advisory Committee and remove 
such member any time at the discretion of the Director. 
‘‘(C) REAPPOINTMENT.—A member of the Advisory Com-
mittee may be reappointed for an unlimited number of 
terms. 
‘‘(3) PROHIBITION ON COMPENSATION.—The members of the 
Advisory Committee may not receive pay or benefits from the 
United States Government by reason of their service on the 
Advisory Committee. 
‘‘(4) MEETINGS.— 
‘‘(A) IN
GENERAL.—The Director shall require the 
Advisory Committee to meet not less frequently than semi-
annually, and may convene additional meetings as nec-
essary. 
‘‘(B) PUBLIC MEETINGS.—At least one of the meetings 
referred to in subparagraph (A) shall be open to the public. 
‘‘(C) ATTENDANCE.—The Advisory Committee shall 
maintain a record of the persons present at each meeting. 
‘‘(5) MEMBER ACCESS TO CLASSIFIED INFORMATION.— 
‘‘(A) IN GENERAL.—Not later than 60 days after the 
date on which a member is first appointed to the Advisory 
Committee and before the member is granted access to 
any classified information, the Director shall determine, 
for the purposes of the Advisory Committee, if the member 
should be restricted from reviewing, discussing, or pos-
sessing classified information. 
‘‘(B) ACCESS.—Access to classified materials shall be 
managed in accordance with Executive Order No. 13526 
of December 29, 2009 (75 Fed. Reg. 707), or any subsequent 
corresponding Executive Order. 
‘‘(C) PROTECTIONS.—A member of the Advisory Com-
mittee shall protect all classified information in accordance 
with the applicable requirements for the particular level 
of classification of such information. 
‘‘(D) RULE OF CONSTRUCTION.—Nothing in this para-
graph shall be construed to affect the security clearance 
of a member of the Advisory Committee or the authority 
of a Federal agency to provide a member of the Advisory 
Committee access to classified information. 
‘‘(6) CHAIRPERSON.—The Advisory Committee shall select, 
from among the members of the Advisory Committee— 
‘‘(A) a member to serve as chairperson of the Advisory 
Committee; and 
‘‘(B) a member to serve as chairperson of each sub-
committee of the Advisory Committee established under 
subsection (d). 
‘‘(d) SUBCOMMITTEES.— 
‘‘(1) IN GENERAL.—The Director shall establish subcommit-
tees within the Advisory Committee to address cybersecurity 
issues, which may include the following: 
‘‘(A) Information exchange. 
‘‘(B) Critical infrastructure. 
‘‘(C) Risk management.
H. R. 6395—718 
‘‘(D) Public and private partnerships. 
‘‘(2) MEETINGS AND REPORTING.—Each subcommittee shall 
meet not less frequently than semiannually, and submit to 
the Advisory Committee for inclusion in the annual report 
required under subsection (b)(4) information, including activi-
ties, findings, and recommendations, regarding subject matter 
considered by the subcommittee. 
‘‘(3) SUBJECT MATTER EXPERTS.—The chair of the Advisory 
Committee shall appoint members to subcommittees and shall 
ensure that each member appointed to a subcommittee has 
subject matter expertise relevant to the subject matter of the 
subcommittee.’’. 
(b) CLERICAL AMENDMENT.—The table of contents in section 
1(b) of the Homeland Security Act of 2002 (Public Law 107–296; 
116 Stat. 2135), as so amended, is further amended by inserting 
after the item relating to section 2215 the following new item: 
‘‘Sec. 2216. Cybersecurity Advisory Committee.’’. 
SEC. 1719. CYBERSECURITY EDUCATION AND TRAINING ASSISTANCE 
PROGRAM. 
(a) AUTHORITIES.—Section 2202(e)(1) of the Homeland Security 
Act of 2002 (6 U.S.C. 652(e)(1)) is amended by adding at the 
end the following new subparagraph: 
‘‘(R) To encourage and build cybersecurity awareness 
and competency across the United States and to develop, 
attract, and retain the cybersecurity workforce necessary 
for the cybersecurity related missions of the Department, 
including by— 
‘‘(i) overseeing elementary and secondary cyberse-
curity education and awareness related programs at 
the Agency; 
‘‘(ii) leading efforts to develop, attract, and retain 
the cybersecurity workforce necessary for the cyberse-
curity related missions of the Department; 
‘‘(iii) 
encouraging 
and 
building 
cybersecurity 
awareness and competency across the United States; 
and 
‘‘(iv) carrying out cybersecurity related workforce 
development activities, including through— 
‘‘(I) increasing the pipeline of future cybersecu-
rity professionals through programs focused on 
elementary and secondary education, postsec-
ondary education, and workforce development; and 
‘‘(II) building awareness of and competency 
in cybersecurity across the civilian Federal Govern-
ment workforce.’’. 
(b) EDUCATION, TRAINING, AND CAPACITY DEVELOPMENT.—Sec-
tion 2202(c) of the Homeland Security Act of 2002 (6 U.S.C. 652(c)) 
is amended— 
(1) in paragraph (10), by striking ‘‘and’’ at the end; 
(2) by redesignating paragraph (11) as paragraph (12); 
and 
(3) by inserting after paragraph (10) the following new 
paragraph: 
‘‘(11) provide education, training, and capacity development 
to Federal and non-Federal entities to enhance the security
H. R. 6395—719 
and resiliency of domestic and global cybersecurity and infra-
structure security; and’’. 
(c) ESTABLISHMENT OF TRAINING PROGRAMS.—Subtitle A of title 
XXII of the Homeland Security Act of 2002 (6 U.S.C. 651 et seq.), 
as amended by sections 1715 and 1718 of this Act, is further 
amended by adding at the end the following new section: 
‘‘SEC. 2217. CYBERSECURITY EDUCATION AND TRAINING PROGRAMS. 
‘‘(a) ESTABLISHMENT.— 
‘‘(1) IN
GENERAL.—The Cybersecurity Education and 
Training Assistance Program (referred to in this section as 
‘CETAP’) is established within the Agency. 
‘‘(2) PURPOSE.—The purpose of CETAP shall be to support 
the effort of the Agency in building and strengthening a 
national cybersecurity workforce pipeline capacity through 
enabling elementary and secondary cybersecurity education, 
including by— 
‘‘(A) providing foundational cybersecurity awareness 
and literacy; 
‘‘(B) encouraging cybersecurity career exploration; and 
‘‘(C) supporting the teaching of cybersecurity skills at 
the elementary and secondary education levels. 
‘‘(b) REQUIREMENTS.—In carrying out CETAP, the Director 
shall— 
‘‘(1) ensure that the program— 
‘‘(A) creates and disseminates cybersecurity-focused 
curricula and career awareness materials appropriate for 
use at the elementary and secondary education levels; 
‘‘(B) conducts professional development sessions for 
teachers; 
‘‘(C) develops resources for the teaching of cybersecu-
rity-focused curricula described in subparagraph (A); 
‘‘(D) provides direct student engagement opportunities 
through camps and other programming; 
‘‘(E) engages with State educational agencies and local 
educational agencies to promote awareness of the program 
and ensure that offerings align with State and local cur-
ricula; 
‘‘(F) integrates with existing post-secondary education 
and workforce development programs at the Department; 
‘‘(G) promotes and supports national standards for 
elementary and secondary cyber education; 
‘‘(H) partners with cybersecurity and education stake-
holder groups to expand outreach; and 
‘‘(I) any other activity the Director determines nec-
essary to meet the purpose described in subsection (a)(2); 
and 
‘‘(2) enable the deployment of CETAP nationwide, with 
special consideration for underserved populations or commu-
nities. 
‘‘(c) BRIEFINGS.— 
‘‘(1) IN GENERAL.—Not later than 1 year after the establish-
ment of CETAP, and annually thereafter, the Secretary shall 
brief the Committee on Homeland Security and Governmental 
Affairs of the Senate and the Committee on Homeland Security 
of the House of Representatives on the program.
H. R. 6395—720 
‘‘(2) CONTENTS.—Each briefing conducted under paragraph 
(1) shall include— 
‘‘(A) estimated figures on the number of students 
reached and teachers engaged; 
‘‘(B) information on outreach and engagement efforts, 
including the activities described in subsection (b)(1)(E); 
‘‘(C) information on new curricula offerings and teacher 
training platforms; and 
‘‘(D) information on coordination with post-secondary 
education and workforce development programs at the 
Department. 
‘‘(d) MISSION PROMOTION.—The Director may use appropriated 
amounts to purchase promotional and recognition items and mar-
keting and advertising services to publicize and promote the mission 
and services of the Agency, support the activities of the Agency, 
and to recruit and retain Agency personnel.’’. 
(d) CLERICAL AMENDMENT.—The table of contents in section 
1(b) of the Homeland Security Act of 2002, as so amended, is 
further amended by inserting after the item relating to section 
2216 the following new item: 
‘‘Sec. 2217. Cybersecurity Education and Training Programs.’’. 
SEC. 1720. FRAMEWORK FOR CYBER HUNT FORWARD OPERATIONS. 
(a) FRAMEWORK REQUIRED.—Not later than April 1, 2021, the 
Secretary of Defense shall develop a standard, comprehensive 
framework to enhance the consistency, execution, and effectiveness 
of cyber hunt forward operations. 
(b) ELEMENTS.—The framework developed pursuant to sub-
section (a) shall include the following: 
(1) Identification of the selection criteria for proposed cyber 
hunt forward operations, including specification of necessary 
thresholds for the justification of operations and thresholds 
for partner cooperation. 
(2) The roles and responsibilities of the following organiza-
tions in the support of the planning and execution of cyber 
hunt forward operations: 
(A) United States Cyber Command. 
(B) Service cyber components. 
(C) The Office of the Under Secretary of Defense for 
Policy. 
(D) Geographic combatant commands. 
(E) Cyber Operations-Integrated Planning Elements 
and Joint Cyber Centers. 
(F) Embassies and consulates of the United States. 
(3) Pre-deployment planning guidelines to maximize the 
operational success of each unique operation, including guid-
ance that takes into account the highly variable nature of 
the following aspects at the tactical level: 
(A) Team composition, including necessary skillsets, 
recommended training, and guidelines on team size and 
structure. 
(B) Relevant factors to determine mission duration in 
a country of interest. 
(C) Agreements with partner countries required pre- 
deployment. 
(D) Criteria for potential follow-on operations.
H. R. 6395—721 
(E) Equipment and infrastructure required to support 
the missions. 
(4) Metrics to measure the effectiveness of each operation, 
including means to evaluate the value of discovered malware 
and infrastructure, the effect on the adversary, and the poten-
tial for future engagements with the partner country. 
(5) Roles and responsibilities for United States Cyber Com-
mand and the National Security Agency in the analysis of 
relevant mission data. 
(6) A detailed description of counterintelligence support 
for cyber hunt forward operations. 
(7) A standardized force presentation model across service 
components and combatant commands. 
(8) Review of active and reserve component personnel poli-
cies to account for deployment and redeployment operations, 
including the following: 
(A) Global Force Management. 
(B) Contingency, Exercise, and Deployment orders to 
be considered for and applied towards deployment credit 
and benefits. 
(9) Such other matters as the Secretary determines rel-
evant. 
(c) BRIEFING.— 
(1) IN GENERAL.—Not later than May 1, 2021, the Secretary 
of Defense shall provide to the Committee on Armed Services 
of the Senate and the Committee on Armed Services of the 
House of Representatives a briefing on the framework developed 
pursuant to subsection (a). 
(2) CONTENTS.—The briefing required by paragraph (1) 
shall include the following: 
(A) An overview of the framework developed pursuant 
to subsection (a). 
(B) An explanation of the tradeoffs associated with 
the use of Department of Defense resources for cyber hunt 
forward missions in the context of competing priorities. 
(C) Such recommendations as the Secretary may have 
for legislative action to improve the effectiveness of cyber 
hunt forward missions. 
SEC. 1721. RATIONALIZATION AND INTEGRATION OF PARALLEL CYBER-
SECURITY ARCHITECTURES AND OPERATIONS. 
(a) REVIEW REQUIRED.—The Commander of United States 
Cyber Command, with support from the Chief Information Officer 
of the Department of Defense, the Chief Data Officer of the Depart-
ment, the Principal Cyber Advisor, the Vice Chairman of the Joint 
Chiefs of Staff, and the Director of Cost Analysis and Program 
Evaluation, as well as the Principal Cyber Advisors and the Chief 
Information Officers of the military services, shall conduct a review 
of the Cybersecurity Service Provider and Cyber Mission Force 
enterprises. 
