1532 
(C) Certain government-sponsored network 
sensors or network-monitoring programs. 
(D) Incident response and cybersecurity 
technical assistance programs. 
(E) Malware forensics and reverse-engi-
neering programs. 
(4) DATA GOVERNANCE.—The council shall es-
tablish a committee comprised of the privacy officers 
of the Department of Homeland Security, the De-
partment of Defense, and the National Security 
Agency. Such committee shall establish procedures 
and data governance structures, as necessary, to 
protect sensitive data, comply with Federal regula-
tions and statutes, and respect existing consent 
agreements with private sector critical infrastructure 
entities that apply to critical infrastructure informa-
tion. 
(5) RECOMMENDATIONS.—The council shall, as 
appropriate, submit recommendations to the Presi-
dent to support the operation, adaptation, and secu-
rity of the information collaboration environment de-
veloped pursuant to subsection (a). 
(e) DEFINITIONS.—In this section: 
(1) CRITICAL
INFRASTRUCTURE.—The term 
‘‘critical infrastructure’’ has the meaning given such
1533 
term in section 1016(e) of Public Law 107–56 (42 
U.S.C. 5195c(e)). 
(2) 
CRITICAL
INFRASTRUCTURE
INFORMA-
TION.—The term ‘‘critical infrastructure informa-
tion’’ has the meaning given such term in section 
2222 of the Homeland Security Act of 2002 (6 
U.S.C. 671). 
(3) CYBER
THREAT
INDICATOR.—The term 
‘‘cyber threat indicator’’ has the meaning given such 
term in section 102(6) of the Cybersecurity Act of 
2015 (enacted as division N of the Consolidated Ap-
propriations Act, 2016 (Public Law 114–113; 6 
U.S.C. 1501(6))). 
(4) CYBERSECURITY RISK.—The term ‘‘cyberse-
curity risk’’ has the meaning given such term in sec-
tion 2209 of the Homeland Security Act of 2002 (6 
U.S.C. 659). 
(5) CYBERSECURITY THREAT.—The term ‘‘cy-
bersecurity threat’’ has the meaning given such term 
in section 102(5) of the Cybersecurity Act of 2015 
(enacted as division N of the Consolidated Appro-
priations Act, 2016 (Public Law 114–113; 6 U.S.C. 
1501(5))). 
(6) INFORMATION SHARING AND ANALYSIS OR-
GANIZATION.—The term ‘‘information sharing and
1534 
analysis organization’’ has the meaning given such 
term in section 2222 of the Homeland Security Act 
of 2002 (6 U.S.C. 671). 
SEC. 1502. ENTERPRISE-WIDE PROCUREMENT OF COMMER-
CIAL CYBER THREAT INFORMATION PROD-
UCTS. 
(a) PROGRAM.—No later than one year after the date 
of the enactment of this Act, the Secretary of Defense, 
acting through the Commander of Joint Force Head-
quarters-Department of Defense information products 
Network, shall establish a program management office for 
the enterprise-wide procurement of commercial cyber 
threat information products. The program manager of 
such program shall be responsible for the following: 
(1) Surveying components of the Department 
for the commercial cyber threat information product 
needs of such components. 
(2) Conducting market research of commercial 
cyber threat information products. 
(3) Developing requirements, both independ-
ently and through consultation with components, for 
the acquisition of commercial cyber threat informa-
tion products. 
(4) Developing and instituting model contract 
language for the acquisition of commercial cyber
1535 
threat information products, including contract lan-
guage that facilitates Department of Defense compo-
nents’ requirements for ingesting, sharing, using and 
reusing, structuring, and analyzing data derived 
from such products. 
(5) Conducting procurement of commercial 
cyber threat information products on behalf of the 
Department of Defense, including negotiating con-
tracts with a fixed number of licenses based on ag-
gregate component demand and negotiation of exten-
sible contracts. 
(b) COORDINATION.—In implementing this section, 
each component of the Department of Defense shall co-
ordinate the commercial cyber threat information product 
requirements and potential procurement plans relating to 
such products of each such component with the program 
management office established pursuant to subsection (a) 
so as to enable the program management office to deter-
mine if satisfying such requirements or such procurement 
of such products on an enterprise-wide basis would serve 
the best interests of the Department. 
(c) PROHIBITION.—Beginning not later than 540 
days after the date of the enactment of this Act, no com-
ponent of the Department of Defense may independently 
procure a commercial cyber threat information product
1536 
that has been procured by the program management office 
established pursuant to subsection (a), unless— 
(1) such component is able to procure such 
product at a lower per-unit price than that available 
through the program management office; or 
(2) the program management office has ap-
proved such independent purchase. 
(d) EXCEPTION.—The requirements of subsections 
(b) and (c) shall not apply to the National Security Agen-
cy. 
(e) DEFINITION.—In this section, the term ‘‘commer-
cial cyber threat information products’’ refers to commer-
cially-available data and indicators that facilitate discovery 
and understanding of the targets, infrastructure, tools, 
and tactics, techniques, and procedures of cyber threats. 
Subtitle B—Cyber Systems and 
Operations 
SEC. 1511. LEGACY INFORMATION TECHNOLOGIES AND 
SYSTEMS ACCOUNTABILITY. 
(a) IN GENERAL.—Not later than 270 days after the 
date of the enactment of this Act, the Secretaries of the 
Army, Navy, and Air Force shall each initiate efforts to 
identify legacy applications, software, and information 
technology within their respective Departments.
1537 
(b) SPECIFICATIONS.—To carry out subsection (a), 
that Secretaries of the Army, Navy, and Air Force shall 
each document the following: 
(1) An identification of the applications, soft-
ware, and information technologies that are consid-
ered active or operational, but which are judged to 
no longer be required by the respective Department. 
(2) Information relating to the sources of fund-
ing for the applications, software, and information 
technologies identified under paragraph (1). 
(3) An identification of the senior official re-
sponsible for each application, software, and infor-
mation technology identified under paragraph (1). 
(4) A plan to discontinue use and funding for 
each item application, software, and information 
technology identified under paragraph (1). 
(c) EXEMPTION.—Any effort substantially similar to 
that described in subsection (a) that is being carried out 
by the Secretary of the Army, Navy, or Air Force as of 
the date of the enactment of this Act and completed not 
later 180 days after such date shall be treated as satis-
fying the requirement under such subsection. 
(d) REPORT.—Not later than 270 days after the date 
of the enactment of this Act, the Secretaries of the Army, 
Navy, and Air Force shall each submit to the congres-
1538 
sional defense committees the documentation required 
under subsection (b). 
SEC. 1512. UPDATE RELATING TO RESPONSIBILITIES OF 
CHIEF INFORMATION OFFICER. 
Paragraph (1) of section 142(b) of title 10, United 
States Code, is amended— 
(1) in subparagraphs (A), (B), and (C), by 
striking ‘‘(other than with respect to business man-
agement)’’ each place it appears; and 
(2) by amending subparagraph (D) to read as 
follows: 
‘‘(D) exercises authority, direction, and control 
over the Cybersecurity Directorate, or any successor 
organization, of the National Security Agency;’’. 
SEC. 1513. PROTECTIVE DOMAIN NAME SYSTEM WITHIN 
THE DEPARTMENT OF DEFENSE. 
(a) IN GENERAL.—Not later than 120 days after the 
date of the enactment of this Act, the Secretary shall en-
sure each component of the Department of Defense uses 
a Protective Domain Name System (PDNS) instantiation 
offered by the Department. 
(b) EXEMPTIONS.—The Secretary of Defense may ex-
empt a component of the Department from using a PDNS 
instantiation for any reason except for cost or technical 
application.
1539 
(c) REPORT TO CONGRESS.—Not later than 150 days 
after the date of the enactment of this Act, the Secretary 
of Defense shall submit to the congressional defense com-
mittees a report that includes information relating to— 
(1) each component of the Department that 
uses a PDNS instantiation offered by the Depart-
ment; 
(2) each component exempt from using a 
PDNS instantiation pursuant to subsection (b); and 
(3) 
efforts 
to 
ensure 
that 
the 
PDNS 
instantiation offered by the Department connect and 
share relevant and timely data. 
Subtitle C—Cyber Weapons 
SEC. 1521. NOTIFICATION REQUIREMENTS REGARDING 
CYBER WEAPONS. 
(a) IN GENERAL.—Not later than 120 days after the 
date of the enactment of this Act, the Secretary of Defense 
shall submit to the congressional defense committees a re-
port on the Department of Defense’s compliance respon-
sibilities regarding cyber capabilities. Such report shall 
also include the Department’s definition of ‘‘cyber capa-
bility’’ that includes all software, hardware, middleware, 
code, and other information technology developed using 
amounts from the Cyberspace Activities Budget of the De-
1540 
partment of Defense that may used in operations author-
ized under title 10, United States Code. 
(b) LIMITATION.—Of amounts authorized to be ap-
propriated by this Act or otherwise made available for fis-
cal year 2022 for operations and maintenance, Defense- 
Wide, for the Office of the Secretary of Defense for travel, 
not more than 75 percent of such amounts may be obli-
gated or expended until the Secretary of Defense has sub-
mitted to the congressional defense committees the report 
required under subsection (a). 
SEC. 1522. CYBERSECURITY OF WEAPON SYSTEMS. 
Section 1640 of the National Defense Authorization 
Act for Fiscal Year 2018 (Public Law 115–91; 10 U.S.C. 
2224 note), is amended— 
(1) in subsection (c)(1), by adding at the end 
the following new subparagraphs: 
‘‘(E) Nuclear Command, Control, and 
Communications (NC3). 
‘‘(F) Senior Leadership Enterprise.’’; and 
(2) by adding at the end the following new sub-
section: 
‘‘(f) BIANNUAL REPORTS.—Not later than June 30, 
2022, and every six months thereafter through 2023, the 
Secretary of Defense shall provide to the congressional de-
fense committees a report on the work of the Program,
1541 
including information relating to staffing and accomplish-
ments of during the immediately preceding six-month pe-
riod.’’. 
SEC. 1523. EXTENSION OF SUNSET FOR PILOT PROGRAM 
ON REGIONAL CYBERSECURITY TRAINING 
CENTER FOR THE ARMY NATIONAL GUARD. 
Section 1651(e) of the John S. McCain National De-
fense Authorization Act for Fiscal Year 2019 (Public Law 
115–232; 32 U.S.C. 501 note) is amended by striking 
‘‘2022’’ and inserting ‘‘2024’’. 
Subtitle D—Other Cyber Matters 
SEC. 1531. FEASIBILITY STUDY REGARDING ESTABLISH-
MENT WITHIN THE DEPARTMENT OF DE-
FENSE A DESIGNATED CENTRAL PROGRAM 
OFFICE, HEADED BY A SENIOR DEPARTMENT 
OFFICIAL, RESPONSIBLE FOR OVERSEEING 
ALL ACADEMIC ENGAGEMENT PROGRAMS 
FOCUSING ON CREATING CYBER TALENT 
ACROSS THE DEPARTMENT. 
(a) IN GENERAL.—Not later than 270 days after the 
date of the enactment of this Act, the Secretary of Defense 
shall submit to the congressional defense committees a 
feasibility study regarding the establishment within the 
Department of Defense of a designated central program 
office, headed by a senior Department official, responsible
1542 
for overseeing all academic engagement programs focusing 
on creating cyber talent across the Department. Such 
study shall examine the following: 
(1) The manner in or through which such a 
designated central program office would obligate and 
expend amounts relating to cyber education initia-
tives. 
(2) The manner in or through which such a 
designated central program office would interact 
with the consortium or consortia of universities (es-
tablished pursuant to section 1659 of the National 
Defense Authorization Act for Fiscal Year 2020 (10 
U.S.C. 391 note)) to assist the Secretary on cyberse-
curity matters. 
(3) The reasons why cyber has unique pro-
grams apart from other science, technology, engi-
neering, and math programs. 
(4) Whether the creation of the designated cen-
tral program office will have an estimated net sav-
ings for the Department. 
(b) CONSULTATION.—In conducting the feasibility 
study required under subsection (a), the Secretary of De-
fense shall consult with and solicit recommendations from 
academic institutions and stakeholders. including primary, 
secondary, and post-secondary educational institutions.
1543 
(c) DETERMINATION.— 
(1) IN GENERAL.—Upon completion of the fea-
sibility study required under subsection (a), the Sec-
retary of Defense shall make a determination re-
garding the establishment within the Department of 
Defense of a designated central program office re-
sponsible for each covered academic engagement 
program across the Department. 
(2) IMPLEMENTATION.—If the Secretary of De-
fense makes a determination under paragraph (1) in 
the affirmative, the Secretary shall establish within 
the Department of Defense a designated central pro-
gram office responsible for each covered academic 
enrichment program across the Department. Not 
later than 180 days after such a determination in 
the affirmative, the Secretary shall promulgate such 
rules and regulations as are necessary to so establish 
such an office. 
(3) NEGATIVE
DETERMINATION.—If the Sec-
retary determines not to establish a designated cen-
tral program office under subsection (a), the Sec-
retary shall submit to Congress notice of such deter-
mination together with a justification for the deter-
mination.
1544 
(d) COMPREHENSIVE REPORT.—Not later than 270 
days after the date of the enactment of this Act, the Sec-
retary of Defense shall submit to the congressional defense 
committees a comprehensive report that updates the mat-
ters required for inclusion in the reports required pursu-
ant to section 1649 of the National Defense Authorization 
Act for Fiscal Year 2020 (Public Law 116–92) and sec-
tion 1726(c) of the William M. (Mac) Thornberry National 
Defense Authorization Act for Fiscal Year 2021 (Public 
Law 116–283). 
(e) DEFINITION.—In this section, the term ‘‘covered 
academic engagement program’’ means each of the fol-
lowing: 
(1) Any primary, secondary, or post-secondary 
education program. 
(2) Any recruitment or retention program. 
(3) Any scholarship program. 
(4) Any academic partnerships. 
(5) Any general enrichment program. 
SEC. 1532. PROHIBITION ON CHIEF INFORMATION OFFICER 
OF THE DEPARTMENT OF DEFENSE SERVING 
AS PRINCIPAL CYBER ADVISOR OF THE DE-
PARTMENT. 
Section 932(c)(1) of the National Defense Authoriza-
tion Act for Fiscal Year 2014 (Public Law 113–66; 10
1545 
U.S.C. 2224 note) is amended by inserting after ‘‘civilian 
officials of the Department of Defense’’ the following: 
‘‘(other than the Chief Information Officer of the Depart-
ment)’’. 
SEC. 1533. AUTHORITY FOR NATIONAL CYBER DIRECTOR 
TO ACCEPT DETAILS ON NONREIMBURSABLE 
BASIS. 
Section 1752(e) of the William M. (Mac) Thornberry 
National Defense Authorization Act for Fiscal Year 2021 
(Public Law 116–283) is amended— 
(1) by redesignating paragraphs (1) through 
(8) as subparagraphs (A) through (H), respectively, 
and indenting such subparagraphs two ems to the 
right; 
(2) in the matter before subparagraph (A), as 
redesignated by paragraph (1), by striking ‘‘The Di-
rector may’’ and inserting the following: 
‘‘(1) IN GENERAL.—The Director may’’; 
(3) in paragraph (1)— 
(A) as redesignated by paragraph (2), by 
redesignating subparagraphs (C) through (H) 
as subparagraphs (D) through (I), respectively; 
and 
(B) by inserting after subparagraph (B) 
the following new subparagraph (C):
1546 
‘‘(C) accept officers or employees of the 
United States or members of the Armed Forces 
on a detail from an element of the intelligence 
community (as such term is defined in section 
3(4) of the National Security Act of 1947 (50 
U.S.C. 3003(4))) or from another element of 
the Federal Government on a nonreimbursable 
basis, as jointly agreed to by the heads of the 
receiving and detailing elements, for a period 
not to exceed three years;’’; and 
(4) by adding at the end the following new 
paragraph: 
‘‘(2) RULES OF CONSTRUCTION REGARDING DE-
TAILS.—Paragraph (1)(C) shall not be construed to 
impose any limitation on any other authority for re-
imbursable or nonreimbursable details. A nonreim-
bursable detail made under such paragraph shall not 
be considered an augmentation of the appropriations 
of the receiving element of the Office of the National 
Cyber Director.’’.
1547 
SEC. 1534. CYBERSENTRY PROGRAM OF THE CYBERSECU-
RITY 
AND 
INFRASTRUCTURE 
SECURITY 
AGENCY. 
(a) IN GENERAL.—Title XXII of the Homeland Se-
curity Act of 2002 (6 U.S.C. 651 et seq.) is amended by 
adding at the end the following new section: 
‘‘SEC. 2220A. CYBERSENTRY PROGRAM. 
‘‘(a) ESTABLISHMENT.—The Director shall establish 
and maintain in the Agency a program, to be known as 
‘CyberSentry’, to provide continuous monitoring and de-
tection of cybersecurity risks to critical infrastructure en-
tities that own or operate industrial control systems that 
support national critical functions, upon request and sub-
ject to the consent of such owner or operator. 
‘‘(b) 
ACTIVITIES.—The 
Director, 
through 
CyberSentry, shall— 
‘‘(1) enter into strategic partnerships with crit-
ical infrastructure owners and operators that, in the 
determination of the Director and subject to the 
availability of resources, own or operate regionally or 
nationally significant industrial control systems that 
support national critical functions, in order to pro-
vide technical assistance in the form of continuous 
monitoring of industrial control systems and the in-
formation systems that support such systems and 
detection of cybersecurity risks to such industrial
1548 
control systems and other cybersecurity services, as 
appropriate, based on and subject to the agreement 
and consent of such owner or operator; 
‘‘(2) leverage sensitive or classified intelligence 
about cybersecurity risks regarding particular sec-
tors, particular adversaries, and trends in tactics, 
techniques, and procedures to advise critical infra-
structure owners and operators regarding mitigation 
measures and share information as appropriate; 
‘‘(3) identify cybersecurity risks in the informa-
tion technology and information systems that sup-
port industrial control systems which could be ex-
ploited by adversaries attempting to gain access to 
such industrial control systems, and work with own-
ers and operators to remediate such vulnerabilities; 
‘‘(4) produce aggregated, anonymized analytic 
products, based on threat hunting and continuous 
monitoring and detection activities and partnerships, 
with findings and recommendations that can be dis-
seminated to critical infrastructure owners and oper-
ators; and 
‘‘(5) support activities authorized in accordance 
with section 1501 of the National Defense Author-
ization Act for Fiscal Year 2022.
1550 
the public or an electronic service provider to the public, 
the disclosure of which is not permitted under section 
2702 of title 18, United States Code. 
‘‘(f) DEFINITIONS.—In this section: 
‘‘(1) CYBERSECURITY RISK.—The term ‘cyber-
security risk’ has the meaning given such term in 
section 2209(a). 
‘‘(2) INDUSTRIAL CONTROL SYSTEM.—The term 
‘industrial control system’ means an information 
system used to monitor and/or control industrial 
processes such as manufacturing, product handling, 
production, and distribution, including supervisory 
control and data acquisition (SCADA) systems used 
to monitor and/or control geographically dispersed 
assets, distributed control systems (DCSs), Human- 
Machine Interfaces (HMIs), and programmable logic 
controllers that control localized processes. 
‘‘(3) INFORMATION SYSTEM.—The term ‘infor-
mation system’ has the meaning given such term in 
section 102 of the Cybersecurity Act of 2015 (en-
acted as division N of the Consolidated Appropria-
tions Act, 2016 (Public Law 114–113; 6 U.S.C. 
1501(9)).’’.
1551 
(b) RESPONSIBILITIES OF THE CISA DIRECTOR RE-
LATING TO INDUSTRIAL CONTROL SYSTEMS THAT SUP-
PORT NATIONAL CRITICAL FUNCTIONS.— 
(1) IN
GENERAL.—Subsection (c) of section 
2202 of the Homeland Security Act of 2002 (6 
U.S.C. 652) is amended— 
(A) in paragraph (11), by striking ‘‘and’’ 
after the semicolon; 
(B) in the first paragraph (12) (relating to 
appointment of a Cybersecurity State Coordi-
nator) by striking ‘‘as described in section 
2215; and’’ and inserting ‘‘as described in sec-
tion 2217;’’; 
(C) by redesignating the second paragraph 
(12) (relating to the .gov internet domain) as 
paragraph (13); 
(D) in such redesignated paragraph (13), 
by striking ‘‘and’’ after the semicolon; 
(E) by inserting after such redesignated 
paragraph (13) the following new paragraph: 
‘‘(14) maintain voluntary partnerships with 
critical infrastructure entities that own or operate 
industrial control systems that support national crit-
ical functions, which may include, upon request and 
subject to the consent of the owner or operator, pro-
1552 
viding technical assistance in the form of continuous 
monitoring and detection of cybersecurity risks (as 
such term is defined in section 2209(a)) in further-
ance of section 2220A; and’’; and 
(F) by redesignating the third paragraph 
(12) (relating to carrying out such other duties 
and responsibilities) as paragraph (15). 
(2) CONTINUOUS
MONITORING
AND
DETEC-
TION.—Section 2209(c)(6) of the Homeland Secu-
rity Act of 2002 (6 U.S.C. 659) is amended by in-
serting ‘‘, which may take the form of continuous 
monitoring and detection of cybersecurity risks to 
critical infrastructure entities that own or operate 
industrial control systems that support national crit-
ical functions’’ after ‘‘mitigation, and remediation’’. 
(c) TITLE XXII TECHNICAL AND CLERICAL AMEND-
MENTS.— 
(1) TECHNICAL AMENDMENTS.— 
(A) HOMELAND SECURITY ACT OF 2002.— 
Subtitle A of title XXII of the Homeland Secu-
rity Act of 2002 (6 U.S.C. 651 et seq.) is 
amended— 
(i) in the first section 2215 (6 U.S.C. 
665; relating to the duties and authorities 
relating to .gov internet domain), by
1553 
amending the section enumerator and 
heading to read as follows: 
‘‘SEC. 2215. DUTIES AND AUTHORITIES RELATING TO .GOV 
INTERNET DOMAIN.’’; 
(ii) in the second section 2215 (6 
U.S.C. 665b; relating to the joint cyber 
planning office), by amending the section 
enumerator and heading to read as follows: 
‘‘SEC. 2216. JOINT CYBER PLANNING OFFICE.’’; 
(iii) in the third section 2215 (6 
U.S.C. 665c; relating to the Cybersecurity 
State Coordinator), by amending the sec-
tion enumerator and heading to read as 
follows: 
‘‘SEC. 2217. CYBERSECURITY STATE COORDINATOR.’’; 
(iv) in the fourth section 2215 (6 
U.S.C. 665d; relating to Sector Risk Man-
agement Agencies), by amending the sec-
tion enumerator and heading to read as 
follows: 
‘‘SEC. 2218. SECTOR RISK MANAGEMENT AGENCIES.’’; 
(v) in section 2216 (6 U.S.C. 665e; 
relating to the Cybersecurity Advisory 
Committee), by amending the section enu-
merator and heading to read as follows:
1554 
‘‘SEC. 2219. CYBERSECURITY ADVISORY COMMITTEE.’’; and 
(vi) in section 2217 (6 U.S.C. 665f; 
relating to Cybersecurity Education and 
Training Programs), by amending the sec-
tion enumerator and heading to read as 
follows: 
‘‘SEC. 2220. CYBERSECURITY EDUCATION AND TRAINING 
PROGRAMS.’’. 
(B) CONSOLIDATED APPROPRIATIONS ACT, 
2021.—Paragraph (1) of section 904(b) of divi-
sion U of the Consolidated Appropriations Act, 
2021 (Public Law 116–260) is amended, in the 
matter preceding subparagraph (A), by insert-
ing ‘‘of 2002’’ after ‘‘Homeland Security Act’’. 
(2) CLERICAL AMENDMENT.—The table of con-
tents in section 1(b) of the Homeland Security Act 
of 2002 is amended by striking the items relating to 
sections 2214 through 2217 and inserting the fol-
lowing new items: 
‘‘Sec. 2214. National Asset Database. 
‘‘Sec. 2215. Duties and authorities relating to .gov internet domain. 
‘‘Sec. 2216. Joint cyber planning office. 
‘‘Sec. 2217. Cybersecurity State Coordinator. 
‘‘Sec. 2218. Sector Risk Management Agencies. 
‘‘Sec. 2219. Cybersecurity Advisory Committee. 
‘‘Sec. 2220. Cybersecurity Education and Training Programs. 
‘‘Sec. 2220A. CyberSentry program.’’.
1555 
SEC. 1535. CYBER INCIDENT REVIEW OFFICE. 
(a) IN GENERAL.—Subtitle A of title XXII of the 
Homeland Security Act of 2002 (6 U.S.C. 651 et seq.) 
is amended by adding at the end the following new section: 
‘‘SEC. 2220A. CYBER INCIDENT REVIEW OFFICE. 
‘‘(a) DEFINITIONS.—In this section: 
‘‘(1) CLOUD
SERVICE
PROVIDER.—The term 
‘cloud service provider’ means an entity offering 
products or services related to cloud computing, as 
defined by the National Institutes of Standards and 
Technology in NIST Special Publication 800–145 
and any amendatory or superseding document relat-
ing thereto. 
‘‘(2) COVERED ENTITY.—The term ‘covered en-
tity’ means an entity that owns or operates critical 
infrastructure that satisfies the definition estab-
lished by the Director in the reporting requirements 
and procedures issued pursuant to subsection (d). 
‘‘(3) COVERED CYBSECURITY INCIDENT.—The 
term ‘covered cybersecurity incident’ means a cyber-
security incident experienced by a covered entity 
that satisfies the definition and criteria established 
by the Director in the reporting requirements and 
procedures issued pursuant to subsection (d). 
‘‘(4) CYBER
THREAT
INDICATOR.—The term 
‘cyber threat indicator’ has the meaning given such
1556 
term in section 102 of the Cybersecurity Act of 2015 
(enacted as division N of the Consolidated Appro-
priations Act, 2016 (Public Law 114–113; 6 U.S.C. 
1501)). 
‘‘(5) CYBERSECURITY PURPOSE.—The term ‘cy-
bersecurity purpose’ has the meaning given such 
term in section 102 of the Cybersecurity Act of 2015 
(enacted as division N of the Consolidated Appro-
priations Act, 2016 (Public Law 114-113; 6 U.S.C. 
1501). 
‘‘(6) CYBERSECURITY THREAT.—The term ‘cy-
bersecurity threat’ has the meaning given such term 
in section 102 of the Cybersecurity Act of 2015 (en-
acted as division N of the Consolidated Appropria-
tions Act, 2016 (Public Law 114–113; 6 U.S.C. 
1501)). 
‘‘(7) DEFENSIVE MEASURE.—The term ‘defen-
sive measure’ has the meaning given such term in 
section 102 of the Cybersecurity Act of 2015 (en-
acted as division N of the Consolidated Appropria-
tions Act, 2016 (Public Law 114–113; 6 U.S.C. 
1501)). 
‘‘(8) INFORMATION SHARING AND ANALYSIS OR-
GANIZATION.—The term ‘Information Sharing and
1558 
‘‘(13) SECURITY
VULNERABILITY.—The term 
‘security vulnerability’ has the meaning given such 
term in section 102 of the Cybersecurity Act of 2015 
(enacted as division N of the Consolidated Appro-
priations Act, 2016 (Public Law 114–113; 6 U.S.C. 
1501)). 
‘‘(14) SIGNIFICANT
CYBER
INCIDENT.—The 
term ‘significant cyber incident’ means a cyber inci-
dent, or a group of related cyber incidents, that the 
Director determines is likely to result in demon-
strable harm to the national security interests, for-
eign relations, or economy of the United States or 
to the public confidence, civil liberties, or public 
health and safety of the American people. 
‘‘(15) SUPPLY CHAIN ATTACK.—The term ‘sup-
ply chain attack’ means an attack that allows an ad-
versary to utilize implants or other vulnerabilities in-
serted into information technology hardware, soft-
ware, operating systems, peripherals (such as infor-
mation technology products), or services at any point 
during the life cycle in order to infiltrate the net-
works of third parties where such products, services, 
or technologies are deployed. 
‘‘(b) CYBER INCIDENT REVIEW OFFICE.—There is 
established in the Agency a Cyber Incident Review Office
1559 
(in this section referred to as the ‘Office’) to receive, ag-
gregate, and analyze reports related to covered cybersecu-
rity incidents submitted by covered entities in furtherance 
of the activities specified in subsection (c) of this section 
and sections 2202(e), 2209(c), and 2203 to enhance the 
situational awareness of cybersecurity threats across crit-
ical infrastructure sectors. 
‘‘(c) ACTIVITIES.—The Office shall, in furtherance of 
the activities specified in sections 2202(e), 2209(c), and 
2203— 
‘‘(1) receive, aggregate, analyze, and secure re-
ports from covered entities related to a covered cy-
bersecurity incident to assess the effectiveness of se-
curity controls and identify tactics, techniques, and 
procedures adversaries use to overcome such con-
trols; 
‘‘(2) facilitate the timely sharing between rel-
evant critical infrastructure owners and operators 
and, as appropriate, the intelligence community of 
information relating to covered cybersecurity inci-
dents, particularly with respect to an ongoing cyber-
security threat or security vulnerability; 
‘‘(3) for a covered cybersecurity incident that 
also satisfies the definition of a significant cyber in-
cident, or are part of a group of related cyber inci-
1560 
dents that together satisfy such definition, conduct 
a review of the details surrounding such covered cy-
bersecurity incident or group of such incidents and 
identify ways to prevent or mitigate similar incidents 
in the future; 
‘‘(4) with respect to covered cybersecurity inci-
dent reports under subsection (d) involving an ongo-
ing cybersecurity threat or security vulnerability, im-
mediately review such reports for cyber threat indi-
cators that can be anonymized and disseminated, 
with defensive measures, to appropriate stake-
holders, in coordination with other Divisions within 
the Agency, as appropriate; 
‘‘(5) publish quarterly unclassified, public re-
ports that describe aggregated, anonymized observa-
tions, findings, and recommendations based on cov-
ered cybersecurity incident reports under subsection 
(d); 
‘‘(6) leverage information gathered regarding 
cybersecurity incidents to enhance the quality and 
effectiveness of bi-directional information sharing 
and coordination efforts with appropriate stake-
holders, including sector coordinating councils, infor-
mation sharing and analysis organizations, tech-
nology providers, cybersecurity and incident response
1561 
firms, and security researchers, including by estab-
lishing mechanisms to receive feedback from such 
stakeholders regarding how the Agency can most ef-
fectively support private sector cybersecurity; and 
‘‘(7) proactively identify opportunities, in ac-
cordance with the protections specified in sub-
sections (e) and (f), to leverage and utilize data on 
cybersecurity incidents in a manner that enables and 
strengthens cybersecurity research carried out by 
academic institutions and other private sector orga-
nizations, to the greatest extent practicable. 