(b) ASSESSMENT AND IDENTIFICATION OF REDUNDANCIES AND 
GAPS.—The review required by subsection (a) shall assess and 
identify— 
(1) the optimal way to integrate the Joint Cyber 
Warfighting Architecture and the Cybersecurity Service Pro-
vider architectures, associated tools and capabilities, and associ-
ated concepts of operations;
H. R. 6395—722 
(2) redundancies and gaps in network sensor deployment 
and data collection and analysis for the— 
(A) Big Data Platform; 
(B) Joint Regional Security Stacks; and 
(C) Security Information and Event Management 
capabilities; 
(3) where integration, collaboration, and interoperability 
are not occurring that would improve outcomes; 
(4) baseline training, capabilities, competencies, operational 
responsibilities, and joint concepts of operations for the Joint 
Force Headquarters for the Department of Defense Information 
Network, Cybersecurity Service Providers, and Cyber Protection 
Teams; 
(5) the roles and responsibilities of the Principal Cyber 
Advisor, Chief Information Officer, and the Commander of 
United States Cyber Command in establishing and overseeing 
the baselines assessed and identified under paragraph (4); 
(6) the optimal command structure for the military services’ 
and combatant commands’ cybersecurity service providers and 
cyber protection teams; 
(7) the responsibilities of network owners and cybersecurity 
service providers in mapping, configuring, instrumenting, and 
deploying sensors on networks to best support response of 
cyber protection teams when assigned to defend unfamiliar 
networks; and 
(8) operational concepts and engineering changes to 
enhance remote access and operations of cyber protection teams 
on networks through tools and capabilities of the Cybersecurity 
Service Providers. 
(c) RECOMMENDATIONS FOR FISCAL YEAR 2023 BUDGET.—The 
Chief Information Officer, the Chief Data Officer, the Commander 
of United States Cyber Command, and the Principal Cyber Advisor 
shall jointly develop recommendations for the Secretary of Defense 
in preparation of the budget justification materials to be submitted 
to Congress in support of the budget for the Department of Defense 
for fiscal year 2023 (as submitted with the budget of the President 
for such fiscal year under section 1105(a) of title 31, United States 
Code). 
(d) PROGRESS BRIEFING.—Not later than March 31, 2021, the 
Chief Information Officer, the Chief Data Officer, the Commander 
of United States Cyber Command, and the Principal Cyber Advisor 
shall jointly provide a briefing to the congressional defense commit-
tees on the progress made in carrying out this section. 
SEC. 1722. ASSESSING RISK TO NATIONAL SECURITY OF QUANTUM 
COMPUTING. 
(a) COMPREHENSIVE
ASSESSMENT
AND
RECOMMENDATIONS 
REQUIRED.—Not later than December 31, 2021, the Secretary of 
Defense shall— 
(1) complete a comprehensive assessment of the current 
and potential threats and risks posed by quantum computing 
technologies to critical national security systems, including— 
(A) an identification and prioritization of critical 
national security systems at risk; 
(B) an assessment of the standards of the National 
Institute of Standards and Technology for quantum resist-
ant cryptography and the applicability of such standards
H. R. 6395—723 
to cryptographic requirements of the Department of 
Defense; 
(C) an assessment of the feasibility of alternate 
quantum-resistant algorithms and features; and 
(D) a description of any funding shortfalls in public 
and private developmental efforts relating to quantum 
resistant cryptography, standards, and models; and 
(2) develop recommendations for research, development, 
and acquisition activities, including resourcing schedules, for 
securing the critical national security systems identified pursu-
ant to paragraph (1)(A) against quantum computing code- 
breaking capabilities. 
(b) BRIEFING.—Not later than February 1, 2022, the Secretary 
shall brief the congressional defense committees on the assessment 
completed under paragraph (1) of subsection (a) and the rec-
ommendations developed under paragraph (2) of such subsection. 
SEC. 1723. TAILORED CYBERSPACE OPERATIONS ORGANIZATIONS. 
(a) STUDY.— 
(1) IN GENERAL.—Not later than 120 days after the date 
of the enactment of this Act, the Secretary of the Navy and 
the Chief of Naval Operations, in consultation with the Com-
mander of United States Cyber Command, shall submit to 
the congressional defense committees a study of the Navy Cyber 
Warfare Development Group (NCWDG). 
(2) ELEMENTS.—The study required under paragraph (1) 
shall include the following: 
(A) An examination of NCWDG’s structure, manning, 
authorities, funding, and operations. 
(B) A review of organizational relationships— 
(i) within the Navy; and 
(ii) to other Department of Defense organizations, 
as well as non-Department of Defense organizations. 
(C) Recommendations for how the NCWDG can be 
strengthened and improved, without growth in size. 
(D) Such other information as determined necessary 
or appropriate by the Secretary of the Navy. 
(3) RELEASE.— 
(A) TO CONGRESS.—Not later than 7 days after comple-
tion of the study required under paragraph (1), the Sec-
retary of the Navy shall brief the congressional defense 
committees on the findings of the study. 
(B) TO SERVICE SERVICES.— The Secretary of the Navy 
shall transmit to the secretaries of the military services 
and the Assistant Secretary of Defense for Special Oper-
ations and Irregular Warfare the study required under 
paragraph (1). 
(b) DESIGNATION.—Notwithstanding any other provision of law, 
the Secretary of the Navy shall designate the NCWDG as a screened 
command. 
(c) AUTHORITY
TO
REPLICATE.—After review of the study 
required under subsection (a) and consulting the Commander of 
United States Cyber Command in accordance with procedures estab-
lished by the Secretary of Defense, the secretaries of the military 
services may establish tailored cyberspace operations organizations 
of comparable size to NCWDG within the military service, respec-
tively, of each such secretary. Such counterpart organizations shall
H. R. 6395—724 
have the same authorities as the NCWDG. On behalf of United 
States Special Operations Command, the Assistant Secretary of 
Defense for Special Operations and Irregular Warfare may 
authorize a tailored cyberspace operations organization within 
United States Special Operations Command of similar size and 
equivalent authorities as NCWDG. 
(d) BRIEFING TO CONGRESS.—Not later than 180 days after 
the date of the enactment of this Act, the secretaries of the military 
services and the Assistant Secretary of Defense for Special Oper-
ations and Irregular Warfare shall brief the congressional defense 
committees on— 
(1) the utilization of the authority provided pursuant to 
subsection (c); and 
(2) if appropriate based on such utilization, details on how 
the military service, respectively, of each such secretary intends 
to establish tailored cyberspace operations organizations. 
SEC. 1724. RESPONSIBILITY FOR CYBERSECURITY AND CRITICAL 
INFRASTRUCTURE PROTECTION OF THE DEFENSE INDUS-
TRIAL BASE. 
(a) CRITICAL INFRASTRUCTURE DEFINED.—In this section, the 
term ‘‘critical infrastructure’’ has the meaning given such term 
in section 1016(e) of the Uniting and Strengthening America by 
Providing Appropriate Tools Required to Intercept and Obstruct 
Terrorism (USA PATRIOT ACT) Act of 2001 (42 U.S.C. 5195c(e)). 
(b) DESIGNATION.—The Secretary of Defense shall designate 
the Principal Cyber Advisor of the Department of Defense as the 
coordinating authority for cybersecurity issues relating to the 
defense industrial base. 
(c) RESPONSIBILITIES.—As the coordinating authority for cyber-
security issues relating to the defense industrial base, the Principal 
Cyber Advisor of the Department of Defense shall synchronize, 
harmonize, de-conflict, and coordinate all policies and programs 
germane to defense industrial base cybersecurity, including the 
following: 
(1) The Sector Specific Agency functions under Presidential 
Policy Directive-21 the Department of Defense has assigned 
to the Under Secretary of Defense for Policy for implementation. 
(2) The Under Secretary of Defense for Acquisition and 
Sustainment’s policies and programs germane to contracting 
and contractual enforcement as such relate to cybersecurity 
assessment and assistance, and industrial base health and 
security. 
(3) The Under Secretary of Defense for Intelligence and 
Security’s policies and programs germane to physical security, 
information security, industrial security, acquisition security 
and cybersecurity, all source intelligence, classified threat intel-
ligence sharing related to defense industrial base cybersecurity 
activities, counterintelligence, and foreign ownership control 
or influence, including the Defense Intelligence Agency and 
National Security Agency support provided to the Department 
of Defense – Defense Industrial Base Collaborative Information 
Sharing Environment and cyber intrusion damage assessment 
analysis as part of defense industrial base cybersecurity activi-
ties.
H. R. 6395—725 
(4) The Department of Defense Chief Information Officer’s 
policies and programs for cybersecurity standards and inte-
grating cybersecurity threat intelligence-sharing activities and 
enhancing Department of Defense and defense industrial base 
cyber situational awareness. 
(5) The Under Secretary of Defense for Research and 
Engineering’s policies and programs germane to protection 
planning requirements of emerging technologies as such relate 
to cybersecurity assessment and assistance, and industrial base 
health and security. 
(6) Other Department of Defense components’ policies and 
programs germane to the cybersecurity of the defense industrial 
base, including the policies and programs of the military serv-
ices and the combatant commands. 
(d) ADDITIONAL FUNCTIONS.—In carrying out this section, the 
Principal Cyber Advisor of the Department of Defense shall— 
(1) coordinate or facilitate coordination with relevant Fed-
eral departments and agencies, defense industrial base entities, 
independent regulatory agencies, and with State, local, terri-
torial, and Tribal entities, as appropriate; 
(2) facilitate or coordinate the provision of incident manage-
ment support to defense industrial base entities, as appropriate; 
(3) facilitate or coordinate the provision of technical assist-
ance to and consultations with defense industrial base entities 
to identify cyber or cyber-physical vulnerabilities and minimize 
the damage of potential incidents, as appropriate; and 
(4) support or facilitate the supporting of the statutorily 
required reporting requirements of such relevant Federal 
departments and agencies by providing or facilitating the provi-
sion to such departments and agencies on an annual basis 
relevant critical infrastructure information, as appropriate. 
(e) DEPARTMENT OF DEFENSE ROLES AND RESPONSIBILITIES.— 
No later than 180 days after the date of the enactment of this 
Act, the Secretary of Defense shall brief the Committees on Armed 
Services of the Senate and the House of Representatives on the 
following issues: 
(1) A plan for implementation of this section, including 
an assessment of the roles and responsibilities of entities across 
the Department of Defense and mechanisms and processes 
for coordination of policy and programs germane to defense 
industrial base cybersecurity. 
(2) An analysis of the feasibility and advisability of sepa-
rating cybersecurity Sector Specific Agency functions under 
Presidential Policy Directive-21 from non-cybersecurity Sector 
Specific Agency functions. 
(3) Regarding the non-cybersecurity Sector Specific Agency 
functions the Department has assigned to the Under Secretary 
of Defense for Policy for implementation, the implications of 
reassigning such responsibilities to the Under Secretary of 
Defense for Acquisition and Sustainment. 
SEC. 1725. PILOT PROGRAM ON REMOTE PROVISION BY NATIONAL 
GUARD TO NATIONAL GUARDS OF OTHER STATES OF 
CYBERSECURITY TECHNICAL ASSISTANCE IN TRAINING, 
PREPARATION, AND RESPONSE TO CYBER INCIDENTS. 
(a) PILOT PROGRAM AUTHORIZED.—
H. R. 6395—726 
(1) IN GENERAL.—The Secretary of Defense may conduct 
a pilot program to assess the feasibility and advisability of 
the development of a capability in support of Department of 
Defense missions within the National Guard through which 
a National Guard of a State remotely provides National Guards 
of other States (whether or not in the same Armed Force 
as the providing National Guard) with cybersecurity technical 
assistance in training, preparation, and response to cyber 
incidents. 
(2) TERMINATION.—The authorization under paragraph (1) 
to conduct the pilot program expires 24 months after the date 
of the enactment of this Act. 
(b) ASSESSMENT PRIOR TO COMMENCEMENT.—For purposes of 
the pilot program described in subsection (a), the Secretary of 
Defense shall, prior to commencing the pilot program, for purposes 
of evaluating existing platforms, technologies, and capabilities 
under subsection (c), and for establishing eligibility and participa-
tion requirements under such subsection— 
(1) conduct an assessment of— 
(A) existing cyber response capacities of the Army 
National Guard or Air National Guard, as applicable, in 
each State; and 
(B) any existing platform, technology, or capability of 
a National Guard that provides the capability described 
in subsection (a)(1); 
(2) determine whether a platform, technology, or capability 
referred to in subparagraph (B) is suitable for expansion for 
purposes of the pilot program; and 
(3) assess potential benefits or impact on the missions, 
the Total Force, the Cyber Operations Forces, and the cyber 
infrastructure of the Department of Defense. 
(c) ELEMENTS.—The pilot program described in subsection (a) 
may include the following: 
(1) A technical capability that enables the National Guard 
of a State to remotely provide cybersecurity technical assistance 
to National Guards of other States, without the need to deploy 
outside its home State. 
(2) The development of policies, processes, procedures, and 
authorities for use of such a capability, including with respect 
to the following: 
(A) The roles and responsibilities of both requesting 
and deploying National Guards with respect to such tech-
nical assistance, taking into account the matters specified 
in subsection (g). 