‘‘(d) COVERED CYBERSECURITY INCIDENT REPORT-
ING REQUIREMENTS AND PROCEDURES.— 
‘‘(1) IN GENERAL.—Not later than 270 days 
after the date of the enactment of this section, the 
Director, in consultation with Sector Risk Manage-
ment Agencies and the heads of other Federal de-
partments and agencies, as appropriate, shall, after 
a 60 day consultative period, followed by a 90 day 
comment period with appropriate stakeholders, in-
cluding sector coordinating councils, publish in the 
Federal Register an interim final rule implementing 
this section. Notwithstanding section 553 of title 5, 
United States Code, such rule shall be effective, on 
an interim basis, immediately upon publication, but
1562 
may be subject to change and revision after public 
notice and opportunity for comment. The Director 
shall issue a final rule not later than one year after 
publication of such interim final rule. Such interim 
final rule shall— 
‘‘(A) require covered entities to submit to 
the Office reports containing information relat-
ing to covered cybersecurity incidents; and 
‘‘(B) establish procedures that clearly de-
scribe— 
‘‘(i) the types of critical infrastructure 
entities determined to be covered entities; 
‘‘(ii) the types of cybersecurity inci-
dents determined to be covered cybersecu-
rity incidents; 
‘‘(iii) the mechanisms by which cov-
ered cybersecurity incident reports under 
subparagraph (A) are to be submitted, in-
cluding— 
‘‘(I) the contents, described in 
paragraph (4), to be included in each 
such report, including any supple-
mental reporting requirements;
1563 
‘‘(II) the timing relating to when 
each such report should be submitted; 
and 
‘‘(III) the format of each such re-
port; 
‘‘(iv) describe the manner in which 
the Office will carry out enforcement ac-
tions under subsection (g), including with 
respect to the issuance of subpoenas, con-
ducting examinations, and other aspects 
relating to noncompliance; and 
‘‘(v) any other responsibilities to be 
carried out by covered entities, or other 
procedures necessary to implement this 
section. 
‘‘(2) 
COVERED
ENTITIES.—In 
determining 
which types of critical infrastructure entities are cov-
ered entities for purposes of this section, the Sec-
retary, acting through the Director, in consultation 
with Sector Risk Management Agencies and the 
heads of other Federal departments and agencies, as 
appropriate, shall consider— 
‘‘(A) the consequences that disruption to 
or compromise of such an entity could cause to
1564 
national security, economic security, or public 
health and safety; 
‘‘(B) the likelihood that such an entity 
may be targeted by a malicious cyber actor, in-
cluding a foreign country; 
‘‘(C) the extent to which damage, disrup-
tion, or unauthorized access to such and entity 
will disrupt the reliable operation of other crit-
ical infrastructure assets; and 
‘‘(D) the extent to which an entity or sec-
tor is subject to existing regulatory require-
ments to report cybersecurity incidents, and the 
possibility of coordination and sharing of re-
ports between the Office and the regulatory au-
thority to which such entity submits such other 
reports. 
‘‘(3) OUTREACH TO COVERED ENTITIES.— 
‘‘(A) IN
GENERAL.—The Director shall 
conduct an outreach and education campaign to 
inform covered entities of the requirements of 
this section. 
‘‘(B) ELEMENTS.—The outreach and edu-
cation campaign under subparagraph (A) shall 
include the following:
1565 
‘‘(i) Overview of the interim final rule 
and final rule issued pursuant to this sec-
tion. 
‘‘(ii) Overview of reporting require-
ments and procedures issued pursuant to 
paragraph (1). 
‘‘(iii) Overview of mechanisms to sub-
mit to the Office covered cybersecurity in-
cident reports and information relating to 
the disclosure, retention, and use of inci-
dent reports under this section. 
‘‘(iv) Overview of the protections af-
forded to covered entities for complying 
with requirements under subsection (f). 
‘‘(v) Overview of the steps taken 
under subsection (g) when a covered entity 
is not in compliance with the reporting re-
quirements under paragraph (1). 
‘‘(C) COORDINATION.—The Director may 
conduct the outreach and education campaign 
under subparagraph (A) through coordination 
with the following: 
‘‘(i) The Critical Infrastructure Part-
nership Advisory Council established pur-
suant to section 871.
1566 
‘‘(ii) Information Sharing and Anal-
ysis Organizations. 
‘‘(iii) Any other means the Director 
determines to be effective to conduct such 
campaign. 
‘‘(4) COVERED CYBERSECURITY INCIDENTS.— 
‘‘(A) 
CONSIDERATIONS.—In 
accordance 
with subparagraph (B), in determining which 
types of incidents are covered cybersecurity in-
cidents for purposes of this section, the Direc-
tor shall consider— 
‘‘(i) the sophistication or novelty of 
the tactics used to perpetrate such an inci-
dent, as well as the type, volume, and sen-
sitivity of the data at issue; 
‘‘(ii) the number of individuals di-
rectly or indirectly affected or potentially 
affected by such an incident; and 
‘‘(iii) potential impacts on industrial 
control systems, such as supervisory con-
trol and data acquisition systems, distrib-
uted control systems, and programmable 
logic controllers. 
‘‘(B) MINIMUM THRESHOLDS.—For a cy-
bersecurity incident to be considered a covered
1567 
cybersecurity incident a cybersecurity incident 
shall, at a minimum, include at least one of the 
following: 
‘‘(i) Unauthorized access to an infor-
mation system or network that leads to 
loss of confidentiality, integrity, or avail-
ability of such information system or net-
work, or has a serious impact on the safety 
and resiliency of operational systems and 
processes. 
‘‘(ii) Disruption of business or indus-
trial operations due to a denial of service 
attack, a ransomware attack, or exploi-
tation 
of 
a 
zero-day 
vulnerability, 
against— 
‘‘(I) an information system or 
network; or 
‘‘(II) an operational technology 
system or process. 
‘‘(iii) Unauthorized access or disrup-
tion of business or industrial operations 
due to loss of service facilitated through, 
or caused by a compromise of, a cloud 
service provider, managed service provider,
1568 
other third-party data hosting provider, or 
supply chain attack. 
‘‘(5) REPORTS.— 
‘‘(A) TIMING.— 
‘‘(i) IN GENERAL.—The Director, in 
consultation with Sector Risk Management 
Agencies and the heads of other Federal 
departments and agencies, as appropriate, 
shall establish reporting timelines for cov-
ered entities to submit promptly to the Of-
fice covered cybersecurity incident reports, 
as the Director determines reasonable and 
appropriate based on relevant factors, such 
as the nature, severity, and complexity of 
the covered cybersecurity incident at issue 
and the time required for investigation, but 
in no case may the Director require report-
ing by a covered entity earlier than 72 
hours after confirmation that a covered cy-
bersecurity incident has occurred. 
‘‘(ii) 
CONSIDERATIONS.—In 
deter-
mining reporting timelines under clause 
(i), the Director shall— 
‘‘(I) consider any existing regu-
latory reporting requirements, similar
1569 
in scope purpose, and timing to the 
reporting requirements under this sec-
tion, to which a covered entity may 
also be subject, and make efforts to 
harmonize the timing and contents of 
any such reports to the maximum ex-
tent practicable; and 
‘‘(II) balance the Agency’s need 
for situational awareness with a cov-
ered entity’s ability to conduct inci-
dent response and investigations. 
‘‘(B) THIRD PARTY REPORTING.— 
‘‘(i) IN GENERAL.—A covered entity 
may submit a covered cybersecurity inci-
dent report through a third party entity or 
Information Sharing and Analysis Organi-
zation. 
‘‘(ii) DUTY
TO
ENSURE
COMPLI-
ANCE.—Third party reporting under this 
subparagraph does not relieve a covered 
entity of the duty to ensure compliance 
with the requirements of this paragraph. 
‘‘(C) SUPPLEMENTAL REPORTING.—A cov-
ered entity shall submit promptly to the Office, 
until such date that such covered entity notifies
1570 
the Office that the cybersecurity incident inves-
tigation at issue has concluded and the associ-
ated covered cybersecurity incident has been 
fully mitigated and resolved, periodic updates or 
supplements to a previously submitted covered 
cybersecurity incident report if new or different 
information becomes available that would other-
wise have been required to have been included 
in such previously submitted report. In deter-
mining reporting timelines, the Director may 
choose to establish a flexible, phased reporting 
timeline for covered entities to report informa-
tion in a manner that aligns with investigative 
timelines 
and 
allows 
covered 
entities 
to 
prioritize incident response efforts over compli-
ance. 
‘‘(D) CONTENTS.—Covered cybersecurity 
incident reports submitted pursuant to this sec-
tion shall contain such information as the Di-
rector prescribes, including the following infor-
mation, to the extent applicable and available, 
with respect to a covered cybersecurity incident: 
‘‘(i) A description of the covered cy-
bersecurity incident, including identifica-
tion of the affected information systems,
1571 
networks, or devices that were, or are rea-
sonably believed to have been, affected by 
such incident, and the estimated date 
range of such incident. 
‘‘(ii) Where applicable, a description 
of the vulnerabilities exploited and the se-
curity defenses that were in place, as well 
as the tactics, techniques, and procedures 
relevant to such incident. 
‘‘(iii) Where applicable, any identi-
fying information related to the actor rea-
sonably believed to be responsible for such 
incident. 
‘‘(iv) Where applicable, identification 
of the category or categories of information 
that was, or is reasonably believed to have 
been, accessed or acquired by an unauthor-
ized person. 
‘‘(v) Contact information, such as 
telephone number or electronic mail ad-
dress, that the Office may use to contact 
the covered entity or, where applicable, an 
authorized agent of such covered entity, or, 
where applicable, the service provider, act-
ing with the express permission, and at the
1572 
direction, of such covered entity, to assist 
with compliance with the requirements of 
this section. 
‘‘(6) RESPONSIBILITIES
OF
COVERED
ENTI-
TIES.—Covered entities that experience a covered cy-
bersecurity incident shall coordinate with the Office 
to the extent necessary to comply with this section, 
and, to the extent practicable, cooperate with the Of-
fice in a manner that supports enhancing the Agen-
cy’s situational awareness of cybersecurity threats 
across critical infrastructure sectors. 
‘‘(7) 
HARMONIZING
REPORTING
REQUIRE-
MENTS.—In establishing the reporting requirements 
and procedures under paragraph (1), the Director 
shall, to the maximum extent practicable— 
‘‘(A) review existing regulatory require-
ments, including the information required in 
such reports, to report cybersecurity incidents 
that may apply to covered entities, and ensure 
that any such reporting requirements and pro-
cedures avoid conflicting, duplicative, or bur-
densome requirements; and 
‘‘(B) coordinate with other regulatory au-
thorities that receive reports relating to cyberse-
curity incidents to identify opportunities to
1573 
streamline reporting processes, and where fea-
sible, enter into agreements with such authori-
ties to permit the sharing of such reports with 
the Office, consistent with applicable law and 
policy, without impacting the Office’s ability to 
gain timely situational awareness of a covered 
cybersecurity incident or significant cyber inci-
dent. 
‘‘(e) DISCLOSURE, RETENTION, AND USE OF INCI-
DENT REPORTS.— 
‘‘(1) AUTHORIZED
ACTIVITIES.—No informa-
tion provided to the Office in accordance with sub-
sections (d) or (h) may be disclosed to, retained by, 
or used by any Federal department or agency, or 
any component, officer, employee, or agent of the 
Federal Government, except if the Director deter-
mines such disclosure, retention, or use is necessary 
for— 
‘‘(A) a cybersecurity purpose; 
‘‘(B) the purpose of identifying— 
‘‘(i) a cybersecurity threat, including 
the source of such threat; or 
‘‘(ii) a security vulnerability;
1574 
‘‘(C) the purpose of responding to, or oth-
erwise preventing, or mitigating a specific 
threat of— 
‘‘(i) death; 
‘‘(ii) serious bodily harm; or 
‘‘(iii) serious economic harm, includ-
ing a terrorist act or a use of a weapon of 
mass destruction; 
‘‘(D) the purpose of responding to, inves-
tigating, prosecuting, or otherwise preventing or 
mitigating a serious threat to a minor, includ-
ing sexual exploitation or threats to physical 
safety; or 
‘‘(E) the purpose of preventing, inves-
tigating, disrupting, or prosecuting an offense 
related to a threat— 
‘‘(i) described in subparagraphs (B) 
through (D); or 
‘‘(ii) 
specified 
in 
section 
105(d)(5)(A)(v) of the Cybersecurity Act 
of 2015 (enacted as division N of the Con-
solidated Appropriations Act, 2016 (Public 
Law 
114–113; 
U.S.C. 
1504(d)(5)(A)(v))). 
‘‘(2) EXCEPTIONS.—
1575 
‘‘(A) RAPID, 
CONFIDENTIAL, 
BI-DIREC-
TIONAL SHARING OF CYBER THREAT INDICA-
TORS.—Upon receiving a covered cybersecurity 
incident report submitted pursuant to this sec-
tion, the Office shall immediately review such 
report to determine whether the incident that is 
the subject of such report is connected to an 
ongoing cybersecurity threat or security vulner-
ability and where applicable, use such report to 
identify, develop, and rapidly disseminate to ap-
propriate stakeholders actionable, anonymized 
cyber threat indicators and defensive measures. 
‘‘(B) PRINCIPLES FOR SHARING SECURITY 
VULNERABILITIES.—With respect to informa-
tion in a covered cybersecurity incident report 
regarding a security vulnerability referred to in 
paragraph (1)(B)(ii), the Director shall develop 
principles that govern the timing and manner in 
which 
information 
relating 
to 
security 
vulnerabilities may be shared, consistent with 
common industry best practices and United 
States and international standards. 
‘‘(3) PRIVACY AND CIVIL LIBERTIES.—Informa-
tion contained in reports submitted to the Office 
pursuant to subsections (d) and (h) shall be re-
1576 
tained, used, and disseminated, where permissible 
and appropriate, by the Federal Government in a 
manner consistent with processes for the protection 
of personal information adopted pursuant to section 
105 of the Cybersecurity Act of 2015 (enacted as di-
vision N of the Consolidated Appropriations Act, 
2016 (Public Law 114–113; 6 U.S.C. 1504)). 