(B) Necessary updates to the Defense Cyber Incident 
Coordinating Procedure, or any other applicable Depart-
ment of Defense instruction, for purposes of implementing 
such a capability. 
(C) Program management and governance structures 
for deployment and maintenance of such a capability. 
(D) 
Security 
when 
performing 
remote 
support, 
including in matters such as authentication and remote 
sensing. 
(3) The conduct, in consultation with the Secretary of 
Homeland Security and the Director of the Federal Bureau
H. R. 6395—727 
of Investigation, the heads of other Federal agencies, and appro-
priate non-Federal entities, as appropriate, of at least one exer-
cise to demonstrate such a capability, which exercise shall 
include the following: 
(A) Participation of not fewer than the National Guards 
of two different States. 
(B) Circumstances designed to test and validate the 
policies, processes, procedures, and authorities developed 
pursuant to paragraph (2). 
(d) USE OF EXISTING TECHNOLOGY.—The Secretary of Defense 
may use an existing platform, technology, or capability to provide 
the technical capability described in subsection (a)(1) under the 
pilot program. 
(e) ELIGIBILITY AND PARTICIPATION REQUIREMENTS.—The Sec-
retary of Defense shall, in consultation with the Chief of the 
National Guard Bureau, establish requirements with respect to 
eligibility and participation of National Guards in the pilot program. 
(g) CONSTRUCTION WITH CERTAIN CURRENT AUTHORITIES.— 
(1) COMMAND AUTHORITIES.—Nothing in this section may 
be construed as affecting or altering the command authorities 
otherwise applicable to any unit of the National Guard partici-
pating in the pilot program. 
(2) EMERGENCY
MANAGEMENT
ASSISTANCE
COMPACT.— 
Nothing in this section may be construed as affecting or altering 
any current agreement under the Emergency Management 
Assistance Compact, or any other State agreements, or as deter-
minative of the future content of any such agreement. 
(h) EVALUATION METRICS.—The Secretary of Defense shall 
establish metrics to evaluate the effectiveness of the pilot program. 
(i) TERM.—The pilot program under subsection (b) shall termi-
nate not later than the date that is three years after the date 
of the commencement of the pilot program. 
(j) REPORTS.— 
(1) INITIAL REPORT.—Not later than 180 days after the 
date of the commencement of the pilot program, the Secretary 
of Defense shall submit to the appropriate committees of Con-
gress and the Secretary of Homeland Security an initial report 
setting forth a description of the pilot program and such other 
matters in connection with the pilot program as the Secretary 
considers appropriate. 
(2) FINAL REPORT.—Not later than 180 days after the termi-
nation of the pilot program, the Secretary of Defense shall 
submit to the appropriate committees of Congress and the 
Secretary of Homeland Security a final report on the pilot 
program. The final report shall include the following: 
(A) A description of the pilot program, including any 
partnerships entered into under the pilot program. 
(B) A summary of the assessment performed prior to 
the commencement of the pilot program in accordance with 
subsection (b). 
(C) A summary of the evaluation metrics established 
in accordance with subsection (h), including how the pilot 
program contributes directly to Department of Defense mis-
sions. 
(D) An assessment of the effectiveness of the pilot 
program, and of the capability described in subsection (c)(1) 
under the pilot program.
H. R. 6395—728 
(E) A description of costs associated with the 
implementation and conduct of the pilot program. 
(F) A recommendation as to the value of the pilot 
program, including whether to authorize a permanent pro-
gram modeled on the pilot program, including whether 
the pilot program duplicates the remote operating concept 
and capabilities of active duty cyber operations forces. 
(G) An estimate of the costs of making the pilot pro-
gram permanent and expanding it nationwide in accord-
ance with the recommendation in subparagraph (F). 
(H) Such recommendations for legislative or adminis-
trative action as the Secretary considers appropriate in 
light of the pilot program. 
(3) APPROPRIATE COMMITTEES OF CONGRESS DEFINED.—In 
this subsection, the term ‘‘appropriate committees of Congress’’ 
means— 
(A) the Committee on Armed Services and the Com-
mittee on Homeland Security of the House of Representa-
tives; and 
(B) the Committee on Armed Services and the Com-
mittee on Homeland Security and Governmental Affairs 
of the Senate. 
(k) STATE DEFINED.—In this section, the term ‘‘State’’ means 
each of the several States, the District of Columbia, the Common-
wealth of Puerto Rico, American Samoa, Guam, the United States 
Virgin Islands, and the Commonwealth of the Northern Mariana 
Islands. 
SEC. 1726. DEPARTMENT OF DEFENSE CYBER WORKFORCE EFFORTS. 
(a) RESOURCES FOR CYBER EDUCATION.— 
(1) IN
GENERAL.—The Chief Information Officer of the 
Department of Defense, in consultation with the Director of 
the National Security Agency (NSA), shall examine the current 
policies permitting National Security Agency employees to use 
up to 140 hours of paid time toward NSA’s cyber education 
programs. 
(2) REPORT.— 
(A) IN GENERAL.—Not later than 90 days after the 
date of the enactment of this Act, the Chief Information 
Officer shall submit to the congressional defense commit-
tees and the congressional intelligence committees a 
strategy for expanding the policies described in paragraph 
(1) to— 
(i) individuals who occupy positions described in 
section 1599f of title 10, United States Code; and 
(ii) any other individuals who the Chief Informa-
tion Officer determines appropriate. 
(B) IMPLEMENTATION PLAN.—The report required under 
subparagraph (A) shall detail the utilization of the policies 
in place at the National Security Agency, as well as an 
implementation plan that describes the mechanisms needed 
to expand the use of such policies to accommodate wider 
participation by individuals described in such subpara-
graph. Such implementation plan shall detail how such 
individuals would be able to connect to the instructional 
and participatory opportunities available through the 
efforts, programs, initiatives, and investments accounted
H. R. 6395—729 
for in the report required under section 1649 of the 
National Defense Authorization Act for Fiscal Year 2020 
(Public Law 116–92), including the following programs: 
(i) GenCyber. 
(ii) Centers for Academic Excellence – Cyber 
Defense. 
(iii) Centers for Academic Excellence – Cyber Oper-
ations. 
(C) DEADLINE.—Not later than 120 days after the 
submission of the report required under subparagraph (A), 
the Chief Information Officer of the Department of Defense 
shall carry out the implementation plan contained in such 
report. 
(b) IMPROVING THE TRAINING WITH INDUSTRY PROGRAM.— 
(1) IN GENERAL.—Not later than 120 days after the date 
of the enactment of this Act, the Principal Cyber Advisor of 
the Department of Defense, in consultation with the Principal 
Cyber Advisors of the military services and the Under Secretary 
of Defense for Personnel and Readiness, shall submit to the 
Secretary of Defense and the congressional defense committees 
a review of the current utilization and utility of the Training 
With Industry (TWI) programs, including relating to the fol-
lowing: 
(A) Recommendations regarding how to improve and 
better utilize such programs, including regarding individ-
uals who have completed such programs. 
(B) An implementation plan to carry out such rec-
ommendations. 
(2) ADDITIONAL.—Not later than 90 days after the submis-
sion of the report required under paragraph (1), the Secretary 
of Defense shall carry out such elements of the implementation 
plan required under paragraph (1)(B) as the Secretary considers 
appropriate and notify the congressional defense committees 
of the determinations of the Secretary relating thereto. 
(c) ALIGNMENT OF CYBERSECURITY TRAINING PROGRAMS.— 
(1) IN GENERAL.—Not later than 120 days after the date 
of the enactment of this Act, the Secretary of Defense shall 
submit to the congressional defense committees a report con-
taining recommendations on how cybersecurity training pro-
grams described in section 1649 of the National Defense 
Authorization Act for Fiscal Year 2020 can be better aligned 
and harmonized. 
(2) REPORT.—The report required under paragraph (1) shall 
provide recommendations concerning the following topics and 
information: 
(A) Developing a comprehensive mechanism for uti-
lizing and leveraging the Cyber Excepted Service workforce 
of the Department of Defense referred to in subsection 
(a), as well as mechanisms for military participation. 
(B) Unnecessary redundancies in such programs, or 
in any related efforts, initiatives, or investments. 
(C) Mechanisms for tracking participation and transi-
tion of participation from one such program to another. 
(D) Department level oversight and management of 
such programs. 
(3) CYBER
WORKFORCE
PIPELINE
AND
EARLY
CHILDHOOD 
EDUCATION.—
H. R. 6395—730 
(A) ELEMENTS.—The Secretary of Defense shall, when 
completing the report required under paragraph (1), take 
into consideration existing Federal childhood cyber edu-
cation programs, including the programs identified in the 
report required under section 1649 of the National Defense 
Authorization Act for Fiscal Year 2020 (Public Law 116– 
92) and the Department of Homeland Security’s Cybersecu-
rity Education and Training Assistance Program (CETAP), 
that can provide opportunities to military-connected stu-
dents and members of the Armed Forces to pursue cyber 
careers. 
(B) DEFINITION.—In this paragraph, the term ‘‘military- 
connected student’’ means an individual who— 
(i) is a dependent a member of the Armed Forces 
serving on active duty; and 
(ii) is enrolled in a preschool, an elementary or 
secondary school, or an institution of higher education. 
SEC. 
1727. 
REPORTING 
REQUIREMENTS 
FOR 
CROSS 
DOMAIN 
INCIDENTS 
AND 
EXEMPTIONS 
TO 
POLICIES 
FOR 
INFORMATION TECHNOLOGY. 
(a) INCIDENT REPORTING.— 
(1) IN GENERAL.—Effective beginning on the date of the 
enactment of this Act, the Secretary of Defense and the secre-
taries of the military services shall submit to the congressional 
defense committees a monthly report in writing that documents 
each instance or indication of a cross-domain incident within 
the Department of Defense. 
(2) PROCEDURES.—The Secretary of Defense shall submit 
to the congressional defense committees procedures for com-
plying with the requirements of paragraph (1) consistent with 
the national security of the United States and the protection 
of operational integrity. The Secretary shall promptly notify 
such committees in writing of any changes to such procedures 
at least 14 days prior to the adoption of any such changes. 
(3) DEFINITION.—In this subsection, the term ‘‘cross domain 
incident’’ means any unauthorized connection of any duration 
between software, hardware, or both that is either used on, 
or designed for use on a network or system built for classified 
data, and systems not accredited or authorized at the same 
or higher classification level, including systems on the public 
internet, regardless of whether the unauthorized connection 
is later determined to have resulted in the exfiltration, expo-
sure, or spillage of data across the cross domain connection. 
(b) EXEMPTIONS TO POLICY FOR INFORMATION TECHNOLOGY.— 
Not later than six months after the date of the enactment of 
this Act and biannually thereafter, the Secretary of Defense and 
the secretaries of the military services shall submit to the congres-
sional defense committees a report in writing that enumerates 
and details each current exemption to information technology policy, 
interim Authority To Operate (ATO) order, or both. Each such 
report shall include other relevant information pertaining to each 
such exemption, including relating to the following: 
(1) Risk categorization. 
(2) Duration. 
(3) Estimated time remaining.
H. R. 6395—731 
SEC. 1728. ASSESSING PRIVATE-PUBLIC COLLABORATION IN CYBERSE-
CURITY. 
(a) REQUIREMENT.—Not later than 120 days after the date 
of the enactment of this Act, the Secretary of Defense shall— 
(1) conduct a review and assessment of any ongoing public- 
private collaborative initiatives involving the Department of 
Defense and the private sector related to cybersecurity and 
defense of critical infrastructure, including— 
(A) the United States Cyber Command’s Pathfinder 
initiative and any derivative initiative; 
(B) the Department’s support to and integration with 
existing Federal cybersecurity centers and organizations; 
and 
(C) comparable initiatives led by other Federal depart-
ments or agencies that support long-term public-private 
cybersecurity collaboration; and 
(2) make recommendations for improvements and the 
requirements and resources necessary to institutionalize and 
strengthen the initiatives described in subparagraphs (A) 
through (C) of paragraph (1). 
(b) REPORT.— 
(1) IN GENERAL.—The Secretary of Defense shall submit 
to the congressional defense committees a report on the review, 
assessment, and recommendations under subsection (a). 
(2) FORM.—The report required under paragraph (1) may 
be submitted in unclassified or classified form, as necessary. 
(c) DEFINITION.—In this section, the term ‘‘critical infrastruc-
ture’’ has the meaning given such term in section 1016(e) of the 
Uniting and Strengthening America by Providing Appropriate Tools 
Required to Intercept and Obstruct Terrorism (USA PATRIOT ACT) 
Act of 2001 (42 U.S.C. 5195c(e)). 
SEC. 1729. CYBER CAPABILITIES AND INTEROPERABILITY OF THE 
NATIONAL GUARD. 
(a) EVALUATION.— 
(1) IN GENERAL.—Not later than 180 days after the date 
of the enactment of this Act, the Secretary of Defense shall 
submit to the congressional defense committees, the Committee 
on Homeland Security and Governmental Affairs of the Senate, 
and the Committee on Homeland Security of the House of 
Representatives an evaluation of the statutes, rules, regulations 
and standards that pertain to the use of the National Guard 
for the response to and recovery from significant cyber 
incidents. 
(2) CONSIDERATION OF INPUTS.—In conducting the evalua-
tion under paragraph (1), the Secretary of Defense shall consult 
with the Secretary of Homeland Security and may solicit and 
consider inputs from the following: 
(A) The heads of Federal agencies determined appro-
priate by the Secretary of Defense. 
(B) State governors. 
(C) The heads of other non-Federal entities as deter-
mined appropriate by the Secretary of Defense. 
(b) ELEMENTS OF EVALUATION.—The evaluation required under 
subsection (a) shall include review of the following: 
(1) Regulations promulgated under section 903 of title 32, 
United States Code, to clarify when and under what conditions
H. R. 6395—732 
the National Guard could respond to a cyber attack as a home-
land defense activity under section 902 of such title. 
(2) Guidance promulgated regarding how units of the 
National Guard shall collaborate with relevant civil, law 
enforcement, and cybersecurity agencies when conducting a 
homeland defense activity under section 902 of title 32, United 
States Code. 
(c) UPDATE TO CERTAIN REGULATIONS AND GUIDANCE.—If the 
Secretary of Defense determines such is appropriate based on the 
evaluation required under subsection (a) and the review described 
in subsection (b), the Secretary shall update— 
(1) the regulations referred to in subsection (b)(1); and 
(2) the guidance referred to in subsection (b)(2). 
(d) UPDATE
TO
THE NATIONAL CYBER INCIDENT RESPONSE 
PLAN.—Not later than 270 days after the date of the enactment 
of this Act, the Secretary of Homeland Security, in coordination 
with the Secretary of Defense, may update the National Cyber 
Incident Response Plan to address any changes made by the Sec-
retary of Defense to the roles and responsibilities of the National 
Guard for the response to and recovery from significant cyber 
incidents. 
(e) JOINT BRIEFINGS.—Not later than 300 days after the date 
of the enactment of this Act, the Secretary of Defense and the 
Secretary of Homeland Security shall jointly brief the congressional 
defense committees, the Committee on Homeland Security and 
Governmental Affairs of the Senate and the Committee on Home-
land Security of the House of Representatives on the following: 
(1) The results of the evaluation required under subsection 
(a)(1), including the utilization of any input provided to the 
Secretary of Defense pursuant to subsection (a)(2). 
(2) Any updated regulations or guidance in accordance 
with subsection (c). 
(3) Any update by the Secretary of Homeland Security 
to the National Cyber Incident Response Plan pursuant to 
subsection (d). 
(4) How the Department of Defense, including the National 
Guard, and the Department of Homeland Security, including 
the Cybersecurity and Infrastructure Security Agency and the 
Federal Emergency Management Agency, will collaborate with 
each other and with relevant law enforcement, State govern-
ments, and other non-Federal entities when responding to and 
recovering from significant cyber incidents. 
(f) DEFINITION.—The term ‘‘significant cyber incident’’ means 
a cyber incident that results, or several related cyber incidents 
that result, in demonstrable harm to— 
(1) the national security interests, foreign relations, or 
economy of the United States; or 
(2) the public confidence, civil liberties, or public health 
and safety of the American people. 
SEC. 1730. EVALUATION OF NON-TRADITIONAL CYBER SUPPORT TO 
THE DEPARTMENT OF DEFENSE. 
(a) REQUIREMENT.—Not later than 270 days after the date 
of the enactment of this Act, the Principal Cyber Advisor to the 
Secretary of Defense, in conjunction with the Under Secretary for 
Personnel and Readiness of the Department of Defense and the 
Principal Cyber Advisors of the military services, shall submit
H. R. 6395—733 
to the congressional defense committees an evaluation of reserve 
models tailored to the support of cyberspace operations for the 
Department. 
(b) ELEMENTS.—The evaluation conducted under subsection (a) 
shall include assessment of the following: 
(1) The capabilities and deficiencies in military and civilian 
personnel with needed cybersecurity expertise, and the quantity 
of personnel with such expertise, within the Department. 
(2) The potential for a uniformed, civilian, or mixed cyber 
reserve force to remedy shortfalls in expertise and capacity. 
(3) The ability of the Department to attract the personnel 
with the desired expertise to either a uniformed or civilian 
cyber reserve force. 
(4) The number of personnel, their skills, additional infra-
structure required, funding, and the composition of a cyber 
reserve force that would be required to meet the needs of 
the Department. 
(5) Alternative models for establishing a cyber reserve force, 
including the following: 
(A) A traditional uniformed military reserve compo-
nent. 
(B) A nontraditional uniformed military reserve compo-
nent, with respect to drilling and other requirements such 
as grooming and physical fitness. 
(C) Nontraditional civilian cyber reserve options. 
(D) Hybrid options. 
(E) Models of reserve support used by international 
allies and partners. 
(6) The impact each of the cyber reserve models would 
have on active duty and existing reserve forces, including the 
following: 
(A) Recruiting. 
(B) Promotion. 
(C) Retention. 
(D) Relocation. 
(7) The impact each of the cyber reserve models would 
have on the Cyber Operations Forces total force, including 
the following: 
(A) Cyber operations forces training. 
(B) Cyber operations forces individual and unit readi-
ness. 
(C) Cyber operations forces training ranges and cyber 
warfighting architectures. 
(D) Infrastructure supporting Cyber Operations Forces. 
(8) The impact each of the cyber reserve models would 
have on the private sector, particularly during and immediately 
after a major cyber incident. 
(9) An evaluation of work conducted to date by the Depart-
ment of Defense in response to the 2014 Report of the Reserve 
Forces Policy Board on Department of Defense Cyber Approach: 
Use of the National Guard and Reserve in the Cyber Mission 
Force. 
SEC. 1731. INTEGRATED CYBERSECURITY CENTER PLAN. 
(a) IN GENERAL.—Not later than one year after the date of 
the enactment of this Act, the Secretary of Homeland Security, 
in coordination with the Secretary of Defense, the Attorney General,
H. R. 6395—734 
the Director of the Federal Bureau of Investigation, and the Director 
of National Intelligence, shall submit to the relevant congressional 
committees a report on Federal cybersecurity centers and the poten-
tial for better coordination of Federal cybersecurity efforts at an 
integrated cybersecurity center within the Cybersecurity and Infra-
structure Security Agency of the Department of Homeland Security 
in furtherance of the functions specified in section 2209 of the 
Homeland Security Act of 2002 (6 U.S.C. 659). 
(b) CONTENTS.—To prepare the report required by subsection 
(a), the Secretary of Homeland Security shall aggregate information 
from components of the Department of Homeland Security with 
information provided to the Secretary of Homeland Security by 
the Secretary of Defense, the Attorney General, the Director of 
the Federal Bureau of Investigation, and the Director of National 
Intelligence. Such aggregated information shall relate to the fol-
lowing topics: 
(1) Any challenges regarding capacity and funding identi-
fied by the Secretary of Homeland Security, the Director of 
the Federal Bureau of Investigation, the Attorney General, 
the Secretary of Defense, and the Director of National Intel-
ligence that negatively impact coordination with the Cybersecu-
rity and Infrastructure Security Agency of the Department 
of Homeland Security in furtherance of the security and resil-
ience of critical infrastructure. 
(2) Distinct statutory authorities identified by the Secretary 
of Homeland Security, the Attorney General, the Director of 
the Federal Bureau of Investigation, the Secretary of Defense, 
or the Director of National Intelligence that should not be 
leveraged by an integrated cybersecurity center within the 
Cybersecurity and Infrastructure Security Agency. 
(3) Any challenges associated with effective mission 
coordination and deconfliction between the Cybersecurity and 
Infrastructure Security Agency of the Department of Homeland 
Security and other Federal agencies that could be addressed 
with the creation of an integrated cybersecurity center within 
the Cybersecurity and Infrastructure Security Agency. 
(4) How capabilities or missions of existing Federal cyber 
centers could benefit from greater integration or collocation 
to support cybersecurity collaboration with critical infrastruc-
ture at an integrated cybersecurity center within the Cybersecu-
rity and Infrastructure Security Agency, including the following 
Federal cyber centers: 
(A) The National Security Agency’s Cyber Threat Oper-
ations Center. 
(B) United States Cyber Command’s Joint Operations 
Center. 
(C) Elements of the Office of the Director of National 
Intelligence, as determined appropriate by the Director 
(D) The Federal Bureau of Investigation’s National 
Cyber Investigative Joint Task Force. 
(E) The Department of Defense’s Defense Cyber Crime 
Center. 
(c) ELEMENTS.—The report required under subsection (a) 
shall— 
(1) identify any challenges regarding the Cybersecurity and 
Infrastructure Security Agency’s current authorities, structure, 
resources, funding, ability to recruit and retain its workforce,
H. R. 6395—735 
or interagency coordination that negatively impact the ability 
of the Agency to fulfill its role as the central coordinator for 
critical infrastructure cybersecurity and resilience pursuant to 
its authorities under the Homeland Security Act of 2002, and 
information on how establishing an integrated cybersecurity 
center within the Cybersecurity and Infrastructure Security 
Agency would address such challenges; 
(2) identify any facility needs for the Cybersecurity and 
Infrastructure Security Agency to adequately host personnel, 
maintain sensitive compartmented information facilities, and 
other resources to serve as the primary coordinating body 
charged with forging whole-of-government, public-private 
collaboration in cybersecurity, pursuant to such authorities; 
(3) identify any lessons from national-level efforts by United 
States allies, such as the United Kingdom’s National Cyber 
Security Centre, to determine whether an integrated cybersecu-
rity center within the Cybersecurity and Infrastructure Security 
Agency should be similarly organized into an unclassified 
environment and a classified environment; 
(4) recommend any changes to procedures and criteria for 
increasing and expanding the participation and integration of 
public- and private-sector personnel into Federal cyber defense 
and security efforts, including continuing limitations or hurdles 
in the security clearance program for private sector partners 
and integrating private sector partners into a Cybersecurity 
and Infrastructure Security Agency integrated cyber center; 
and 
(5) propose policies, programs, or practices that could over-
come challenges identified in the aggregated information under 
subsection (b), including the potential creation of an integrated 
cybersecurity center within the Cybersecurity and Infrastruc-
ture Security Agency, accompanied by legislative proposals, 
as appropriate. 
(d) PLAN.—Upon submitting the report pursuant to subsection 
(a), the Secretary of Homeland Security, in coordination with the 
Secretary of Defense, the Attorney General, the Director of the 
Federal Bureau of Investigation, and the Director of National Intel-
ligence, may submit to the relevant congressional committees a 
plan to establish an integrated cybersecurity center within the 
Cybersecurity and Infrastructure Security Agency, if appropriate, 
or to implement other mechanisms for improving cybersecurity 
coordination among the Federal cyber centers specified in subsection 
(b)(4). 
(e) PRIVACY REVIEW.—The Privacy Officers of the Department 
of Homeland Security, the Department of Defense, the Department 
of Justice, and the Federal Bureau of Investigation, and the Director 
of National Intelligence shall review and provide to the relevant 
congressional committees comment, as appropriate, on each report 
and legislative proposal submitted under this section. 
(f) DEFINITION.—In this section, the term ‘‘relevant congres-
sional committees’’ means— 
(1) in the House of Representatives— 
(A) the Committee on Armed Services; 
(B) the Committee on the Judiciary; 
(C) the Permanent Select Committee on Intelligence; 
and 
(D) the Committee on Homeland Security; and
H. R. 6395—736 
(2) in the Senate— 
(A) the Committee on Armed Services; 
(B) the Committee on the Judiciary; 
(C) the Select Committee on Intelligence; and 
(D) the Committee on Homeland Security and Govern-
mental Affairs. 
SEC. 1732. ASSESSMENT OF CYBER OPERATIONAL PLANNING AND 
DECONFLICTION POLICIES AND PROCESSES. 
(a) ASSESSMENT.—Not later than August 1, 2021, the Principal 
Cyber Advisor of the Department of Defense and the Commander 
of United States Cyber Command shall jointly, in coordination 
with the Under Secretary of Defense for Policy, the Under Secretary 
of Defense for Intelligence and Security, and the Chairman of 
the Joint Chiefs of Staff, conduct and complete an assessment 
on the operational planning and deconfliction policies and processes 
that govern cyber operations of the Department of Defense. 
(b) ELEMENTS.—The assessment required by subsection (a) shall 
include evaluations as to whether— 
(1) the joint targeting cycle and relevant operational and 
targeting databases are suitable for the conduct of timely and 
well-coordinated cyber operations; 
(2) each of the policies and processes in effect to facilitate 
technical, operational, and capability deconfliction are appro-
priate for the conduct of timely and effective cyber operations; 
(3) intelligence gain-loss decisions made by Cyber Com-
mand are sufficiently well-informed and made in timely fashion; 
(4) relevant intelligence data and products are consistently 
available and distributed to relevant planning and operational 
elements in Cyber Command; 
(5) collection operations and priorities meet the operational 
requirements of Cyber Command; and 
(6) authorities relevant to intelligence, surveillance, and 
reconnaissance and operational preparation of the environment 
are delegated to the appropriate level. 