‘‘(4) PROHIBITION ON USE OF INFORMATION IN 
REGULATORY ACTIONS.— 
‘‘(A) IN GENERAL.—Information contained 
in reports submitted to the Office pursuant to 
subsections (d) and (h) may not be used by any 
Federal, State, Tribal, or local government to 
regulate, including through an enforcement ac-
tion, the lawful activities of any non-Federal en-
tity. 
‘‘(B) EXCEPTION.—A report submitted to 
the Agency pursuant to subsection (d) or (h) 
may, consistent with Federal or State regu-
latory authority specifically relating to the pre-
vention and mitigation of cybersecurity threats 
to information systems, inform the development 
or implementation of regulations relating to 
such systems.
1577 
‘‘(f) PROTECTIONS FOR REPORTING ENTITIES AND 
INFORMATION.—Reports describing covered cybersecurity 
incidents submitted to the Office by covered entities in ac-
cordance with subsection (d), as well as voluntarily-sub-
mitted cybersecurity incident reports submitted to the Of-
fice pursuant to subsection (h), shall be— 
‘‘(1) entitled to the protections against liability 
described in section 106 of the Cybersecurity Act of 
2015 (enacted as division N of the Consolidated Ap-
propriations Act, 2016 (Public Law 114–113; 6 
U.S.C. 1505)); 
‘‘(2) exempt from disclosure under section 552 
of title 5, United States Code, as well as any provi-
sion of State, Tribal, or local freedom of information 
law, open government law, open meetings law, open 
records law, sunshine law, or similar law requiring 
disclosure of information or records; and 
‘‘(3) considered the commercial, financial, and 
proprietary information of the covered entity when 
so designated by the covered entity. 
‘‘(g) NONCOMPLIANCE WITH REQUIRED REPORT-
ING.— 
‘‘(1) PURPOSE.—In the event a covered entity 
experiences a cybersecurity incident but does not 
comply with the reporting requirements under this
1578 
section, the Director may obtain information about 
such incident by engaging directly such covered enti-
ty in accordance with paragraph (2) to request in-
formation about such incident, or, if the Director is 
unable to obtain such information through such en-
gagement, by issuing a subpoena to such covered en-
tity, subject to paragraph (3), to gather information 
sufficient to determine whether such incident is a 
covered cybersecurity incident, and if so, whether ad-
ditional action is warranted pursuant to paragraph 
(4). 
‘‘(2) INITIAL REQUEST FOR INFORMATION.— 
‘‘(A) IN
GENERAL.—If the Director has 
reason to believe, whether through public re-
porting, intelligence gathering, or other infor-
mation in the Federal Government’s possession, 
that a covered entity has experienced a cyberse-
curity incident that may be a covered cyberse-
curity incident but did not submit pursuant to 
subsection (d) to the Office a covered cyberse-
curity incident report relating thereto, the Di-
rector may request information from such cov-
ered entity to confirm whether the cybersecurity 
incident at issue is a covered cybersecurity inci-
dent, and determine whether further examina-
1579 
tion into the details surrounding such incident 
are warranted pursuant to paragraph (4). 
‘‘(B) TREATMENT.—Information provided 
to the Office in response to a request under 
subparagraph (A) shall be treated as if such in-
formation was submitted pursuant to the re-
porting procedures established in accordance 
with subsection (d). 
‘‘(3) AUTHORITY TO ISSUE SUBPOENAS.— 
‘‘(A) IN GENERAL.—If, after the date that 
is seven days from the date on which the Direc-
tor made a request for information in para-
graph (2), the Director has received no re-
sponse from the entity from which such infor-
mation was requested, or received an inad-
equate response, the Director may issue to such 
entity a subpoena to compel disclosure of infor-
mation the Director considers necessary to de-
termine whether a covered cybersecurity inci-
dent has occurred and assess potential impacts 
to national security, economic security, or pub-
lic health and safety, determine whether further 
examination into the details surrounding such 
incident are warranted pursuant to paragraph 
(4), and if so, compel disclosure of such infor-
1580 
mation as is necessary to carry out activities 
described in subsection (c). 
‘‘(B) CIVIL ACTION.—If a covered entity 
does not comply with a subpoena, the Director 
may bring a civil action in a district court of 
the United States to enforce such subpoena. An 
action under this paragraph may be brought in 
the judicial district in which the entity against 
which the action is brought resides, is found, or 
does business. The court may punish a failure 
to obey an order of the court to comply with the 
subpoena as a contempt of court. 
‘‘(C) NON-APPLICABILITY
OF
PROTEC-
TIONS.—The protections described in subsection 
(f) do not apply to a covered entity that is the 
recipient of a subpoena under this paragraph 
(3). 
‘‘(4) ADDITIONAL ACTIONS.— 
‘‘(A) EXAMINATION.—If, based on the in-
formation provided in response to a subpoena 
issued pursuant to paragraph (3), the Director 
determines that the cybersecurity incident at 
issue is a significant cyber incident, or is part 
of a group of related cybersecurity incidents 
that together satisfy the definition of a signifi-
1581 
cant cyber incident, and a more thorough exam-
ination of the details surrounding such incident 
is warranted in order to carry out activities de-
scribed in subsection (c), the Director may di-
rect the Office to conduct an examination of 
such incident in order to enhance the Agency’s 
situational awareness of cybersecurity threats 
across critical infrastructure sectors, in a man-
ner consistent with privacy and civil liberties 
protections under applicable law. 
‘‘(B) PROVISION
OF
CERTAIN
INFORMA-
TION
TO
ATTORNEY
GENERAL.—Notwith-
standing subsection (e)(4) and paragraph 
(2)(B), if the Director determines, based on the 
information provided in response to a subpoena 
issued pursuant to paragraph (3) or identified 
in the course of an examination under subpara-
graph (A), that the facts relating to the cyber-
security incident at issue may constitute 
grounds for a regulatory enforcement action or 
criminal prosecution, the Director may provide 
such information to the Attorney General or the 
appropriate regulator, who may use such infor-
mation for a regulatory enforcement action or 
criminal prosecution.
1582 
‘‘(h) VOLUNTARY
REPORTING
OF
CYBER
INCI-
DENTS.—The Agency shall receive cybersecurity incident 
reports submitted voluntarily by entities that are not cov-
ered entities, or concerning cybersecurity incidents that do 
not satisfy the definition of covered cybersecurity incidents 
but may nevertheless enhance the Agency’s situational 
awareness of cybersecurity threats across critical infra-
structure sectors. The protections under this section appli-
cable to covered cybersecurity incident reports shall apply 
in the same manner and to the same extent to voluntarily- 
submitted cybersecurity incident reports under this sub-
section. 
‘‘(i) NOTIFICATION TO IMPACTED COVERED ENTI-
TIES.—If the Director receives information regarding a 
cybersecurity incident impacting a Federal agency relating 
to unauthorized access to data provided to such Federal 
agency by a covered entity, and with respect to which such 
incident is likely to undermine the security of such covered 
entity or cause operational or reputational damage to such 
covered entity, the Director shall, to the extent prac-
ticable, notify such covered entity and provide to such cov-
ered entity such information regarding such incident as 
is necessary to enable such covered entity to address any 
such security risk or operational or reputational damage 
arising from such incident.
1583 
‘‘(j) EXEMPTION.—Subchapter I of chapter 35 of 
title 44, United States Code, does not apply to any action 
to carry out this section. 
‘‘(k) SAVING PROVISION.—Nothing in this section 
may be construed as modifying, superseding, or otherwise 
affecting in any manner any regulatory authority held by 
a Federal department or agency, including Sector Risk 
Management Agencies, existing on the day before the date 
of the enactment of this section, or any existing regulatory 
requirements or obligations that apply to covered enti-
ties.’’. 
(b) REPORTS.— 
(1) ON
STAKEHOLDER
ENGAGEMENT.—Not 
later than 30 days before the date on which that the 
Director of the Cybersecurity and Infrastructure Se-
curity Agency of the Department of Homeland Secu-
rity intends to issue an interim final rule under sub-
section (d)(1) of section 2220A of the Homeland Se-
curity Act of 2002 (as added by subsection (a)), the 
Director shall submit to the Committee on Home-
land Security of the House of Representatives and 
the Committee on Homeland Security and Govern-
mental Affairs of the Senate a report that describes 
how the Director engaged stakeholders in the devel-
opment of such interim final rules.
1584 
(2) ON OPPORTUNITIES TO STRENGTHEN CY-
BERSECURITY RESEARCH.—Not later than one year 
after the date of the enactment of this Act, the Di-
rector of the Cybersecurity and Infrastructure Secu-
rity Agency of the Department of Homeland Secu-
rity shall submit to the Committee on Homeland Se-
curity of the House of Representatives and the Com-
mittee on Homeland Security and Governmental Af-
fairs of the Senate a report describing how the 
Cyber Incident Review Office of the Department of 
Homeland Security (established pursuant to section 
2220A of the Homeland Security Act of 2002, as 
added by subsection (a)) has carried out activities 
under subsection (c)(6) of such section 2220A by 
proactively identifying opportunities to use cyberse-
curity incident data to inform and enable cybersecu-
rity research carried out by academic institutions 
and other private sector organizations. 
(c) TITLE XXII TECHNICAL AND CLERICAL AMEND-
MENTS.— 
(1) TECHNICAL AMENDMENTS.— 
(A) HOMELAND SECURITY ACT OF 2002.— 
Subtitle A of title XXII of the Homeland Secu-
rity Act of 2002 (6 U.S.C. 651 et seq.) is 
amended—
1585 
(i) in section 2202 (6 U.S.C. 652)— 
(I) in paragraph (11), by striking 
‘‘and’’ after the semicolon; 
(II) in the first paragraph (12) 
(relating to appointment of a Cyberse-
curity State Coordinator) by striking 
‘‘as described in section 2215; and’’ 
and inserting ‘‘as described in section 
2217;’’; 
(III) by redesignating the second 
paragraph (12) (relating to the .gov 
internet domain) as paragraph (13); 
and 
(IV) by redesignating the third 
paragraph (12) (relating to carrying 
out such other duties and responsibil-
ities) as paragraph (14); 
(ii) in the first section 2215 (6 U.S.C. 
665; relating to the duties and authorities 
relating to .gov internet domain), by 
amending the section enumerator and 
heading to read as follows:
1586 
‘‘SEC. 2215. DUTIES AND AUTHORITIES RELATING TO .GOV 
INTERNET DOMAIN.’’; 
(iii) in the second section 2215 (6 
U.S.C. 665b; relating to the joint cyber 
planning office), by amending the section 
enumerator and heading to read as follows: 
‘‘SEC. 2216. JOINT CYBER PLANNING OFFICE.’’; 
(iv) in the third section 2215 (6 
U.S.C. 665c; relating to the Cybersecurity 
State Coordinator), by amending the sec-
tion enumerator and heading to read as 
follows: 
‘‘SEC. 2217. CYBERSECURITY STATE COORDINATOR.’’; 
(v) in the fourth section 2215 (6 
U.S.C. 665d; relating to Sector Risk Man-
agement Agencies), by amending the sec-
tion enumerator and heading to read as 
follows: 
‘‘SEC. 2218. SECTOR RISK MANAGEMENT AGENCIES.’’; 
(vi) in section 2216 (6 U.S.C. 665e; 
relating to the Cybersecurity Advisory 
Committee), by amending the section enu-
merator and heading to read as follows: 
‘‘SEC. 2219. CYBERSECURITY ADVISORY COMMITTEE.’’; and 
(vii) in section 2217 (6 U.S.C. 665f; 
relating to Cybersecurity Education and
1587 
Training Programs), by amending the sec-
tion enumerator and heading to read as 
follows: 
‘‘SEC. 2220. CYBERSECURITY EDUCATION AND TRAINING 
PROGRAMS.’’. 
(B) CONSOLIDATED APPROPRIATIONS ACT, 
2021.—Paragraph (1) of section 904(b) of divi-
sion U of the Consolidated Appropriations Act, 
2021 (Public Law 116–260) is amended, in the 
matter preceding subparagraph (A), by insert-
ing ‘‘of 2002’’ after ‘‘Homeland Security Act’’. 
(2) CLERICAL AMENDMENT.—The table of con-
tents in section 1(b) of the Homeland Security Act 
of 2002 is amended by striking the items relating to 
sections 2214 through 2217 and inserting the fol-
lowing new items: 
‘‘Sec. 2214. National Asset Database. 
‘‘Sec. 2215. Duties and authorities relating to .gov internet domain. 
‘‘Sec. 2216. Joint cyber planning office. 
‘‘Sec. 2217. Cybersecurity State Coordinator. 
‘‘Sec. 2218. Sector Risk Management Agencies. 
‘‘Sec. 2219. Cybersecurity Advisory Committee. 
‘‘Sec. 2220. Cybersecurity Education and Training Programs. 
‘‘Sec. 2220A. Cyber Incident Review Office.’’. 
SEC. 1536. CISA DIRECTOR APPOINTMENT AND TERM. 
Subsection (b) of section 2202 of the Homeland Se-
curity Act of 2002 (6 U.S.C. 652) is amended— 
(1) in paragraph (1), by adding at the end the 
following new sentence: ‘‘The Director shall be ap-
1588 
pointed by the President, by and with the advice and 
consent of the Senate.’’; 
(2) by redesignating paragraphs (2) and (3) as 
paragraphs (3) and (4), respectively; and 
(3) by inserting after paragraph (1) the fol-
lowing new paragraph: 
‘‘(2) TERM.—Effective with respect to an indi-
vidual appointed pursuant to paragraph (1) after the 
date of the enactment of this paragraph, the term 
of office of such an individual so appointed shall be 
five years. The term of office of the individual serv-
ing as the Director on the day before the date of the 
enactment of this paragraph shall be five years be-
ginning from the date on which such Director began 
serving.’’. 
SEC. 1537. UNITED STATES-ISRAEL CYBERSECURITY CO-
OPERATION. 
(a) GRANT PROGRAM.— 
(1) ESTABLISHMENT.—The Secretary, in ac-
cordance with the agreement entitled the ‘‘Agree-
ment between the Government of the United States 
of America and the Government of the State of 
Israel on Cooperation in Science and Technology for 
Homeland Security Matters’’, dated May 29, 2008 
(or successor agreement), and the requirements
1589 
specified in paragraph (2), shall establish a grant 
program at the Department to support— 
(A) cybersecurity research and develop-
ment; and 
(B) demonstration and commercialization 
of cybersecurity technology. 
(2) REQUIREMENTS.— 
(A) APPLICABILITY.—Notwithstanding any 
other provision of law, in carrying out a re-
search, development, demonstration, or com-
mercial application program or activity that is 
authorized under this section, the Secretary 
shall require cost sharing in accordance with 
this paragraph. 