(c) BRIEFING.—Not later than September 1, 2021, the Principal 
Cyber Advisor and the Commander of United States Cyber Com-
mand shall provide to the Committee on Armed Services of the 
Senate and the Committee on Armed Services of the House of 
Representatives a briefing on the findings of the assessment com-
pleted under subsection (a), including discussion of planned policy 
and process changes, if any, relevant to cyber operations. 
SEC. 
1733. 
PILOT 
PROGRAM 
ON 
CYBERSECURITY 
CAPABILITY 
METRICS. 
(a) PILOT PROGRAM REQUIRED.—The Secretary of Defense, 
acting through the Chief Information Officer of the Department 
of Defense and the Commander of United States Cyber Command, 
shall conduct a pilot program to assess the feasibility and advis-
ability of developing and using speed-based metrics to measure 
the performance and effectiveness of security operations centers 
and cyber security service providers in the Department of Defense. 
(b) REQUIREMENTS.— 
(1) DEVELOPMENT OF METRICS.—(A) Not later than July 
1, 2021, the Chief Information Officer and the Commander 
shall jointly develop metrics described in subsection (a) to carry 
out the pilot program under such subsection.
H. R. 6395—737 
(B) The Chief Information Officer and the Commander 
shall ensure that the metrics developed under subpara-
graph (A) are commensurate with the representative 
timelines of nation-state and non-nation-state actors when 
gaining access to, and compromising, Department net-
works. 
(2) USE OF METRICS.—(A) Not later than December 1, 2021, 
the Secretary shall, in carrying out the pilot program required 
by subsection (a), begin using the metrics developed under 
paragraph (1) of this subsection to assess select security oper-
ations centers and cyber security service providers, which the 
Secretary shall select specifically for purposes of the pilot pro-
gram, for a period of not less than four months. 
(B) In carrying out the pilot program under subsection 
(a), the Secretary shall evaluate the effectiveness of opera-
tors, capabilities available to operators, and operators’ tac-
tics, techniques, and procedures. 
(c) AUTHORITIES.—In carrying out the pilot program under sub-
section (a), the Secretary may— 
(1) assess select security operations centers and cyber secu-
rity service providers— 
(A) over the course of their mission performance; or 
(B) in the testing and accreditation of cybersecurity 
products and services on test networks designated pursuant 
to section 1658 of the National Defense Authorization Act 
for Fiscal Year 2020 (Public Law 116–92); and 
(2) assess select elements’ use of security orchestration 
and response technologies, modern endpoint security tech-
nologies, Big Data Platform instantiations, and technologies 
relevant to zero trust architectures. 
(d) BRIEFING.— 
(1) IN GENERAL.—Not later than March 1, 2022, the Sec-
retary shall brief the Committee on Armed Services of the 
Senate and the Committee on Armed Services of the House 
of Representatives on the findings of the Secretary with respect 
to the pilot program required by subsection (a). 
(2) ELEMENTS.—The briefing provided under paragraph (1) 
shall include the following: 
(A) The pilot metrics developed under subsection (b)(1). 
(B) The findings of the Secretary with respect to the 
assessments carried out under subsection (b)(2). 
(C) An analysis of the utility of speed-based metrics 
in assessing security operations centers and cyber security 
service providers. 
(D) An analysis of the utility of the extension of the 
pilot metrics to or speed-based assessment of the Cyber 
Mission Forces. 
(E) An assessment of the technical and procedural 
measures that would be necessary to meet the speed-based 
metrics developed and applied in the pilot program. 
SEC. 1734. ASSESSMENT OF EFFECT OF INCONSISTENT TIMING AND 
USE OF NETWORK ADDRESS TRANSLATION IN DEPART-
MENT OF DEFENSE NETWORKS. 
(a) IN GENERAL.—Not later than March 1, 2021, the Chief 
Information Officer of the Department of Defense shall conduct 
comprehensive assessments as follows:
H. R. 6395—738 
(1) TIMING VARIABILITY IN DEPARTMENT NETWORKS.—The 
Chief Information Officer shall characterize— 
(A) timing variability across Department information 
technology and operational technology networks, appli-
ances, devices, applications, and sensors that generate 
time-stamped data and metadata used for cybersecurity 
purposes; 
(B) how timing variability affects current, planned, 
and potential capabilities for detecting network intrusions 
that rely on correlating events and the sequence of events; 
and 
(C) how to harmonize standard of timing across Depart-
ment networks. 
(2) USE OF NETWORK ADDRESS TRANSLATION.—The Chief 
Information Officer shall characterize— 
(A) why and how the Department is using Network 
Address Translation (NAT) and multiple layers and nesting 
of Network Address Translation; 
(B) how using Network Address Translation affects 
the ability to link malicious communications detected at 
various network tiers to specific endpoints or hosts to 
enable 
prompt 
additional 
investigations, 
quarantine 
decisions, and remediation activities; and 
(C) what steps and associated cost and schedule are 
necessary to eliminate the use of Network Address Trans-
lation or to otherwise provide transparency to network 
defenders, including options to accelerate the transition 
from Internet Protocol version 4 to Internet Protocol version 
6. 
(b) RECOMMENDATION.—The Chief Information Officer and the 
Principal Cyber Advisor shall submit to the Secretary of Defense 
a recommendation to address the assessments conducted under 
subsection (a), including whether and how to revise the cyber 
strategy of the Department. 
(c) BRIEFING.—Not later than April 1, 2021, the Chief Informa-
tion Officer shall brief the congressional defense committees on 
the findings of the Chief Information Officer with respect to the 
assessments conducted under subsection (a) and the recommenda-
tion submitted under subsection (b). 
SEC. 1735. INTEGRATION OF DEPARTMENT OF DEFENSE USER 
ACTIVITY MONITORING AND CYBERSECURITY. 
(a) INTEGRATION OF PLANS, CAPABILITIES, AND SYSTEMS.—The 
Secretary of Defense shall integrate the plans, capabilities, and 
systems for user activity monitoring, and the plans, capabilities, 
and systems for endpoint cybersecurity and the collection of 
metadata on network activity for cybersecurity to enable mutual 
support and information sharing. 
(b) REQUIREMENTS.—In carrying out subsection (a), the Sec-
retary shall— 
(1) consider using the Big Data Platform instances that 
host cybersecurity metadata for storage and analysis of all 
user activity monitoring data collected across the Department 
of Defense Information Network at all security classification 
levels;
H. R. 6395—739 
(2) develop policies and procedures governing access to 
user activity monitoring data or data derived from user activity 
monitoring by cybersecurity operators; and 
(3) develop processes and capabilities for using metadata 
on host and network activity for user activity monitoring in 
support of the insider threat mission. 
(c) CONGRESSIONAL BRIEFING.—Not later than October 1, 2021, 
the Secretary shall provide a briefing to the congressional defense 
committees on actions taken to carry out this section. 
SEC. 1736. DEFENSE INDUSTRIAL BASE CYBERSECURITY SENSOR 
ARCHITECTURE PLAN. 
(a) 
DEFENSE
INDUSTRIAL
BASE
CYBERSECURITY
SENSOR 
ARCHITECTURE PROGRAM ASSESSMENT.—Not later than 180 days 
after the date of the enactment of this Act, the Principal Cyber 
Advisor of the Department of Defense, in consultation with the 
Chief Information Officer of the Department, the Under Secretary 
of Defense for Acquisition and Sustainment, the Under Secretary 
of Defense for Intelligence and Security, and the Commander of 
United States Cyber Command, shall complete an assessment of 
the feasibility, suitability, and resourcing required to establish a 
Defense Industrial Base Cybersecurity Sensor Architecture Pro-
gram, responsible for deploying commercial-off-the-shelf solutions 
to remotely monitor the public-facing internet attack surface of 
the defense industrial base. 
(b) ELEMENTS.—The assessment required under subsection (a) 
shall include the following: 
(1) Definition of an architecture, concept of operations, 
and governance structure that— 
(A) will allow for the instrumentation and collection 
of cybersecurity data on the public-facing internet attack 
surfaces of defense industrial base contractors in a manner 
that is compatible with the Department’s existing or future 
capabilities for analysis, and instrumentation and collec-
tion, as appropriate, of cybersecurity data within the 
Department of Defense Information Network; 
(B) includes the expected scale, schedule, and guiding 
principles of deployment; 
(C) is consistent with the defense industrial base cyber-
security policies and programs of the Under Secretary of 
Defense for Acquisition and Sustainment and the Chief 
Information Officer; and 
(D) includes an acquisition strategy for sensor capabili-
ties that optimizes required capability, scalability, cost, 
and intelligence and cybersecurity requirements. 
(2) Roles and responsibilities of the persons referred to 
in subsection (a) in implementing and executing the plan. 
(c) CONSULTATION.—In conducting the assessment required 
under subsection (a), the Principal Cyber Advisor shall consult 
with and solicit recommendations from representative industry 
stakeholders across the defense industrial base regarding the ele-
ments described in subsection (b) and potential stakeholder costs 
of compliance. 
(d) BRIEFING.—Upon completion of the assessment required 
under subsection (a), the Principal Cyber Advisor shall provide 
a briefing to the Committee on Armed Services of the Senate
H. R. 6395—740 
and the Committee on Armed Services of the House of Representa-
tives on the assessment. 
SEC. 1737. ASSESSMENT ON DEFENSE INDUSTRIAL BASE PARTICIPA-
TION IN A THREAT INFORMATION SHARING PROGRAM. 
(a) DEFENSE INDUSTRIAL BASE THREAT INFORMATION PROGRAM 
ASSESSMENT.—Not later than 270 days after the date of the enact-
ment of this Act, the Secretary of Defense shall complete an assess-
ment of the feasibility, suitability, and definition of, and resourcing 
required to establish, a defense industrial base threat information 
sharing program to collaborate and share threat information with, 
and obtain threat information from, the defense industrial base. 
(b) ELEMENTS.—The assessment regarding the establishment 
of a defense industrial base threat information sharing program 
under subsection (a) shall include evaluation of the following: 
(1) The feasibility and suitability of, and requirements for, 
the establishment of a defense industrial base threat informa-
tion 
sharing 
program, 
including 
cybersecurity 
incident 
reporting requirements applicable to the defense industrial base 
that— 
(A) extend beyond mandatory cybersecurity incident 
reporting requirements as in effect on the day before the 
date of the enactment of this Act; 
(B) set specific, consistent timeframes for all categories 
of cybersecurity incident reporting; 
(C) establish a single clearinghouse for all mandatory 
cybersecurity incident reporting to the Department of 
Defense, including incidents involving covered unclassified 
information, and classified information; and 
(D) provide that, unless authorized or required by 
another provision of law or the element of the defense 
industrial base making the report consents, nonpublic 
information of which the Department becomes aware only 
because of a report provided pursuant to the program shall 
be disseminated and used only for a cybersecurity purpose 
(as such term is defined in section 102 of the Cybersecurity 
Information Sharing Act of 2015 (6 U.S.C. 1501)) and in 
support of national defense activities. 
(2) A mechanism for developing a shared and real-time 
picture of the threat environment. 
(3) Options for joint, collaborative, and co-located analytics. 
(4) Possible investments in technology and capabilities to 
support automated detection and analysis across the defense 
industrial base. 
(5) 
Coordinated 
information 
tipping, 
sharing, 
and 
deconfliction, as necessary, with relevant Federal Government 
agencies with similar information sharing programs. 
(6) Processes for direct sharing of threat information related 
to a specific defense industrial base entity with such entity. 
(7) Mechanisms for providing defense industrial base enti-
ties with clearances for national security information access, 
as appropriate. 
(8) Requirements to consent to queries of foreign intel-
ligence collection databases related to a specific defense indus-
trial base entity as a condition of participation in the threat 
information sharing program.
H. R. 6395—741 
(9) Recommendations with respect to threat information 
sharing program participation, including the following: 
(A) Incentives for defense industrial base entities to 
participate in the threat information sharing program. 
(B) Mandating minimum levels of threat information 
sharing program participation for any entity that is part 
of the defense industrial base. 
(C) Procurement prohibitions on any defense industrial 
base entity that are not in compliance with the require-
ments of the threat information sharing program. 
(D) Waiver authority and criteria. 
(E) Adopting tiers of requirements for participation 
within the threat information sharing program based on— 
(i) the role of and relative threats related to 
defense industrial base entities; and 
(ii) Cybersecurity Maturity Model Certification 
level. 
(10) Options to utilize an existing federally recognized 
information sharing program to satisfy the requirement for 
a threat information sharing program if— 
(A) the existing program includes, or is modified to 
include, two-way sharing of threat information that is 
specifically relevant to the defense industrial base; and 
(B) such a program is coordinated with other Federal 
Government agencies with existing information sharing 
programs where overlap occurs. 