(B) RESEARCH AND DEVELOPMENT.— 
(i) IN GENERAL.—Except as provided 
in clause (ii), the Secretary shall require 
not less than 50 percent of the cost of a 
research, development, demonstration, or 
commercial application program or activity 
described in subparagraph (A) to be pro-
vided by a non-Federal source. 
(ii) REDUCTION.—The Secretary may 
reduce or eliminate, on a case-by-case 
basis, the percentage requirement specified
1590 
in clause (i) if the Secretary determines 
that such reduction or elimination is nec-
essary and appropriate. 
(C) MERIT REVIEW.—In carrying out a re-
search, development, demonstration, or com-
mercial application program or activity that is 
authorized under this section, awards shall be 
made only after an impartial review of the sci-
entific and technical merit of the proposals for 
such awards has been carried out by or for the 
Department. 
(D) REVIEW PROCESSES.—In carrying out 
a review under subparagraph (C), the Secretary 
may use merit review processes developed under 
section 302(14) of the Homeland Security Act 
of 2002 (6 U.S.C. 182(14)). 
(3) ELIGIBLE APPLICANTS.—An applicant shall 
be eligible to receive a grant under this subsection 
if the project of such applicant— 
(A) addresses a requirement in the area of 
cybersecurity research or cybersecurity tech-
nology, as determined by the Secretary; and 
(B) is a joint venture between— 
(i)(I) a for-profit business entity, aca-
demic institution, National Laboratory (as
1591 
such term is defined in section 2 of the 
Energy Policy Act of 2005 (42 U.S.C. 
15801)), or nonprofit entity in the United 
States; and 
(II) a for-profit business entity, aca-
demic institution, or nonprofit entity in 
Israel; or 
(ii)(I) the Federal Government; and 
(II) the Government of Israel. 
(4) APPLICATIONS.—To be eligible to receive a 
grant under this subsection, an applicant shall sub-
mit to the Secretary an application for such grant 
in accordance with procedures established by the 
Secretary, in consultation with the advisory board 
established under paragraph (5). 
(5) ADVISORY BOARD.— 
(A) 
ESTABLISHMENT.—The 
Secretary 
shall establish an advisory board to— 
(i) monitor the method by which 
grants are awarded under this subsection; 
and 
(ii) provide to the Secretary periodic 
performance reviews of actions taken to 
carry out this subsection.
1592 
(B) COMPOSITION.—The advisory board 
established under subparagraph (A) shall be 
composed of three members, to be appointed by 
the Secretary, of whom— 
(i) one shall be a representative of the 
Federal Government; 
(ii) one shall be selected from a list of 
nominees provided by the United States- 
Israel Binational Science Foundation; and 
(iii) one shall be selected from a list 
of nominees provided by the United States- 
Israel Binational Industrial Research and 
Development Foundation. 
(6) CONTRIBUTED
FUNDS.—Notwithstanding 
any other provision of law, the Secretary may accept 
or retain funds contributed by any person, govern-
ment entity, or organization for purposes of carrying 
out this subsection. Such funds shall be available, 
subject to appropriation, without fiscal year limita-
tion. 
(7) REPORT.—Not later than 180 days after 
the date of completion of a project for which a grant 
is provided under this subsection, the grant recipient 
shall submit to the Secretary a report that con-
tains—
1593 
(A) a description of how the grant funds 
were used by the recipient; and 
(B) an evaluation of the level of success of 
each project funded by the grant. 
(8) CLASSIFICATION.—Grants shall be awarded 
under this subsection only for projects that are con-
sidered to be unclassified by both the United States 
and Israel. 
(b) AUTHORIZATION OF APPROPRIATIONS.—There is 
authorized to be appropriated to carry out this section not 
less than $6,000,000 for each of fiscal years 2022 through 
2026. 
(c) DEFINITIONS.—In this section— 
(1) the term ‘‘cybersecurity research’’ means re-
search, including social science research, into ways 
to identify, protect against, detect, respond to, and 
recover from cybersecurity threats; 
(2) the term ‘‘cybersecurity technology’’ means 
technology intended to identify, protect against, de-
tect, respond to, and recover from cybersecurity 
threats; 
(3) the term ‘‘cybersecurity threat’’ has the 
meaning given such term in section 102 of the Cy-
bersecurity Information Sharing Act of 2015 (6 
U.S.C. 1501; enacted as title I of the Cybersecurity
1594 
Act of 2015 (division N of the Consolidated Appro-
priations Act, 2016 (Public Law 114–113))); 
(4) the term ‘‘Department’’ means the Depart-
ment of Homeland Security; and 
(5) the term ‘‘Secretary’’ means the Secretary 
of Homeland Security. 
SEC. 1538. CYBER INCIDENT RESPONSE PLAN. 
Subsection (c) of section 2210 of the Homeland Secu-
rity Act of 2002 (6 U.S.C. 660) is amended— 
(1) by striking ‘‘regularly update’’ and inserting 
‘‘update not less often then biennially’’; and 
(2) by adding at the end the following new sen-
tence: ‘‘The Director, in consultation with relevant 
Sector Risk Management Agencies and the National 
Cyber Director, shall develop mechanisms to engage 
with stakeholders to educate such stakeholders re-
garding Federal Government cybersecurity roles and 
responsibilities for cyber incident response.’’. 
SEC. 1539. REPORT ON PLAN TO FULLY FUND THE INFOR-
MATION SYSTEMS SECURITY PROGRAM AND 
NEXT GENERATION ENCRYPTION. 
(a) REPORT.—Not later than one year after the date 
of the enactment of this Act, the Secretary of Defense 
shall submit to the appropriate congressional committees 
a report on the resources necessary to fully fund the Infor-
1595 
mation Systems Security Program during the period cov-
ered by the most recent future-years defense program sub-
mitted under section 221 of title 10, United States Code— 
(1) to address the cybersecurity requirements of 
the Department of Defense; and 
(2) for the adoption of next generation 
encryption into existing and future systems. 
(b) MATTERS INCLUDED.—The report under sub-
section (a) shall include the following: 
(1) An assessment by the Chief Information Of-
ficer of the Department of Defense, in coordination 
with the chiefs of the Armed Forces and in consulta-
tion with the Director of the National Security 
Agency, of the additional resources required to fund 
the Information Systems Security Program at a level 
that satisfies current and anticipated cybersecurity 
requirements of the Department. 
(2) An identification of any existing funding not 
currently aligned to the Program that is more ap-
propriately funded through the Program. 
(3) A strategic plan, developed in coordination 
with the chiefs of the Armed Forces and in consulta-
tion with the Director of the National Security 
Agency, that provides options, timelines and re-
quired funding, by Armed Force or component of
1596 
the Department, for the adoption of next generation 
encryption into existing and future systems. 
(c) FORM.—The report under subsection (a) may be 
submitted in classified form. 
(d) BRIEFING.—Not later than 30 days after the date 
on which the Secretary submits the report under sub-
section (a), the Chief Information Officer of the Depart-
ment and the Director of the National Security Agency 
shall jointly provide to the appropriate congressional com-
mittees a briefing on the report. 
(e) APPROPRIATE CONGRESSIONAL COMMITTEES DE-
FINED.—In this section, the term ‘‘appropriate congres-
sional committees’’ means— 
(1) the Committee on Armed Services, the 
Committee on Appropriations, and the Permanent 
Select Committee on Intelligence of the House of 
Representatives; and 
(2) the Committee on Armed Services, the 
Committee on Appropriations, and the Select Com-
mittee on Intelligence of the Senate. 
SEC. 1540. ASSESSMENT OF CONTROLLED UNCLASSIFIED 
INFORMATION PROGRAM. 
Subsection (b) of section 1648 of the National De-
fense Authorization Act for Fiscal Year 2020 (Public Law
1597 
116–92), is amended by amending paragraph (4) to read 
as follows: 
‘‘(4) Definitions for ‘Controlled Unclassified In-
formation’ (CUI) and ‘For Official Use Only’ 
(FOUO), policies regarding protecting information 
designated as either of such, and an assessment of 
the ‘DoD CUI Program’ and Department of Defense 
compliance with the responsibilities specified in De-
partment of Defense Instruction (DoDI) 5200.48, 
‘Controlled Unclassified Information (CUI),’ includ-
ing the following: 
‘‘(A) The extent to which the Department 
of Defense is identifying whether information is 
CUI via a contracting vehicle and marking doc-
uments, material, or media containing such in-
formation in a clear and consistent manner. 
‘‘(B) Recommended regulatory or policy 
changes to ensure consistency and clarity in 
CUI identification and marking requirements. 
‘‘(C) Circumstances under which commer-
cial information is considered CUI, and any im-
pacts to the commercial supply chain associated 
with security and marking requirements. 
‘‘(D) Benefits and drawbacks of requiring 
all CUI to be marked with a unique CUI legend
1598 
versus requiring that all data marked with an 
appropriate restricted legend be handled as 
CUI. 
‘‘(E) The extent to which the Department 
of Defense clearly delineates Federal Contract 
Information (FCI) from CUI. 
‘‘(F) Examples or scenarios to illustrate 
information that is and is not CUI.’’. 
SEC. 1541. EVALUATION OF DEPARTMENT OF DEFENSE 
CYBER GOVERNANCE. 
(a) IN GENERAL.—Not later than 30 days after the 
date of the enactment of this Act, the Secretary of Defense 
shall commission a comprehensive evaluation and review 
of the Department of Defense’s current cyber governance 
construct. 
(b) SCOPE.—The evaluation and review commis-
sioned pursuant to subsection (a) shall— 
(1) assess the performance of the Department 
of Defense in carrying out cyberspace and cybersecu-
rity responsibilities relating to— 
(A) conducting military cyberspace oper-
ations of offensive, defensive, and protective na-
tures; 
(B) securely operating technologies associ-
ated with information networks, industrial con-
1599 
trol systems, operational technologies, weapon 
systems, and weapon platforms; and 
(C) enabling, encouraging, and supporting 
the security of international, industrial, and 
academic partners; 
(2) analyze and assess the current institutional 
constructs across the Office of the Secretary of De-
fense, Joint Staff, military services, and combatant 
commands involved with and responsible for the re-
sponsibilities specified in paragraph (1); 
(3) examine the Department’s policy, legislative, 
and regulatory regimes related to cyberspace and cy-
bersecurity matters; 
(4) analyze and assess the Department’s per-
formance in and posture for building and retaining 
the requisite workforce necessary to perform the re-
sponsibilities specified in paragraph (1); 
(5) determine optimal governance structures re-
lated to the management and advancement of the 
Department’s cyber workforce, including those struc-
tures defined under and evaluated pursuant to sec-
tion 1649 of the National Defense Authorization Act 
for Fiscal Year 2020 (Public Law 116–92) and sec-
tion 1726 of the National Defense Authorization Act 
for Fiscal Year 2021 (Public Law 116–283);
1600 
(6) develop policy and legislative recommenda-
tions, as appropriate, to delineate and deconflict the 
roles and responsibilities of United States Cyber 
Command in defending and protecting the Depart-
ment of Defense Information Network (DoDIN), 
with the responsibility of the Chief Information Offi-
cer, the Defense Information Systems Agency, and 
the military services to securely operate technologies 
specified in paragraph (1)(B); 
(7) develop policy and legislative recommenda-
tions to enhance the authority of the Chief Informa-
tion Officers within the military services, specifically 
as such relates to executive and budgetary control 
over matters related to such services’ information 
technology security, acquisition, and value; 
(8) develop policy and legislative recommenda-
tions, as appropriate, for optimizing the institutional 
constructs across the Office of the Secretary of De-
fense, Joint Staff, military services, and combatant 
commands involved with and responsible for the re-
sponsibilities specified in paragraph (1); and 
(9) make recommendations for any legislation 
determined appropriate. 
(c) INTERIM BRIEFINGS.—Not later than 90 days 
after the commencement of the evaluation and review com-
1601 
missioned pursuant to subsection (a) and every 45 days 
thereafter, the Secretary of Defense shall brief the con-
gressional defense committees on interim findings of such 
evaluation and review. 
(d) REPORT.—Not later than six months after the 
commencement of the evaluation and review commissioned 
pursuant to subsection (a), the Secretary of Defense shall 
submit to the congressional defense committees a report 
on such evaluation and review. 
SEC. 1542. OPERATIONAL TECHNOLOGY AND MISSION-REL-
EVANT TERRAIN IN CYBERSPACE. 
(a) MISSION-RELEVANT TERRAIN.—Not later than 
January 1, 2025, the Department of Defense shall have 
completed mapping of mission-relevant terrain in cyber-
space for Defense Critical Assets and Task Critical Assets 
at sufficient granularity to enable mission thread analysis 
and situational awareness, including required— 
(1) decomposition of missions reliant on such 
Assets; 
(2) identification of access vectors; 
(3) internal and external dependencies; 
(4) topology of networks and network segments; 
(5) cybersecurity defenses across information 
and operational technology on such Assets; and
1602 
(6) identification of associated or reliant weap-
on systems. 
(b) COMBATANT COMMAND RESPONSIBILITIES.—Not 
later than January 1, 2024, the Commanders of United 
States European Command, United States Indo-Pacific 
Command, United States Northern Command, United 
States Strategic Command, United States Space Com-
mand, United States Transportation Command, and other 
relevant Commands, in coordination with the Commander 
of United States Cyber Command, in order to enable effec-
tive mission thread analysis, cyber situational awareness, 
and effective cyber defense of Defense Critical Assets and 
Task Critical Assets under their control or in their areas 
of responsibility, shall develop, institute, and make nec-
essary modifications to— 
(1) internal combatant command processes, re-
sponsibilities, and functions; 
(2) coordination with service components under 
their operational control, United States Cyber Com-
mand, Joint Forces Headquarters-Department of 
Defense Information Network, and the service cyber 
components; 
(3) combatant command headquarters’ situa-
tional awareness posture to ensure an appropriate 
level of cyber situational awareness of the forces, fa-
1603 
cilities, installations, bases, critical infrastructure, 
and weapon systems under their control or in their 
areas of responsibility, in particular, Defense Critical 
Assets and Task Critical Assets; and 
(4) documentation of their mission-relevant ter-
rain in cyberspace. 
(c) DEPARTMENT OF DEFENSE CHIEF INFORMATION 
OFFICER RESPONSIBILITIES.— 
(1) IN GENERAL.—Not later than November 1, 
2023, the Chief Information Officer of the Depart-
ment of Defense shall establish or make necessary 
changes to policy, control systems standards, risk 
management framework and authority to operate 
policies, and cybersecurity reference architectures to 
provide baseline cybersecurity requirements for oper-
ational technology in facilities, installations, bases, 
critical infrastructure, and weapon systems across 
the Department of Defense Information Network. 
(2) IMPLEMENTATION OF POLICIES.—The Chief 
Information Officer shall leverage acquisition guid-
ance, concerted assessment of the Department’s 
operational technology enterprise, and coordination 
with the military department principal cyber advi-
sors and chief information officers to drive necessary 
change and implementation of relevant policy across
1604 
the Department’s facilities, installations, bases, crit-
ical infrastructure, and weapon systems. 
(3) 
ADDITIONAL
RESPONSIBILITIES.—The 
Chief Information Officer shall ensure that policies, 
control systems standards, and cybersecurity ref-
erence architectures— 
(A) are implementable by components of 
the Department; 
(B) in their implementation, limit adver-
saries’ ability to reach or manipulate control 
systems through cyberspace; 
(C) appropriately balance non-connectivity 
and monitoring requirements; 
(D) include data collection and flow re-
quirements; 
(E) interoperate with and are informed by 
the operational community’s workflows for de-
fense of information and operational technology 
in facilities, installations, bases, critical infra-
structure, and weapon systems; 
(F) integrate and interoperate with De-
partment mission assurance construct; and 
(G) are implemented with respect to De-
fense Critical Assets and Task Critical Assets.
1605 
(d) UNITED
STATES
CYBER
COMMAND
OPER-
ATIONAL RESPONSIBILITIES.—Not later than January 1, 
2025, the Commander of United States Cyber Command 
shall make necessary modifications to the mission, scope, 
and posture of Joint Forces Headquarters-Department of 
Defense Information Network to ensure that Joint Forces 
Headquarters— 
(1) has appropriate visibility of operational 
technology in facilities, installations, bases, critical 
infrastructure, and weapon systems across the De-
partment of Defense Information Network and, in 
particular, Defense Critical Assets and Task Critical 
Assets; 
(2) can effectively command and control forces 
to defend such operational technology; and 
(3) has established processes for— 
(A) incident and compliance reporting; 
(B) ensuring compliance with Department 
of Defense cybersecurity policy; and 
(C) ensuring that cyber vulnerabilities, at-
tack vectors, and security violations, in par-
ticular those specific to Defense Critical Assets 
and Task Critical Assets, are appropriately 
managed.
1606 
(e) UNITED STATES CYBER COMMAND FUNCTIONAL 
RESPONSIBILITIES.—Not later than January 1, 2025, the 
Commander of United States Cyber Command shall— 
(1) ensure in its role of Joint Forces Trainer 
for the Cyberspace Operations Forces that oper-
ational technology cyber defense is appropriately in-
corporated into training for the Cyberspace Oper-
ations Forces; 
(2) delineate the specific force composition re-
quirements within the Cyberspace Operations Forces 
for specialized cyber defense of operational tech-
nology, including the number, size, scale, and re-
sponsibilities of defined Cyber Operations Forces ele-
ments; 
(3) develop and maintain, or support the devel-
opment and maintenance of, a joint training cur-
riculum for operational technology-focused Cyber-
space Operations Forces; 
(4) support the Chief Information Officer as 
the Department’s senior official for the cybersecurity 
of operational technology under this section; 
(5) develop and institutionalize, or support the 
development and institutionalization of, tradecraft 
for defense of operational technology across local de-
1608 
(F) instituting of model defensive cyber op-
erations and Department of Defense Informa-
tion Network operations tradecraft; and 
(G) integrating of such operations to en-
sure interoperability across echelons; and 
(7) advance the integration of the Department 
of Defense’s mission assurance, cybersecurity com-
pliance, cybersecurity operations, risk management 
framework, and authority to operate programs and 
policies. 
(f) SERVICE RESPONSIBILITIES.—No later than Jan-
uary 1, 2025, the Secretaries of the military departments, 
through the service principal cyber advisors, chief informa-
tion officers, the service cyber components, and relevant 
service commands, shall make necessary investments in 
operational technology in facilities, installations, bases, 
critical infrastructure, and weapon systems across the De-
partment of Defense Information Network and the serv-
ice-controlled forces responsible for defense of such oper-
ational technology to— 
(1) ensure that relevant local network and cy-
bersecurity forces are responsible for defending and 
appropriately postured to defend operational tech-
nology across facilities, installations, bases, critical
1609 
infrastructure, and weapon systems, in particular 
Defense Critical Assets and Task Critical Assets; 
(2) ensure that relevant local operational tech-
nology-focused system operators, network and cyber-
security forces, mission defense teams and other 
service-retained forces, and cyber protection teams 
are appropriately trained, including through common 
training and use of cyber ranges, as appropriate, to 
execute the specific requirements of cybersecurity 
operations in operational technology; 
(3) ensure that all Defense Critical Assets and 
Task Critical Assets are monitored and defended by 
Cybersecurity Service Providers; 
(4) ensure that operational technology is appro-
priately sensored and appropriate cybersecurity de-
fenses, including technologies associated with the 
More Situational Awareness for Industrial Control 
Systems Joint Capability Technology Demonstra-
tion, are employed to enable defense of Defense Crit-
ical Assets and Task Critical Assets; 
(5) implement Department of Defense Chief In-
formation Officer policy germane to operational 
technology, in particular with respect to Defense 
Critical Assets and Task Critical Assets;
1610 
(6) plan for, designate, and train dedicate 
forces to be utilized in operational technology-centric 
roles across the military services and United States 
Cyber Command; and 
(7) ensure that operational technology, as ap-
propriate, is not easily accessible via the internet 
and that cybersecurity investments accord with mis-
sion risk to and relevant access vectors for Defense 
Critical Assets and Task Critical Assets. 
(g) OFFICE OF THE SECRETARY OF DEFENSE RE-
SPONSIBILITIES.—No later than January 1, 2023, the 
Secretary of Defense shall— 
(1) assess and finalize Office of the Secretary 
of Defense components’ roles responsibilities for the 
cybersecurity of operational technology in facilities, 
installations, bases, critical infrastructure, and weap-
on systems across the Department of Defense Infor-
mation Network; 
(2) assess the need to establish centralized or 
dedicated funding for remediation of cybersecurity 
gaps in operational technology across the Depart-
ment of Defense Information Network and to drive 
implementation of this section; 
(3) make relevant modifications to the Depart-
ment of Defense’s mission assurance construct, Mis-
1611 
sion Assurance Coordination Board, and other rel-
evant bodies to drive— 
(A) prioritization of kinetic and non-kinetic 
threats to the Department’s missions and mini-
mization of mission risk in the Department’s 
war plans; 
(B) prioritization of relevant mitigations 
and investments to harden and assure the De-
partment’s missions and minimize mission risk 
in the Department’s war plans; and 
(C) completion of mission relevant terrain 
mapping of Defense Critical Assets and Task 
Critical Assets and population of associated as-
sessment and mitigation data in authorized re-
positories; 
(4) make relevant modifications to the Strategic 
Cybersecurity Program; and 
(5) drive and provide oversight of the imple-
mentation of this section. 
(h) BUDGET ROLLOUT BRIEFINGS.— 
(1) Until January 1, 2024, at the annual staff-
er day briefings for the Committees on Armed Serv-
ices of the Senate and the House of Representatives, 
each of the Secretaries of the military departments, 
the Commander of United States Cyber Command,
1612 
and the Department of Defense Chief Information 
Officer shall provide updates on activities under-
taken and progress made against the specific re-
quirements of this section. 
(2) No less frequently than annually until Jan-
uary 1, 2024, beginning no later than 1 year after 
the date of the enactment of this Act, the Under 
Secretary of Defense for Policy, the Under Secretary 
of Defense for Acquisition and Sustainment, the 
Chief Information Officer, and the Joint Staff J6, 
representing the combatant commands, shall individ-
ually or together provide briefings to the Committees 
on Armed Services of the Senate and the House of 
Representatives 
on 
activities 
undertaken 
and 
progress made against the specific requirements of 
this section. 
(i) IMPLEMENTATION.— 
(1) IN
GENERAL.—In implementing this sec-
tion, the Department of Defense shall prioritize the 
cybersecurity and cyber defense of Defense Critical 
Assets and Task Critical Assets and shape cyber in-
vestments, policy, operations, and deployments to 
ensure cybersecurity and cyber defense. 
(2) APPLICATION.—This section shall apply to 
assets owned and operated by the Department of
1613 
Defense, as well as applicable, non-Department of 
Defense assets essential to the projection, support, 
and sustainment of military forces and operations 
worldwide. 
(j) DEFINITION.—In this section, ‘‘operational tech-
nology’’ refers to control systems, or controllers, commu-
nication architectures, and user interfaces that monitor or 
control infrastructure and equipment operating in various 
environments, such as weapons systems, utility or energy 
production and distribution, medical, logistics, nuclear, bi-
ological, chemical, and manufacturing facilities. 
SEC. 1543. IMPLEMENTATION OF CERTAIN CYBERSECURITY 
RECOMMENDATIONS; CYBER HYGIENE AND 
CYBERSECURITY MATURITY MODEL CERTIFI-
CATION FRAMEWORK. 
(a) REPORT ON IMPLEMENTATION OF CERTAIN CY-
BERSECURITY RECOMMENDATIONS.—Not later than 180 
days after the date of the enactment of this Act, the Sec-
retary of Defense shall submit to the congressional defense 
committees a report regarding the plans of the Secretary 
to implement certain cybersecurity recommendations to 
ensure— 
(1) the Chief Information Officer of the Depart-
ment of Defense takes appropriate steps to ensure 
implementation of DC3I tasks;
1614 
(2) Department components develop plans with 
scheduled completion dates to implement any re-
maining CDIP tasks overseen by the Chief Informa-
tion Officer; 
(3) the Deputy Secretary of Defense identifies 
a Department component to oversee the implementa-
tion of any CDIP tasks not overseen by the Chief 
Information Officer and reports on progress relating 
to such implementation; 
(4) Department components accurately monitor 
and report information on the extent that users have 
completed Cyber Awareness Challenge training, as 
well as the number of users whose access to the De-
partment network was revoked because such users 
have not completed such training; 
(5) the Chief Information Officer ensures all 
Department components, including DARPA, require 
their users to take Cyber Awareness Challenge train-
ing; 
(6) a Department component is directed to 
monitor the extent to which practices are imple-
mented to protect the Department’s network from 
key cyberattack techniques; and 
(7) the Chief Information Officer assesses the 
extent to which senior leaders of the Department
1615 
have more complete information to make risk-based 
decisions, and revise the recurring reports (or de-
velop a new report) accordingly, including informa-
tion relating to the Department’s progress on imple-
menting— 
(A) cybersecurity practices identified in 
cyber hygiene initiatives; and 
(B) cyber hygiene practices to protect De-
partment networks from key cyberattack tech-
niques. 
(b) REPORT ON CYBER HYGIENE AND CYBERSECU-
RITY MATURITY MODEL CERTIFICATION FRAMEWORK.— 
(1) IN
GENERAL.—Not later than 180 days 
after the date of the enactment of this Act, the Sec-
retary of Defense shall submit to the congressional 
defense committees and the Comptroller General of 
the United States a report on the cyber hygiene 
practices of the Department of Defense and the ex-
tent to which such practices are effective at pro-
tecting Department missions, information, system 
and networks. The report shall include the following: 
(A) An assessment of each Department 
component’s compliance with the requirements 
and levels identified in the Cybersecurity Matu-
rity Model Certification framework.
1616 
(B) For each Department component that 
does not achieve the requirements for ‘‘good 
cyber hygiene’’ as defined in CMMC Model 
Version 1.02, a plan for how that component 
will implement security measures to bring it 
into compliance with good cyber hygiene re-
quirements within one year, and a strategy for 
mitigating potential vulnerabilities and con-
sequences until such requirements are imple-
mented. 
(2) COMPTROLLER
GENERAL
REVIEW.—Not 
later than 180 days after the submission of the re-
port required under paragraph (1)), the Comptroller 
General of the United States shall conduct an inde-
pendent review of the report and provide a briefing 
to the congressional defense committees on the find-
ings of the review. 
SEC. 1544. NATIONAL CYBER EXERCISE PROGRAM. 
(a) IN GENERAL.—Subtitle A of title XXII of the 
Homeland Security Act of 2002 (6 U.S.C. 651 et seq.) 
is amended by adding at the end the following new section: 
‘‘SEC. 2220A. NATIONAL CYBER EXERCISE PROGRAM. 
‘‘(a) ESTABLISHMENT OF PROGRAM.— 
‘‘(1) IN GENERAL.—There is established in the 
Agency the National Cyber Exercise Program (re-
1617 
ferred to in this section as the ‘Exercise Program’) 
to evaluate the National Cyber Incident Response 
Plan, and other related plans and strategies. 
‘‘(2) REQUIREMENTS.— 
‘‘(A) IN GENERAL.—The Exercise Program 
shall be— 
‘‘(i) based on current risk assess-
ments, 
including 
credible 
threats, 
vulnerabilities, and consequences; 
‘‘(ii) designed, to the extent prac-
ticable, to simulate the partial or complete 
incapacitation of a government or critical 
infrastructure network resulting from a 
cyber incident; 
‘‘(iii) designed to provide for the sys-
tematic evaluation of cyber readiness and 
enhance operational understanding of the 
cyber incident response system and rel-
evant information sharing agreements; and 
‘‘(iv) designed to promptly develop 
after-action reports and plans that can 
quickly incorporate lessons learned into fu-
ture operations. 
‘‘(B) MODEL EXERCISE SELECTION.—The 
Exercise Program shall—
1618 
‘‘(i) include a selection of model exer-
cises that government and private entities 
can readily adapt for use; and 
‘‘(ii) aid such governments and pri-
vate entities with the design, implementa-
tion, and evaluation of exercises that— 
‘‘(I) conform to the requirements 
described in subparagraph (A); 
‘‘(II) are consistent with any ap-
plicable national, State, local, or Trib-
al strategy or plan; and 
‘‘(III) 
provide 
for 
systematic 
evaluation of readiness. 
‘‘(3) CONSULTATION.—In carrying out the Ex-
ercise Program, the Director may consult with ap-
propriate representatives from Sector Risk Manage-
ment Agencies, the Office of the National Cyber Di-
rector, cybersecurity research stakeholders, and Sec-
tor Coordinating Councils. 
‘‘(b) DEFINITIONS.—In this section: 
‘‘(1) STATE.—The term ‘State’ means any 
State of the United States, the District of Columbia, 
the Commonwealth of Puerto Rico, the Northern 
Mariana Islands, the United States Virgin Islands,
1619 
Guam, American Samoa, and any other territory or 
possession of the United States. 
‘‘(2) PRIVATE ENTITY.—The term ‘private enti-
ty’ has the meaning given such term in section 102 
of the Cybersecurity Information Sharing Act of 
2015 (6 U.S.C. 1501).’’. 
(b) TITLE XXII TECHNICAL AND CLERICAL AMEND-
MENTS.— 
(1) TECHNICAL AMENDMENTS.— 
(A) HOMELAND SECURITY ACT OF 2002.— 
Subtitle A of title XXII of the Homeland Secu-
rity Act of 2002 (6 U.S.C. 651 et seq.) is 
amended— 
(i) in the first section 2215 (6 U.S.C. 