(11) Methods to encourage participation of defense indus-
trial base entities in appropriate private sector information 
sharing and analysis centers (ISACs). 
(12) Methods to coordinate collectively with defense indus-
trial base entities to consider methods for mitigating compliance 
costs. 
(13) The resources needed, governance roles and structures 
required, and changes in regulation or law needed for execution 
of a threat information sharing program, as well as any other 
considerations determined relevant by the Secretary. 
(14) Identification of any barriers that would prevent the 
establishment of a defense industrial base threat information 
sharing program. 
(c) CONSULTATION.—In conducting the assessment required 
under subsection (a), the Secretary of Defense shall consult with 
and solicit recommendations from representative industry stake-
holders across the defense industrial base regarding the elements 
described in subsection (b) and potential stakeholder costs of compli-
ance. 
(d) DETERMINATION AND BRIEFING.—Upon completion of the 
assessment required under subsection (a), the Secretary of Defense 
shall make a determination regarding the establishment by the 
end of fiscal year 2021 of a defense industrial base threat informa-
tion sharing program and provide a briefing to the Committee 
on Armed Services of the Senate and the Committee on Armed 
Services of the House of Representatives on— 
(1) the findings of the Secretary with respect to such assess-
ment and such determination; and 
(2) such implementation plans as the Secretary may have 
arising from such findings.
H. R. 6395—742 
(e) IMPLEMENTATION.—If the Secretary of Defense makes a 
positive determination pursuant to subsection (d) of the feasibility 
and suitability of establishing a defense industrial base threat 
information sharing program, the Secretary shall establish such 
program. Not later than 180 days after a positive determination, 
the Secretary of Defense shall promulgate such rules and regula-
tions as are necessary to establish the defense industrial base 
threat information sharing program under this section. 
SEC. 1738. ASSISTANCE FOR SMALL MANUFACTURERS IN THE 
DEFENSE INDUSTRIAL SUPPLY CHAIN ON MATTERS 
RELATING TO CYBERSECURITY. 
(a) IN GENERAL.—Subject to the availability of appropriations, 
the Secretary of Defense, in consultation with the Director of the 
National Institute of Standards and Technology, may award finan-
cial assistance to a Center for the purpose of providing cybersecurity 
services to small manufacturers. 
(b) CRITERIA.—If the Secretary carries out subsection (a), the 
Secretary, in consultation with the Director, shall establish and 
publish on the grants.gov website, or successor website, criteria 
for selecting recipients for financial assistance under this section. 
(c) USE OF FINANCIAL ASSISTANCE.—Financial assistance under 
this section— 
(1) shall be used by a Center to provide small manufactur-
ers with cybersecurity services, including— 
(A) compliance with the cybersecurity requirements 
of the Department of Defense Supplement to the Federal 
Acquisition Regulation, including awareness, assessment, 
evaluation, preparation, and implementation of cybersecu-
rity services; and 
(B) achieving compliance with the Cybersecurity Matu-
rity Model Certification framework of the Department of 
Defense; and 
(2) may be used by a Center to employ trained personnel 
to deliver cybersecurity services to small manufacturers. 
(d) BIENNIAL REPORTS.— 
(1) IN GENERAL.—Not less frequently than once every two 
years, the Secretary shall submit to the congressional defense 
committees, the Committee on Commerce, Science, and 
Transportation of the Senate, and the Committee on Science, 
Space, and Technology of the House of Representatives a report 
on financial assistance awarded under this section. 
(2) CONTENTS.—To the extent practicable, each report sub-
mitted under paragraph (1) shall include the following with 
respect to the years covered by each such report: 
(A) The number of small manufacturers assisted. 
(B) A description of the cybersecurity services provided. 
(C) A description of the cybersecurity matters 
addressed. 
(D) An analysis of the operational effectiveness and 
cost-effectiveness of such cybersecurity services. 
(e) TERMINATION.—The authority of the Secretary to award 
financial assistance under this section shall terminate on the date 
that is five years after the date of the enactment of this section. 
(f) DEFINITIONS.—In this section:
H. R. 6395—743 
(1) CENTER.—The term ‘‘Center’’ has the meaning given 
such term in section 25(a) of the National Institute of Standards 
and Technology Act (15 U.S.C. 278k(a)). 
(2) SMALL
MANUFACTURER.—The term ‘‘small manufac-
turer’’ has the meaning given such term in section 1644(g) 
of the John S. McCain National Defense Authorization Act 
for Fiscal Year 2019 (Public Law 115–232; 10 U.S.C. 2224 
note). 
SEC. 1739. ASSESSMENT ON DEFENSE INDUSTRIAL BASE CYBERSECU-
RITY THREAT HUNTING PROGRAM. 
(a) ASSESSMENT REQUIRED.—Not later than 270 days after the 
date of the enactment of this Act, the Secretary of Defense shall 
complete an assessment of the feasibility, suitability, definition 
of, and resourcing required to establish a defense industrial base 
cybersecurity threat hunting program to actively identify cybersecu-
rity threats and vulnerabilities within the defense industrial base. 
(b) ELEMENTS.—The assessment required under section (a) shall 
include evaluation of the following: 
(1) Existing defense industrial base cybersecurity threat 
hunting policies and programs, including the threat hunting 
elements at each level of the compliance-based Cybersecurity 
Maturity Model Certification program of the Department of 
Defense, including requirements germane to continuous moni-
toring, discovery, and investigation of anomalous activity indic-
ative of a cybersecurity incident. 
(2) The suitability of a continuous cybersecurity threat 
hunting program, as a supplement to the cyber hygiene require-
ments of the Cybersecurity Maturity Model Certification, 
including consideration of the following: 
(A) Collection and analysis of metadata on network 
activity to detect possible intrusions. 
(B) Rapid investigation and remediation of possible 
intrusions. 
(C) Requirements for mitigating any vulnerabilities 
identified pursuant to the cybersecurity threat hunting pro-
gram. 
(D) Mechanisms for the Department of Defense to 
share with entities in the defense industrial base malicious 
code, indicators of compromise, and insights on the evolving 
threat landscape. 
(3) Recommendations with respect to cybersecurity threat 
hunting program participation of prime contractors and sub-
contractors, including relating to the following: 
(A) Incentives for defense industrial base entities to 
share with the Department of Defense threat and vulner-
ability information collected pursuant to threat monitoring 
and hunting activities. 
(B) Mandating minimum levels of program participa-
tion for any defense industrial base entity. 
(C) Procurement prohibitions on any defense industrial 
base entity that is not in compliance with the requirements 
of the cybersecurity threat hunting program. 
(D) Waiver authority and criteria. 
(E) Consideration of a tiered cybersecurity threat 
hunting program that takes into account the following:
H. R. 6395—744 
(i) The cybersecurity maturity of defense industrial 
base entities. 
(ii) The roles of such entities. 
(iii) Whether each such entity possesses classified 
information or controlled unclassified information and 
covered defense networks. 
(iv) The covered defense information to which each 
such entity has access as a result of contracts with 
the Department of Defense. 
(4) Whether the continuous cybersecurity threat-hunting 
program described in paragraph (2) should be conducted by— 
(A) qualified prime contractors or subcontractors; 
(B) accredited third-party cybersecurity vendors; 
(C) with contractor consent— 
(i) United States Cyber Command; or 
(ii) a component of the Department of Defense 
other than United States Cyber Command; 
(D) the deployment of network sensing technologies 
capable of identifying and filtering malicious network 
traffic; or 
(E) a combination of the entities specified in subpara-
graphs (A) through (D). 
(5) The resources necessary, governance structures or 
changes in regulation or law needed, and responsibility for 
execution of a defense industrial base cybersecurity threat 
hunting program, as well as any other considerations deter-
mined relevant by the Secretary. 
(6) A timelime for establishing the defense industrial base 
cybersecurity threat hunting program not later than two years 
after the date of the enactment of this Act. 
(7) Identification of any barriers that would prevent such 
establishment. 
(c) CONSULTATION.—In conducting the assessment required 
under subsection (a), the Secretary of Defense shall consult with 
and solicit recommendations from representative industry stake-
holders across the defense industrial base regarding the elements 
described in subsection (b) and potential stakeholder costs of compli-
ance. 
(d) DETERMINATION AND BRIEFING.—Upon completion of the 
assessment required under subsection (a), the Secretary of Defense 
shall make a determination regarding the establishment of a 
defense industrial base cybersecurity threat hunting program and 
provide a briefing to the Committee on Armed Services of the 
Senate and the Committee on Armed Services of the House of 
Representatives on— 
(1) the findings of the Secretary with respect to such assess-
ment and such determination; and 
(2) such implementation plans as the Secretary may have 
arising from such findings. 
(e) IMPLEMENTATION.—If the Secretary of Defense makes a 
positive determination pursuant to subsection (d) of the feasibility 
and suitability of establishing a defense industrial base threat 
cybersecurity threat hunting program, the Secretary shall establish 
such program. Not later than 180 days after a positive determina-
tion, the Secretary of Defense shall promulgate such rules and 
regulations as are necessary to establish the defense industrial 
base cybersecurity threat hunting program under this section.
H. R. 6395—745 
SEC. 1740. DEFENSE DIGITAL SERVICE. 
(a) RELATIONSHIP WITH UNITED STATES DIGITAL SERVICE.— 
Not later than 120 days after the date of the enactment of this 
Act, the Secretary of Defense and the Administrator of the United 
States Digital Service shall establish a direct relationship between 
the Department of Defense and the United States Digital Service 
to address authorities, hiring processes, roles, and responsibilities 
of the Defense Digital Service. 
(b) CERTIFICATION.—Not later than 120 days after the date 
of the enactment of this Act, the Secretary of Defense and the 
Administrator of the United States Digital Service shall jointly 
certify to the congressional defense committees, the Committee 
on Homeland Security and Governmental Affairs of the Senate, 
and the Committee on Oversight and Reform of the House of 
Representatives that the skills and qualifications of the Department 
of Defense personnel assigned to and supporting the core functions 
of the Defense Digital Service are consistent with the skills and 
qualifications United States Digital Service personnel. 
(c) BRIEFING.—Not later than 150 days after the date of the 
enactment of this Act, the Secretary of Defense and the Adminis-
trator of the United States Digital Service shall provide to the 
Committee on Armed Services and the Committee on Homeland 
Security and Governmental Affairs of the Senate and the Committee 
on Armed Services and the Committee on Oversight and Reform 
of the House of Representatives a briefing on the relationship 
established in subsection (a). 
SEC. 1741. MATTERS CONCERNING THE COLLEGE OF INFORMATION 
AND CYBERSPACE AND LIMITATION OF FUNDING FOR 
NATIONAL DEFENSE UNIVERSITY. 
(a) PROHIBITIONS.—The Secretary of Defense may not— 
(1) eliminate, divest, downsize, reorganize, or seek to reduce 
the number of students educated at the College of Information 
and Cyberspace of the National Defense University, or 
(2) obligate or expend more than 60 percent of the funds 
authorized to be appropriated by this Act for fiscal year 2021 
for the National Defense University, 
until 60 days after the date on which the congressional defense 
committees receive the report required by subsection (d). 
(b) ASSESSMENT.—The Chairman of the Joint Chiefs of Staff, 
in consultation with the Under Secretary of Defense for Policy, 
the Under Secretary of Defense for Personnel and Readiness, the 
Principal Cyber Advisor, the Principal Information Operations 
Advisor of the Department of Defense, the Chief Information Officer 
of the Department, the Chief Financial Officer of the Department, 
and the Commander of United States Cyber Command, shall assess 
requirements for joint professional military education and civilian 
leader education in the information environment and cyberspace 
domain to support the Department and other national security 
institutions of the Federal Government. 
(c) FURTHER ASSESSMENT, DETERMINATION, AND REVIEW.—The 
Under Secretary of Defense for Policy, in consultation with the 
Under Secretary of Defense for Personnel and Readiness, the Prin-
cipal Cyber Advisor, the Principal Information Operations Advisor 
of the Department of Defense, the Chief Information Officer of 
the Department, the Chief Financial Officer of the Department,
H. R. 6395—746 
the Chairman of the Joint Chiefs of Staff, and the Commander 
of United States Cyber Command, shall— 
(1) determine whether the importance, challenges, and com-
plexity of the modern information environment and cyberspace 
domain warrant— 
(A) a college at the National Defense University, a 
college independent of the National Defense University 
whose leadership is responsible to the Office of the Sec-
retary of Defense, or an independent public or private 
university; and 
(B) the provision of resources, services, and capacity 
at levels that are the same as, or decreased or enhanced 
in comparison to, those resources, services, and capacity 
in place at the College of Information and Cyberspace 
on January 1, 2019; 
(2) review the plan proposed by the National Defense 
University for eliminating the College of Information and 
Cyberspace and reducing and restructuring the information 
and cyberspace faculty, course offerings, joint professional mili-
tary education and degree and certificate programs, and other 
services provided by the College and the effects of such changes 
on the military and civilian personnel requirements of the 
cyber workforce; 
(3) assess the changes made to the College of Information 
and Cyberspace since January 1, 2019, and the actions nec-
essary to reverse those changes, including relocating the College 
and its associated budget, faculty, staff, students, and facilities 
outside of the National Defense University; and 
(4) determine the Department of Defense’s overall per-
sonnel requirement for cyber and information educated military 
and civilian personnel. 