665; relating to the duties and authorities 
relating to .gov internet domain), by 
amending the section enumerator and 
heading to read as follows: 
‘‘SEC. 2215. DUTIES AND AUTHORITIES RELATING TO .GOV 
INTERNET DOMAIN.’’; 
(ii) in the second section 2215 (6 
U.S.C. 665b; relating to the joint cyber 
planning office), by amending the section 
enumerator and heading to read as follows:
1620 
‘‘SEC. 2216. JOINT CYBER PLANNING OFFICE.’’; 
(iii) in the third section 2215 (6 
U.S.C. 665c; relating to the Cybersecurity 
State Coordinator), by amending the sec-
tion enumerator and heading to read as 
follows: 
‘‘SEC. 2217. CYBERSECURITY STATE COORDINATOR.’’; 
(iv) in the fourth section 2215 (6 
U.S.C. 665d; relating to Sector Risk Man-
agement Agencies), by amending the sec-
tion enumerator and heading to read as 
follows: 
‘‘SEC. 2218. SECTOR RISK MANAGEMENT AGENCIES.’’; 
(v) in section 2216 (6 U.S.C. 665e; 
relating to the Cybersecurity Advisory 
Committee), by amending the section enu-
merator and heading to read as follows: 
‘‘SEC. 2219. CYBERSECURITY ADVISORY COMMITTEE.’’; and 
(vi) in section 2217 (6 U.S.C. 665f; 
relating to Cybersecurity Education and 
Training Programs), by amending the sec-
tion enumerator and heading to read as 
follows:
1621 
‘‘SEC. 2220. CYBERSECURITY EDUCATION AND TRAINING 
PROGRAMS.’’. 
(B) CONSOLIDATED APPROPRIATIONS ACT, 
2021.—Paragraph (1) of section 904(b) of divi-
sion U of the Consolidated Appropriations Act, 
2021 (Public Law 116–260) is amended, in the 
matter preceding subparagraph (A), by insert-
ing ‘‘of 2002’’ after ‘‘Homeland Security Act’’. 
(2) CLERICAL AMENDMENT.—The table of con-
tents in section 1(b) of the Homeland Security Act 
of 2002 is amended by striking the items relating to 
sections 2214 through 2217 and inserting the fol-
lowing new items: 
‘‘Sec. 2214. National Asset Database. 
‘‘Sec. 2215. Duties and authorities relating to .gov internet domain. 
‘‘Sec. 2216. Joint cyber planning office. 
‘‘Sec. 2217. Cybersecurity State Coordinator. 
‘‘Sec. 2218. Sector Risk Management Agencies. 
‘‘Sec. 2219. Cybersecurity Advisory Committee. 
‘‘Sec. 2220. Cybersecurity Education and Training Programs. 
‘‘Sec. 2220A. National Cyber Exercise Program.’’. 
SEC. 1545. DEPARTMENT OF HOMELAND SECURITY GUID-
ANCE WITH RESPECT TO CERTAIN INFORMA-
TION AND COMMUNICATIONS TECHNOLOGY 
OR SERVICES CONTRACTS. 
(a) GUIDANCE.—The Secretary of Homeland Secu-
rity, acting through the Under Secretary, shall issue guid-
ance with respect to new and existing covered contracts. 
(b) NEW
COVERED
CONTRACTS.—In developing 
guidance under subsection (a), with respect to each new
1622 
covered contract, as a condition on the award of such a 
contract, each contractor responding to a solicitation for 
such a contract shall submit to the covered officer— 
(1) a planned bill of materials when submitting 
a bid proposal; and 
(2) the certification and notifications described 
in subsection (e). 
(c) EXISTING COVERED CONTRACTS.—In developing 
guidance under subsection (a), with respect to each exist-
ing covered contract, each contractor with an existing cov-
ered contract shall submit to the covered officer— 
(1) the bill of materials used for such contract, 
upon the request of such officer; and 
(2) the certification and notifications described 
in subsection (e). 
(d) UPDATING BILL OF MATERIALS.—With respect 
to a covered contract, in the case of a change to the infor-
mation included in a bill of materials submitted pursuant 
to subsections (b)(1) and (c)(1), each contractor shall sub-
mit to the covered officer the update to such bill of mate-
rials, in a timely manner. 
(e) CERTIFICATION AND NOTIFICATIONS.—The cer-
tification and notifications referred to in subsections 
(b)(2) and (c)(2), with respect to a covered contract, are 
the following:
1623 
(1) A certification that each item listed on the 
submitted bill of materials is free from all known 
vulnerabilities or defects affecting the security of the 
end product or service identified in— 
(A) the National Institute of Standards 
and Technology National Vulnerability Data-
base; and 
(B) any database designated by the Under 
Secretary, in coordination with the Director of 
the Cybersecurity and Infrastructure Security 
Agency, that tracks security vulnerabilities and 
defects in open source or third-party developed 
software. 
(2) A notification of each vulnerability or defect 
affecting the security of the end product or service, 
if identified, through— 
(A) the certification of such submitted bill 
of materials required under paragraph (1); or 
(B) any other manner of identification. 
(3) A notification relating to the plan to miti-
gate, repair, or resolve each security vulnerability or 
defect listed in the notification required under para-
graph (2).
1624 
(f) ENFORCEMENT.—In developing guidance under 
subsection (a), the Secretary shall instruct covered officers 
with respect to— 
(1) the processes available to such officers en-
forcing subsections (b) and (c); and 
(2) when such processes should be used. 
(g) EFFECTIVE DATE.—The guidance required under 
subsection (a) shall take effect on the date that is 180 
days after the date of the enactment of this section. 
(h) GAO REPORT.—Not later than 1 year after the 
date of the enactment of this Act, the Comptroller General 
of the United States shall submit to the Secretary, the 
Committee on Homeland Security of the House of Rep-
resentatives, and the Committee on Homeland Security 
and Governmental Affairs of the Senate a report that in-
cludes— 
(1) a review of the implementation of this sec-
tion; 
(2) information relating to the engagement of 
the Department of Homeland Security with indus-
try; 
(3) an assessment of how the guidance issued 
pursuant to subsection (a) complies with Executive 
Order 14208 (86 Fed. Reg. 26633; relating to im-
proving the nation’s cybersecurity); and
1625 
(4) any recommendations relating to improving 
the supply chain with respect to covered contracts. 
(i) DEFINITIONS.—In this section: 
(1) The term ‘‘bill of materials’’ means a list of 
the parts and components (whether new or reused) 
of an end product or service, including, with respect 
to each part and component, information relating to 
the origin, composition, integrity, and any other in-
formation as determined appropriate by the Under 
Secretary. 
(2) The term ‘‘covered contract’’ means a con-
tract relating to the procurement of covered infor-
mation and communications technology or services 
for the Department. 
(3) The term ‘‘covered information and commu-
nications technology or services’’ means the terms— 
(A) ‘‘information technology’’ (as such 
term is defined in section 11101(6) of title 40, 
United States Code); 
(B) ‘‘information system’’ (as such term is 
defined in section 3502(8) of title 44, United 
States Code); 
(C) ‘‘telecommunications equipment’’ (as 
such term is defined in section 3(52) of the
1626 
Communications Act of 1934 (47 U.S.C. 
153(52))); and 
(D) ‘‘telecommunications service’’ (as such 
term is defined in section 3(53) of the Commu-
nications Act of 1934 (47 U.S.C. 153(53))). 
(4) The term ‘‘covered officer’’ means— 
(A) a contracting officer of the Depart-
ment; and 
(B) any other official of the Department as 
determined appropriate by the Under Secretary. 
(5) The term ‘‘Department’’ means the Depart-
ment of Homeland Security. 
(6) The term ‘‘software’’ means computer pro-
grams and associated data that may be dynamically 
written or modified during execution. 
(7) The term ‘‘Under Secretary’’ means the 
Under Secretary for Management of the Depart-
ment. 
SEC. 1546. STRATEGIC ASSESSMENT RELATING TO INNOVA-
TION OF INFORMATION SYSTEMS AND CY-
BERSECURITY THREATS. 
(a) 
RESPONSIBILITIES
OF
DIRECTOR.—Section 
2202(c)(3) of the Homeland Security Act of 2002 (6 
U.S.C. 652) is amended by striking the semicolon at the 
end and adding the following: ‘‘, including by carrying out
1627 
a periodic strategic assessment of the related programs 
and activities of the Agency to ensure such programs and 
activities contemplate the innovation of information sys-
tems and changes in cybersecurity risks and cybersecurity 
threats;’’ 
(b) REPORT.— 
(1) IN
GENERAL.—Not later than 120 days 
after the date of the enactment of this Act and not 
fewer than once every three years thereafter, the Di-
rector of the Cybersecurity and Infrastructure Secu-
rity Agency shall submit to the Committee on Home-
land Security of the House of Representatives and 
the Committee on Homeland Security and Govern-
mental Affairs of the Senate a strategic assessment 
for the purposes described in paragraph (2). 
(2) PURPOSES.—The purposes described in this 
paragraph are the following: 
(A) A description of the existing programs 
and activities administered in furtherance of 
section 2202(c)(3) of the Homeland Security 
Act of 2002 (6 U.S.C. 652). 
(B) An assessment of the capability of ex-
isting programs and activities administered by 
the Agency in furtherance of such section to 
monitor for, manage, mitigate, and defend
1628 
against cybersecurity risks and cybersecurity 
threats. 
(C) An assessment of past or anticipated 
technological trends or innovation of informa-
tion systems or information technology that 
have the potential to affect the efficacy of the 
programs and activities administered by the 
Agency in furtherance of such section. 
(D) A description of any changes in the 
practices of the Federal workforce, such as in-
creased telework, affect the efficacy of the pro-
grams and activities administered by the Agen-
cy in furtherance of section 2202(c)(3). 
(E) A plan to integrate innovative security 
tools, technologies, protocols, activities, or pro-
grams to improve the programs and activities 
administered by the Agency in furtherance of 
such section. 
(F) A description of any research and de-
velopment activities necessary to enhance the 
programs and activities administered by the 
Agency in furtherance of such section. 
(G) A description of proposed changes to 
existing programs and activities administered 
by the Agency in furtherance of such section,
1629 
including corresponding milestones for imple-
mentation. 
(H) Information relating to any new re-
sources or authorities necessary to improve the 
programs and activities administered by the 
Agency in furtherance of such section. 
(c) DEFINITIONS.—In this section: 
(1) The term ‘‘Agency’’ means the Cybersecu-
rity and Infrastructure Security Agency. 
(2) The term ‘‘cybersecurity purpose’’ has the 
meaning given such term in section 102(4) of the 
Cybersecurity Information Sharing Act of 2015 (6 
U.S.C. 1501(4)). 
(3) The term ‘‘cybersecurity risk’’ has the 
meaning given such term in section 2209(a)(2) of 
the Homeland Security Act of 2002 (6 U.S.C. 
659(a)(2)). 
(4) The term ‘‘information system’’ has the 
meaning given such term in section 3502(8) of title 
44, United States Code. 
(5) The term ‘‘information technology’’ has the 
meaning given such term in 3502(9) of title 44, 
United States Code.
1630 
(6) The term ‘‘telework’’ has the meaning given 
the term in section 6501(3) of title 5, United States 
Code. 
TITLE XVI—SPACE ACTIVITIES, 
STRATEGIC PROGRAMS, AND 
INTELLIGENCE MATTERS 
Subtitle A—Space Activities 
SEC. 1601. IMPROVEMENTS TO TACTICALLY RESPONSIVE 
SPACE LAUNCH PROGRAM. 
(a) SENSE OF CONGRESS.—It is the sense of Con-
gress that— 
(1) the Space Force, in collaboration with the 
United States Space Command, the military depart-
ments, relevant Defense Agencies and, where prac-
ticable, the National Reconnaissance Office, should 
continue to build on the successful Space Safari 
tactically responsive launch-2 mission of the Space 
Force, which was a pathfinder to inform concepts of 
operation regarding tactically responsive launches; 
and 
(2) future efforts regarding tactically responsive 
launches should not be limited to only launch capa-
bilities, but should also include all aspects that are 
needed for rapid reconstitution and responsiveness 
to urgent requirements with respect to satellite
1631 
buses, payloads, operations, and ground infrastruc-
ture. 
(b) PROGRAM.—Section 1609 of the William M. 
(Mac) Thornberry National Defense Authorization Act for 
Fiscal Year 2021 (Public Law 116–283) is amended— 
(1) by striking ‘‘The Secretary’’ and inserting 
‘‘(a) PROGRAM.—The Secretary’’; and 
(2) by adding at the end the following new sub-
section: 
‘‘(b) SUPPORT.— 
‘‘(1) ELEMENTS.—The Secretary of Defense, in 
consultation with the Director of National Intel-
ligence, shall support the tactically responsive launch 
program under subsection (a) during the period cov-
ered by the future-years defense program submitted 
to Congress under section 221 of title 10, United 
States Code, in 2022 to ensure that the program ad-
dresses the following: 
‘‘(A) The ability to rapidly place on-orbit 
systems to respond to urgent needs of the com-
manders of the combatant commands or to re-
constitute space assets and capabilities to sup-
port national security priorities if such assets 
and capabilities are degraded, attacked, or oth-
erwise impaired, including such assets and ca-
1632 
pabilities relating to protected communications 
and intelligence, surveillance, and reconnais-
sance. 
‘‘(B) The entire launch process, including 
with respect to launch services, satellite bus and 
payload 
availability, 
and 
operations 
and 
sustainment on-orbit. 
‘‘(2) PLAN.—As a part of the defense budget 
materials (as defined in section 239 of title 10, 
United States Code) for fiscal year 2023, the Sec-
retary of Defense, in consultation with the Director 
of National Intelligence, shall submit to Congress a 
plan for the tactically responsive launch program to 
address the elements under paragraph (1). Such 
plan shall include the following: 
‘‘(A) Lessons learned from the Space Sa-
fari tactically responsive launch-2 mission of 
the Space Force, and how to incorporate such 
lessons into future efforts regarding tactically 
responsive launches. 
‘‘(B) How to achieve responsive acquisition 
timelines within the adaptive acquisition frame-
work for space acquisition pursuant to section 
807.
1633 
‘‘(C) Plans to address supply chain issues 
and leverage commercial capabilities to support 
future reconstitution and urgent space require-
ments leveraging the tactically responsive 
launch program under subsection (a).’’. 
SEC. 1602. NATIONAL SECURITY SPACE LAUNCH PROGRAM. 
(a) SENSE OF CONGRESS.—It is the sense of Con-
gress that— 
(1) the Department of Defense and the Na-
tional Reconnaissance Office should, to the extent 
practicable, use launch services under a phase two 
contract of the National Security Space Launch pro-
gram; and 
(2) for missions that fall outside of the require-
ments of phase two of the National Security Space 
Launch program, the Department of Defense and 
the National Reconnaissance Office should continue 
to leverage the growing launch provider base of the 
United States, including those companies that pro-
vide smaller and ride-share launch capabilities, to 
incentivize sustained investment in domestic launch 
capabilities. 
(b) POLICY.—With respect to entering into contracts 
for launch services during the period beginning on the date 
of the enactment of this Act and ending September 30,
1634 
2024, it shall be the policy of the Department of Defense 
and the National Reconnaissance Office to— 
(1) use the National Security Space Launch 
program to the extent practicable to procure launch 
services that are met under the requirements of 
phase two; and 
(2) maximize continuous competition for launch 
services as the Space Force initiates planning for 
phase three, specifically for those technology areas 
that are unique to existing and emerging national 
security requirements. 
(c) NOTIFICATION.—If the Secretary of Defense or 
the Director of the National Reconnaissance Office deter-
mines that a program requiring launch services that could 
be met using phase two contracts will instead use an alter-
native launch procurement approach, not later than seven 
days after the date of such determination, the Secretary 
of Defense or, as appropriate, the Director of National 
Intelligence, shall submit to the appropriate congressional 
committees— 
(1) a notification of such determination; 
(2) a certification that the alternative launch 
procurement approach is in the national security in-
terest of the United States; and
1635 
(3) an outline of the cost analysis and any 
other rationale for such determination. 
(d) REPORT.— 
(1) REQUIREMENT.—Not later than 90 days 
after the date of the enactment of this Act, the Sec-
retary of Defense, in coordination with the Chief of 
Space Operations and the Director of the Space De-
velopment Agency, and in consultation with the Di-
rector of National Intelligence (including with re-
spect to the views of the Director of the National 
Reconnaissance Office), shall submit to the appro-
priate congressional committees a report on the 
plans of the Secretary to address, with respect to 
launches that would be procured in addition to or 
outside of launches under phase two, the emerging 
launch requirements in the areas of space access, 
mobility, and logistics that cannot be met by phase 
two capabilities, as of the date of the report. 
(2) ELEMENTS.—The report under paragraph 
(1) shall include the following: 
(A) An examination of the benefits of com-
peting up to two launches per year outside of 
phase two to accelerate the rapid development 
and on-orbit deployment of enabling and trans-
formational technologies required to address
1636 
emerging requirements, including with respect 
to— 
(i) delivery of in-space transportation, 
logistics and on-orbit servicing capabilities 
to enhance the persistence, sensitivity, and 
resiliency of national security space mis-
sions in a contested space environment; 
(ii) proliferated low-Earth orbit con-
stellation deployment; 
(iii) routine access to extended orbits 
beyond 
geostationary 
orbits, 
including 
cislunar orbits; 
(iv) greater cislunar awareness capa-
bilities; 
(v) payload fairings that exceed cur-
rent launch requirements; 
(vi) increased responsiveness for heavy 
lift capability; 
(vii) the ability to transfer orbits, in-
cluding point-to-point orbital transfers; 
(viii) capacity and capability to exe-
cute secondary deployments; 
(ix) high-performance upper stages; 
(x) vertical integration; and
1637 
(xi) other new missions that are out-
side the parameters of the nine design ref-
erence missions that exist as of the date of 
the enactment of this Act; 
(B) A description of how competing space 
access, mobility, and logistics launches could 
aid in establishing a new acquisition framework 
to— 
(i) promote the potential for addi-
tional open and sustainable competition for 
phase three; and 
(ii) re-examine the balance of mission 
assurance versus risk tolerance to reflect 
new resilient spacecraft architectures and 
reduce workload on the Federal Govern-
ment and industry to perform mission as-
surance where appropriate. 
(C) An analysis of how the matters under 
subparagraphs (A) and (B) may help continue 
to reduce the cost per launch of national secu-
rity payloads. 
(D) An examination of the effects to the 
National Security Space Launch program if 
contracted launch providers cannot meet all
1638 
phase two requirements, including with respect 
to— 
(i) the effects to national security 
launch resiliency; and 
(ii) the cost effects of a launch market 
that lacks full competition. 
(3) FORM.—The report under paragraph (1) 
shall be submitted in unclassified form, but may in-
clude a classified appendix. 
(4) BRIEFING.—Not later than 30 days after 
the date of the enactment of this Act, the Secretary, 
in consultation with the Director of National Intel-
ligence, shall provide to the appropriate congres-
sional committees a briefing on the report under 
paragraph (1). 
(e) DEFINITIONS.—In this section: 
(1) The term ‘‘appropriate congressional com-
mittees’’ means— 
(A) the congressional defense committees; 
and 
(B) the Permanent Select Committee on 
Intelligence of the House of Representatives 
and the Select Committee on Intelligence of the 
Senate.
1639 
(2) The term ‘‘phase three’’ means, with re-
spect to the National Security Space Launch pro-
gram, launch missions ordered under the program 
after fiscal year 2024. 
(3) The term ‘‘phase two’’ means, with respect 
to the National Security Space Launch program, 
launch missions ordered under the program during 
fiscal years 2020 through 2024. 
SEC. 1603. CLASSIFICATION REVIEW OF PROGRAMS OF THE 
SPACE FORCE. 
(a) CLASSIFICATION REVIEW.—The Chief of Space 
Operations shall— 
(1) not later than 120 days after the date of 
the enactment of this Act, conduct a review of each 
classified program managed under the authority of 
the Space Force to determine whether— 
(A) the level of classification of the pro-
gram could be changed to a lower level; or 
(B) the program could be declassified; and 
(2) not later than 90 days after the date on 
which the Chief completes such review, commence 
the change to the classification level or the declas-
sification as determined in such review. 
(b) COORDINATION.—The Chief of Space Operations 
shall carry out the review under subsection (a)(1) in co-
1640 
ordination with the Assistant Secretary of Defense for 
Space Policy and, as the Chief determines appropriate, the 
heads of other elements of the Department of Defense. 
(c) REPORT.—Not later than 60 days after the date 
on which the Chief of Space Operations completes the re-
view under subsection (a)(1), the Chief, in coordination 
with the Assistant Secretary of Defense for Space Policy, 
shall submit to the congressional defense committees a re-
port identifying each program managed under the author-
ity of the Space Force covered by a determination regard-
ing changing the classification level of the program or de-
classifying the program, including— 
(1) the timeline for implementing such change 
or declassification; and 
(2) any risks that exist in implementing such 
change or declassification. 
SEC. 1604. REPORT ON RANGE OF THE FUTURE INITIATIVE 
OF THE SPACE FORCE. 
(a) FINDINGS.—Congress finds that in a report sub-
mitted to Congress by the Chief of Space Operations, the 
Chief highlighted a need for changes to current law to im-
prove installation infrastructure at the launch ranges of 
the Space Force, and stated that ‘‘If we fail to do this 
effectively our installations will become a limiting factor 
to launch capability.’’.
1641 
(b) REPORT.—Not later than 90 days after the date 
of the enactment of this Act, the Chief of Space Oper-
ations shall submit to the congressional defense commit-
tees and the Committee on Science, Space, and Tech-
nology of the House of Representatives and the Committee 
on Commerce, Science, and Transportation of the Senate 
a report containing the following: 
(1) A detailed plan to carry out the Space 
Force ‘‘Range of the Future’’ initiative, including 
the estimated funding required to implement the 
plan. 
(2) Identification of any specific authorities the 
Chief determines need to be modified by law to im-
prove the ability of the Space Force to address long- 
term challenges to the physical infrastructure at the 
launch ranges of the Space Force to support govern-
ment and commercial launch, and an explanation for 
why such modified authorities are needed, as well as 
an identification of any impacts the proposed au-
thorities could have on competition in the commer-
cial launch industry. 
(3) Any additional proposals that would support 
improved infrastructure at the launch ranges of the 
Space Force and allow for commercial investment 
for mutually beneficial projects, including rec-
1642 
ommendations for legislative action to carry out such 
proposals and an identification of any impacts the 
proposed authorities could have on competition in 
the commercial launch industry. 
SEC. 1605. NORMS OF BEHAVIOR FOR INTERNATIONAL 
RULES-BASED ORDER IN SPACE. 
(a) PRIORITIZED OBJECTIVES.—Not later than 90 
days after the date of the enactment of this Act, the cov-
ered officials shall each submit to the National Space 
Council a list of prioritized objectives with respect to es-
tablishing norms of behavior to be addressed through bi-
lateral and multilateral negotiations relating to an inter-
national rules-based order in space, including with respect 
to events that create space debris, rendezvous and prox-
imity operations, and other appropriate matters. 
(b) CONSOLIDATED LIST AND FRAMEWORK.—Not 
later than 45 days after the date on which the National 
Space Council has received the list of prioritized objectives 
from each covered official under subsection (a), the Coun-
cil shall consolidate such prioritized objectives in a single 
list. The Secretary of State, in collaboration with other 
heads of relevant departments and agencies of the Federal 
Government, shall use such consolidated list as a guide 
to establish a framework for bilateral and multilateral ne-
gotiations described in such subsection.
1643 
(c) SUBMISSION
TO CONGRESS.—Not later than 
seven days after the date on which the National Space 
Council consolidates the list of prioritized objectives under 
subsection (b) in a single list, the Council shall submit 
to the appropriate congressional committees such consoli-
dated list, disaggregated by the covered official who sub-
mitted each such prioritized objective. 
(d) DEFINITIONS.—In this section: 
(1) The term ‘‘appropriate congressional com-
mittees’’ means— 
(A) the congressional defense committees; 
(B) the Committee on Foreign Affairs, the 
Committee on Science, Space, and Technology, 
and the Permanent Select Committee on Intel-
ligence of the House of Representatives; and 
(C) the Committee on Foreign Relations, 
the Committee on Commerce, Science, and 
Transportation, and the Select Committee on 
Intelligence of the Senate. 
(2) The term ‘‘covered official’’ means each of 
the following: 
(A) The Under Secretary of Defense for 
Policy, in consultation with the Chief of Space 
Operations, the Commander of the United
1644 
States Space Command, and the Director of the 
National Geospatial-Intelligence Agency. 
(B) The Assistant Secretary of State for 
Arms Control, Verification, and Compliance. 
(C) The Administrator of the National 
Aeronautics and Space Administration. 
(D) The Director of the National Recon-
naissance Office. 
SEC. 1606. PROGRAMS OF RECORD OF SPACE FORCE AND 
COMMERCIAL CAPABILITIES. 
Section 957(c) of the National Defense Authorization 
Act for Fiscal Year 2020 (Public Law 116–92; 10 U.S.C. 
9016 note) is amended by adding at the end the following 
new paragraph: 
‘‘(5) PROGRAMS OF RECORD AND COMMERCIAL 
CAPABILITIES.—The Service Acquisition Executive 
for Space Systems and Programs may not establish 
a program of record for the Space Force unless the 
Service Acquisition Executive first— 
‘‘(A) determines that there is no commer-
cially available capability that would meet the 
threshold objectives for that proposed program; 
and 
‘‘(B) submits to the congressional defense 
committees such determination.’’.
1645 
SEC. 1607. CLARIFICATION OF DOMESTIC SERVICES AND 
CAPABILITIES IN LEVERAGING COMMERCIAL 
SATELLITE REMOTE SENSING. 
(a) DOMESTIC DEFINED.—Section 1612(c) of the 
William M. (Mac) Thornberry National Defense Author-
ization Act for Fiscal Year 2021 (Public Law 116–283; 
10 U.S.C. 441 note) is amended— 
(1) by redesignating paragraph (4) as para-
graph (5); and 
(2) by inserting after paragraph (3) the fol-
lowing new paragraph (4): 
‘‘(4) The term ‘domestic’ includes, with respect 
to commercial capabilities or services covered by this 
section, capabilities or services provided by compa-
nies that operate in the United States and have ac-
tive mitigation agreements pursuant to the National 
Industrial Security Program.’’. 
(b) EFFECTIVE DATE.—The amendments made by 
subsection (a) shall take effect as if included in the enact-
ment of the William M. (Mac) Thornberry National De-
fense Authorization Act for Fiscal Year 2021 (Public Law 
116–283), including with respect to any requests for pro-
posals or rules issued pursuant to section 1612 of such 
Act.
1646 
SEC. 1608. NATIONAL SECURITY COUNCIL BRIEFING ON PO-
TENTIAL 
HARMFUL 
INTERFERENCE 
TO 
GLOBAL POSITIONING SYSTEM. 
(a) REQUIREMENT.—Not later than 30 days after the 
date of the enactment of this Act, the Secretary of Defense 
shall provide to the National Security Council, the Sec-
retary of Commerce, and the Commissioners of the Fed-
eral Communications Commission a briefing at the highest 
level of classification on the current assessment of the De-
partment of Defense, as of the date of the briefing, regard-
ing the potential for harmful interference to the Global 
Positioning System, mobile satellite services, or other tac-
tical or strategic systems of the Department of Defense, 
from commercial terrestrial operations and mobile satellite 
services using the 1525–1559 megahertz band and the 
1626.5–1660.5 megahertz band. 
(b) MATTERS INCLUDED.—The briefing under sub-
section (a) shall include— 
(1) potential operational impacts that have been 
studied within the megahertz bands specified in such 
subsection; and 
(2) impacts that could be mitigated, if any, in-
cluding how such mitigations could be implemented. 
(c) CONGRESSIONAL
BRIEFING.—Not later than 
seven days after the date on which the Secretary provides 
the briefing under subsection (a), the Secretary shall pro-
1647 
vide to the appropriate congressional committees such 
briefing. 
(d) INDEPENDENT TECHNICAL REVIEW.—The Sec-
retary shall carry out subsections (a) an (c) regardless of 
whether the independent technical review conducted pur-
suant to section 1663 of the William M. (Mac) Thornberry 
National Defense Authorization Act for Fiscal Year 2021 
(Public Law 116–283) has been completed. 
(e) APPROPRIATE CONGRESSIONAL COMMITTEES DE-
FINED.—In this section, the term ‘‘appropriate congres-
sional committees’’ means— 
(1) the congressional defense committees; and 
(2) the Committee on Energy and Commerce of 
the House of Representatives and the Committee on 
Commerce, Science, and Transportation of the Sen-
ate. 
SEC. 1609. LIMITATION ON AVAILABILITY OF FUNDS FOR 
PROTOTYPE PROGRAM FOR MULTIGLOBAL 
NAVIGATION SATELLITE SYSTEM RECEIVER 
DEVELOPMENT. 
Of the funds authorized to be appropriated by this 
Act or otherwise made available for fiscal year 2022 for 
the Office of the Secretary of the Air Force, not more than 
80 percent may be obligated or expended until the date 
on which the Secretary of Defense—
1648 
(1) certifies to the congressional defense com-
mittees that the Secretary of the Air Force is car-
rying out the program required under section 1607 
of the National Defense Authorization Act for Fiscal 
Year 2020 (Public Law 116–92; 133 Stat. 1724); 
and 
(2) provides to the Committees on Armed Serv-
ices of the House of Representatives and the Senate 
a briefing on how the Secretary is implementing 
such program, including with respect to addressing 
each element specified in subsection (b) of such sec-
tion. 
SEC. 1610. REPORT ON SPACE DEBRIS. 
(a) IN GENERAL.—Not later than 240 days after the 
date of the enactment of this Act, the Secretary of Defense 
shall submit to the appropriate congressional committees 
a report on the risks posed by man-made space debris in 
low-earth orbit, including— 
(1) recommendations with respect to the reme-
diation of such risks; and 
(2) outlines of plans to reduce