(d) REPORT REQUIRED.—Not later than March 1, 2021, the 
Secretary shall present to the Committee on Armed Services of 
the House of Representatives and the Committee on Armed Services 
of the Senate a briefing, and not later than May 1, 2021, the 
Secretary shall submit to such committees a report, on— 
(1) the findings of the Secretary with respect to the assess-
ments, determinations, and reviews conducted under sub-
sections (b) and (c); and 
(2) such recommendations as the Secretary may have for 
higher education needs in the information environment and 
cyberspace domain. 
SEC. 1742. DEPARTMENT OF DEFENSE CYBER HYGIENE AND CYBERSE-
CURITY MATURITY MODEL CERTIFICATION FRAMEWORK. 
(a) CYBER SECURITY PRACTICES
AND CAPABILITIES
IN
THE 
DEPARTMENT OF DEFENSE.— 
(1) IN GENERAL.—Not later than March 1, 2021, the Sec-
retary of Defense, acting through the Chief Information Officer 
of the Department of Defense and the Commander, Joint Forces 
Headquarters-Department of Defense Information Network, 
shall assess each Department component against the Cyberse-
curity Maturity Model Certification (CMMC) framework and 
submit to the congressional defense committees a report that 
identifies each such component’s CMMC level and implementa-
tion of the cybersecurity practices and capabilities required 
in each of the levels of the CMMC framework. The report
H. R. 6395—747 
shall include, for each component that does not achieve at 
least level 3 status (referred to as ‘‘good cyber hygiene’’ in 
CMMC Model ver. 1.02), a determination as to whether and 
details as to how— 
(A) such component will implement relevant security 
measures to achieve a desired CMMC or other appropriate 
capability and performance threshold prior to March 1, 
2022; and 
(B) such component will mitigate potential risks until 
such measures are implemented. 
(2) COMPTROLLER GENERAL REPORT REQUIRED.—Not later 
than 180 days after the submission of the report required 
under paragraph (1), the Comptroller General of the United 
States shall conduct an independent review of the report and 
provide a briefing to the congressional defense committees on 
the findings of the review. 
(b) BRIEFING ON IMPLEMENTATION OF CERTAIN CYBERSECURITY 
RECOMMENDATIONS.—Not later than 180 days after the date of 
the enactment of this Act, the Secretary of Defense shall provide 
to the congressional defense committees a briefing regarding the 
plans of the Secretary to implement certain cybersecurity rec-
ommendations to ensure— 
(1) the Chief Information Officer of the Department of 
Defense takes appropriate steps to ensure implementation of 
Department of Defense Cybersecurity Culture and Compliance 
Initiative (DC3I) tasks; 
(2) Department components develop plans with scheduled 
completion dates to implement any remaining Cybersecurity 
Discipline Implementation Plan (CDIP) tasks overseen by the 
Chief Information Officer; 
(3) the Deputy Secretary of Defense identifies a Department 
component to oversee the implementation of any CDIP tasks 
not overseen by the Chief Information Officer and reports on 
progress relating to such implementation; 
(4) Department components accurately monitor and report 
information on the extent that users have completed Cyber 
Awareness Challenge training, as well as the number of users 
whose access to the Department network was revoked because 
such users have not completed such training; 
(5) the Chief Information Officer ensures all Department 
components, including Defense Advanced Research Projects 
Agency (DARPA), require their users to take Cyber Awareness 
Challenge training; and 
(6) the Chief Information Officer assesses the extent to 
which senior leaders of the Department have more complete 
information to make risk-based decisions, and revise the recur-
ring reports (or develop a new report) accordingly, including 
information relating to the Department’s progress on imple-
menting— 
(A) cybersecurity practices identified in cyber hygiene 
initiatives; and 
(B) cyber hygiene practices to protect Department net-
works from key cyberattack techniques. 
(c) CYBERSECURITY MATURITY MODEL CERTIFICATION FUNDING 
LIMITATION.—Of the funds authorized to be appropriated by this 
Act for fiscal year 2021 for implementation of the CMMC, not 
more than 60 percent of such funds may be obligated or expended
H. R. 6395—748 
until the Under Secretary of Defense for Acquisition and 
Sustainment delivers to the congressional defense committees a 
plan for implementation of the CMMC via requirements in procure-
ment contracts, developed in coordination with the Principal Cyber 
Advisor and the Chief Information Officer of the Department of 
Defense. The plan shall include a timeline for pilot activities, a 
description of the planned relationship between Department of 
Defense and the auditing or accrediting bodies, a funding and 
activity profile for the Defense Industrial Base Cybersecurity 
Assessment Center, and a description of efforts to ensure that 
the service acquisition executives and service program managers 
are equipped to implement the CMMC requirements and facilitate 
contractors’ meeting relevant requirements. 
SEC. 1743. EXTENSION OF SUNSET FOR PILOT PROGRAM ON REGIONAL 
CYBERSECURITY TRAINING CENTER FOR THE ARMY 
NATIONAL GUARD. 
Section 1651(e) of the John S. McCain National Defense 
Authorization Act for Fiscal Year 2019 (Public Law 115–232; 32 
U.S.C. 501 note) is amended by striking ‘‘shall expire on the date 
that is two years after the date of the enactment of this Act’’ 
and inserting ‘‘shall expire on August 31, 2022’’. 
SEC. 1744. NATIONAL CYBER EXERCISES. 
(a) REQUIREMENT.—Not later than December 31, 2023, the Sec-
retary of Homeland Security, in coordination with the Director 
of National Intelligence, the Attorney General, and the Secretary 
of Defense, shall conduct an exercise, which may be a tabletop 
exercise, to test the resilience, response, and recovery of the United 
States to a significant cyber incident impacting critical infrastruc-
ture. The Secretary shall convene similar exercises not fewer than 
three times, in consultation with such officials, until 2033. 
(b) PLANNING AND PREPARATION.—The exercises required under 
subsection (a) shall be prepared by— 
(1) appropriate personnel from— 
(A) the Department of Homeland Security; 
(B) the Department of Defense; and 
(C) the Department of Justice; and 
(2) appropriate elements of the intelligence community, 
identified by the Director of National Intelligence. 
(c) SUBMISSION TO CONGRESS.—For each fiscal year in which 
an exercise is planned, the Secretary, in coordination with the 
Director of National Intelligence, the Attorney General, and the 
Secretary of Defense, shall submit to the appropriate congressional 
committees a plan for the exercise not later than 180 days prior 
to the exercise. Each such plan shall include information regarding 
the goals of the exercise at issue, how the exercise is to be carried 
out, where and when the exercise will take place, how many individ-
uals are expected to participate from each Federal agency specified 
in subsection (b), and the costs or other resources associated with 
the exercise. 
(d) PARTICIPANTS.— 
(1) FEDERAL GOVERNMENT PARTICIPANTS.—Appropriate per-
sonnel from the following Federal agencies shall participate 
in each exercise required under subsection (a): 
(A) The Department of Homeland Security. 
(B) The Department of Defense, as identified by the 
Secretary of Defense.
H. R. 6395—749 
(C) Elements of the intelligence community, as identi-
fied by the Director of National Intelligence. 
(D) The Department of Justice, as identified by the 
Attorney General. 
(E) Sector-specific agencies, as determined by the Sec-
retary of Homeland Security. 
(2) STATE AND LOCAL GOVERNMENTS.—The Secretary shall 
invite representatives from State, local, and Tribal governments 
to participate in each exercise required under subsection (a) 
if the Secretary determines such is appropriate. 
(3) PRIVATE ENTITIES.—Depending on the nature of an exer-
cise being conducted under subsection (a), the Secretary, in 
consultation with the senior representative of the sector-specific 
agencies participating in such exercise in accordance with para-
graph (1)(E), shall invite the following individuals to partici-
pate: 
(A) Representatives from appropriate private entities. 
(B) Other individuals whom the Secretary determines 
will best assist the United States in preparing for, and 
defending against, a significant cyber incident impacting 
critical infrastructure. 
(4) INTERNATIONAL PARTNERS.—Depending on the nature 
of an exercise being conducted under subsection (a), the Sec-
retary may, in coordination with the Secretary of State, invite 
allies and partners of the United States to participate in such 
exercise. 
(e) OBSERVERS.—The Secretary may invite representatives from 
the executive and legislative branches of the Federal Government 
to observe an exercise required under subsection (a). 
(f) ELEMENTS.—Each exercise required under subsection (a) 
shall include the following elements: 
(1) Exercising the orchestration of cybersecurity response 
and the provision of cyber support to Federal, State, local, 
and Tribal governments and private entities, including the 
exercise of the command, control, and deconfliction of— 
(A) 
operational 
responses 
through 
interagency 
coordination processes and response groups; and 
(B) each Federal agency participating in such exercise 
in accordance with subsection (d)(1). 
(2) Testing of the information sharing needs and capabili-
ties of exercise participants. 
(3) Testing of the relevant policy, guidance, and doctrine, 
including the National Cyber Incident Response Plan of the 
Cybersecurity and Infrastructure Security Agency of the 
Department of Homeland Security. 
(4) Testing of the integration and interoperability between 
the entities participating in the exercise in accordance with 
subsection (d). 
(5) Exercising the integration and interoperability of the 
cybersecurity operation centers of the Federal Government, 
as appropriate, in coordination with appropriate cabinet level 
officials. 
(g) BRIEFING.— 
(1) IN GENERAL.—Not later than 180 days after the date 
on which each exercise required under subsection (a) is con-
ducted, the Secretary shall provide to the appropriate congres-
sional committees a briefing on the exercise.
H. R. 6395—750 
(2) CONTENTS.—Each briefing required under paragraph 
(1) shall include— 
(A) an assessment of the decision and response gaps 
observed in the exercise at issue; 
(B) proposed recommendations to improve the resil-
ience, response, and recovery of the United States to a 
significant cyber attack against critical infrastructure; and 
(C) appropriate plans to address the recommendations 
proposed under subparagraph (B). 
(h) REPEAL.—Subsection (b) of section 1648 of the National 
Defense Authorization Act for Fiscal Year 2016 (Public Law 114– 
92; 129 Stat. 1119) is repealed. 
(i) DEFINITIONS.—In this section: 
(1) APPROPRIATE CONGRESSIONAL COMMITTEES.—The term 
‘‘appropriate congressional committees’’ means— 
(A) the Committee on Armed Services of the Senate; 
(B) the Committee on Armed Services of the House 
of Representatives; 
(C) the Committee on Homeland Security and Govern-
mental Affairs of the Senate; 
(D) the Committee on Homeland Security of the House 
of Representatives; 
(E) the Select Committee on Intelligence of the Senate; 
(F) the Permanent Select Committee on Intelligence 
of the House of Representatives; 
(G) the Committee on the Judiciary of the Senate; 
(H) the Committee on the Judiciary of the House of 
Representatives; 
(I) the Committee on Commerce, Science, and 
Transportation of the Senate; 
(J) the Committee on Science, Space, and Technology 
of the House of Representatives; 
(K) the Committee on Foreign Relations of the Senate; 
and 
(L) the Committee on Foreign Affairs of the House 
of Representatives. 
(2) ELEMENT OF THE INTELLIGENCE COMMUNITY.—The term 
‘‘element of the intelligence community’’ means an element 
specified or designated under section 3 of the National Security 
Act of 1947 (50 U.S.C. 3003). 
(3) PRIVATE ENTITY.—The term ‘‘private entity’’ has the 
meaning given the term in section 102 of the Cybersecurity 
Information Sharing Act of 2015 (6 U.S.C. 1501). 
(4) SECRETARY.—The term ‘‘Secretary’’ means the Secretary 
of Homeland Security. 
(5) SECTOR-SPECIFIC
AGENCY.—The term ‘‘sector-specific 
agency’’ has the meaning given the term ‘‘Sector-Specific 
Agency’’ in section 2201 of the Homeland Security Act of 2002 
(6 U.S.C. 651). 
(6) STATE.—The term ‘‘State’’ means any State of the 
United States, the District of Columbia, the Commonwealth 
of Puerto Rico, the Northern Mariana Islands, the United States 
Virgin Islands, Guam, American Samoa, and any other territory 
or possession of the United States.
H. R. 6395—751 
SEC. 1745. CYBERSECURITY AND INFRASTRUCTURE SECURITY AGENCY 
REVIEW. 
(a) DHS REVIEW.— 
(1) IN GENERAL.—In order to strengthen the Cybersecurity 
and Infrastructure Security Agency of the Department of Home-
land Security, the Secretary of Homeland Security shall conduct 
a comprehensive review of the ability of the Agency to fulfill— 
(A) the missions of the Agency; and 
(B) the recommendations detailed in the report issued 
by the Cyberspace Solarium Commission under section 
1652(k) of the John S. McCain National Defense Authoriza-
tion Act for Fiscal Year 2019 (Public Law 115–232). 
(2) ELEMENTS OF REVIEW.—The review conducted under 
paragraph (1) shall include the following elements: 
(A) An assessment of how additional budget resources 
could be used by the Cybersecurity and Infrastructure Secu-
rity Agency for projects and programs that— 
(i) support the national risk management mission; 
(ii) support public and private-sector cybersecurity; 
(iii) promote public-private integration; and 
(iv) provide situational awareness of cybersecurity 
threats. 
(B) A comprehensive force structure assessment of the 
Cybersecurity 
and 
Infrastructure 
Security 
Agency, 
including— 
(i) a determination of the appropriate size and 
composition of personnel to accomplish the mission 
of the Agency, as well as the recommendations detailed 
in the report issued by the Cyberspace Solarium 
Commission under section 1652(k) of the John S. 
McCain National Defense Authorization Act for Fiscal 
Year 2019 (Public Law 115–232); 
(ii) an assessment of whether existing personnel 
are appropriately matched to the prioritization of 
threats in the cyber domain and risks in critical infra-
structure; 
(iii) an assessment of whether the Agency has 
the appropriate personnel and resources to— 
(I) perform risk assessments, threat hunting, 
incident response to support both private and 
public cybersecurity; 
(II) carry out the responsibilities of the Agency 
related to the security of Federal information and 
Federal information systems; and 
(III) carry out the critical infrastructure 
responsibilities of the Agency, including national 
risk management; and 
(iv) an assessment of whether current structure, 
personnel, and resources of regional field offices are 
sufficient in fulfilling agency responsibilities and mis-
sion requirements. 
(3) SUBMISSION OF REVIEW.—Not later than one year after 
the date of the enactment of this Act, the Secretary of Homeland 
Security shall submit to Congress a report detailing the results 
of the assessments required under paragraph (1), including 
recommendations to address any identified gaps. 
(b) GENERAL SERVICES ADMINISTRATION REVIEW.—
H. R. 6395—752 
(1) IN GENERAL.—The Administrator of the General Serv-
ices Administration shall— 
(A) conduct a review of current Cybersecurity and 
Infrastructure Security Agency facilities and assess the 
suitability of such facilities to fully support current and 
projected mission requirements nationally and regionally; 
and 
(B) make recommendations regarding resources needed 
to procure or build a new facility or augment existing 
facilities to ensure sufficient size and accommodations to 
fully support current and projected mission requirements, 
including the integration of personnel from the private 
sector and other departments and agencies. 
(2) SUBMISSION OF REVIEW.—Not later than one year after 
the date of the enactment of this Act, the Administrator of 
the General Services Administration shall submit the review 
required under subsection (a) to— 
(A) the President; 
(B) the Secretary of Homeland Security; and 
(C) the Committee on Homeland Security and Govern-
mental Affairs, the Committee on Appropriations, and the 
Committee on Environment and Public Work of the Senate, 
and the Committee on Homeland Security, the Committee 
on Appropriations, the Committee on Oversight and 
Reform, and the Committee on Transportation and Infra-
structure of the House of Representatives. 
SEC. 1746. REPORT ON ENABLING UNITED STATES CYBER COMMAND 
RESOURCE ALLOCATION. 
(a) IN GENERAL.—Not later than April 15, 2021, the Secretary 
of Defense shall submit to the congressional defense committees 
a report detailing the actions the Secretary will undertake to imple-
ment clauses (ii) and (iii) of section 167b(d)(2) of title 10, United 
States Code, including actions to ensure that the Commander of 
United States Cyber Command has enhanced authority, direction, 
and control of the Cyber Operations Forces and the equipment 
budget that enables Cyber Operations Forces’ operations and readi-
ness, beginning with the budget to be submitted to Congress by 
the President under section 1105(a) of title 31, United States Code, 
for fiscal year 2024, and the budget justification materials for 
the Department of Defense to be submitted to Congress in support 
of such budget. 
(b) ELEMENTS.—The report required by subsection (a) shall 
address the following items: 
(1) The procedures by which the Principal Cyber Advisor 
(PCA) will exercise authority, direction, and oversight over 
the Commander of United States Cyber Command, with respect 
to Cyber Operations Forces-peculiar equipment and resources. 
(2) The procedures by which the Commander of United 
States Cyber Command will— 
(A) prepare and submit to the Secretary program rec-
ommendations and budget proposals for Cyber Operations 
Forces and for other forces assigned to United States Cyber 
Command; and 
(B) exercise authority, direction, and control over the 
expenditure of funds for—
H. R. 6395—753 
(i) forces assigned to United States Cyber Com-
mand; and 
(ii) Cyber Operations Forces assigned to other uni-
fied combatant commands. 
(3) Recommendations for actions to enable the Commander 
of United States Cyber Command to execute the budget and 
acquisition responsibilities of the Commander in excess of cur-
rently imposed limits on the Cyber Operations Procurement 
Fund, including potential increases in personnel to support 
the Commander. 
(4) The procedures by which the Secretary will categorize 
and track funding obligated or expended for Cyber Operations 
Forces-peculiar equipment and capabilities. 
(5) The methodology and criteria by which the Secretary 
will characterize equipment as being Cyber Operations Forces- 
peculiar. 
SEC. 1747. ENSURING CYBER RESILIENCY OF NUCLEAR COMMAND AND 
CONTROL SYSTEM. 
(a) PLAN FOR IMPLEMENTATION OF FINDINGS AND RECOMMENDA-
TIONS FROM FIRST ANNUAL ASSESSMENT OF CYBER RESILIENCY OF 
NUCLEAR COMMAND AND CONTROL SYSTEM.—Not later than October 
1, 2021, the Secretary of Defense shall submit to the congressional 
defense committees a comprehensive plan, including a schedule 
and resourcing plan, for the implementation of the findings and 
recommendations included in the first report submitted under sec-
tion 499(c)(3) of title 10, United States Code. 
(b) CONCEPT OF OPERATIONS AND OVERSIGHT MECHANISM FOR 
CYBER DEFENSE OF NUCLEAR COMMAND AND CONTROL SYSTEM.— 
Not later than October 1, 2021, the Secretary shall develop and 
establish— 
(1) a concept of operations for defending the nuclear com-
mand and control system against cyber attacks, including speci-
fication of the— 
(A) roles and responsibilities of relevant entities within 
the Office of the Secretary, the military services, combatant 
commands, the Defense Agencies, and the Department of 
Defense Field Activities; and 
(B) cybersecurity capabilities to be acquired and 
employed and operational tactics, techniques, and proce-
dures, including cyber protection team and sensor deploy-
ment strategies, to be used to monitor, defend, and mitigate 
vulnerabilities in nuclear command and control systems; 
and 
(2) an oversight mechanism or governance model for over-
seeing the implementation of the concept of operations devel-
oped and established under paragraph (1), related development, 
systems engineering, and acquisition activities and programs, 
and the plan required by subsection (a), including specification 
of the— 
(A) roles and responsibilities of relevant entities within 
the Office of the Secretary, the military services, combatant 
commands, the Defense Agencies, and the Department of 
Defense Field Activities in overseeing the defense of the 
nuclear command and control system against cyber attacks;
H. R. 6395—754 
(B) responsibilities and authorities of the Strategic 
Cybersecurity Program in overseeing and, as appropriate, 
executing— 
(i) vulnerability assessments; and 
(ii) development, systems engineering, and acquisi-
tion activities; and 
(C) processes for coordination of activities, policies, and 
programs relating to the cybersecurity and defense of the 
nuclear command and control system. 
SEC. 1748. REQUIREMENTS FOR REVIEW OF AND LIMITATIONS ON THE 
JOINT REGIONAL SECURITY STACKS ACTIVITY. 
(a) INDEPENDENT REVIEW.— 
(1) IN GENERAL.—Not later than 30 days after the date 
of the enactment of this Act, the Secretary of Defense shall 
seek to enter into a contract with a not-for-profit entity or 
federally-funded research and development center independent 
of the Department of Defense to conduct a review of the Joint 
Regional Security Stacks program. 
(2) MATTERS FOR INCLUSION.—The review conducted under 
paragraph (1) shall include each of the following: 
(A) An assessment of the efficacy of the Joint Regional 
Security Stacks program and how such program has been 
managed and executed. 
(B) An analysis of the capabilities and performance 
of the program as compared to alternative solutions uti-
lizing commercial products and services. 
(C) An evaluation of the program’s ability to meet 
Department of Defense performance metrics. 
(D) An assessment of what measures would be required 
for the program to meet future to meet cost and schedule 
milestones, including training requirements. 
(b) BASELINE REVIEW.— 
(1) IN GENERAL.—Not later than 30 days after the date 
of the enactment of this Act, the Secretary of Defense shall 
undertake a baseline review of the Joint Regional Security 
Stacks program. 
(2) ELEMENTS.—The baseline review undertaken pursuant 
to paragraph (1) shall determine whether the Joint Regional 
Security Stacks program— 
(A) should proceed as a program of record, with modi-
fications as specified in subsection (c), for exclusively the 
Non-Classified Internet Protocol Network (NIPRNET) or 
for such network and the Secret Internet Protocol Network 
(SIPRNET); or 
(B) should be phased out across the Department of 
Defense with each of the Joint Regional Security Stacks 
replaced through the institution of cost-effective and 
capable 
networking 
and 
cybersecurity 
technologies, 
architectures, and operational concepts within five years 
of the date of the enactment of this Act. 
(3) INCORPORATION.—The baseline review shall incorporate 
the results of the review conducted under subsection (a). 
(c) PLAN TO TRANSITION TO PROGRAM OF RECORD.—If the Sec-
retary of Defense determines under subsection (b) that the Joint 
Regional Security Stacks program should proceed, not later than 
October 1, 2021, the Secretary shall develop a plan to transition
H. R. 6395—755 
such program to a program of record, governed by standard Depart-
ment of Defense acquisition program requirements and practices, 
including the following: 
(1) Baseline operational requirements documentation. 
(2) An acquisition strategy and baseline. 
(3) A program office and responsible program manager, 
under the oversight of the Under Secretary of Defense for 
Acquisition and Sustainment and the Chief Information Officer 
of the Department of Defense, responsible for pertinent doc-
trine, organization, training, materiel, leadership and edu-
cation, personnel, facilities and policy matters, and the develop-
ment of effective tactics, techniques, and procedures. 
(4) Manning and training requirements documentation. 
(5) Operational test planning. 
(d) LIMITATIONS.— 
(1) LIMITATION
ON
USE
OF
FUNDS.—None of the funds 
authorized to be appropriated by this Act may be used to 
field Joint Regional Security Stacks on the Secret Internet 
Protocol Network in fiscal year 2021. 
(2) LIMITATION ON OPERATIONAL DEPLOYMENT.—The Sec-
retary of Defense may not conduct an operational deployment 
of Joint Regional Security Stacks to the Secret Internet Protocol 
Network in fiscal year 2021. 
(e) SUBMISSION TO CONGRESS.—Not later than December 1, 
2021, the Secretary shall submit to the congressional defense 
committees— 
(1) the findings of the Secretary with respect to the baseline 
review conducted pursuant to subsection (b); 
(2) the plan developed under subsection (c), if any; and 
(3) a proposal for the replacement of Joint Regional Security 
Stacks, if the Secretary determines under subsection (b) that 
it should be replaced. 
SEC. 1749. IMPLEMENTATION OF INFORMATION OPERATIONS MAT-
TERS. 
(a) LIMITATION ON FUNDING.—Of the amounts authorized to 
be appropriated for fiscal year 2021 by section 301 for operation 
and maintenance and available for the Office of the Secretary 
of Defense for the travel of persons as specified in the table in 
section 4301— 
(1) not more than 25 percent shall be available until the 
date on which the report required by subsection (h)(1) of section 
1631 of the National Defense Authorization Act for Fiscal Year 
2020 (Public Law 116–92) is submitted to the Committee on 
Armed Services of the Senate and the Committee on Armed 
Services House of Representatives; and 
(2) not more than 75 percent shall be available until the 
date on which the strategy and posture review required by 
subsection (g) of such section is submitted to such committees. 
(b) REQUIREMENTS OF STRATEGY AND POSTURE REVIEW.—Para-
graph (1) of section 1631(g) of the National Defense Authorization 
Act for Fiscal Year 2020 (Public Law 116–92; 10 U.S.C. 397 note)— 
(1) in subparagraph (D), by striking the semicolon; 
(2) in subparagraph (E), by striking the period and 
inserting ‘‘; and’’; and 
(3) by adding at the end the following new subparagraph: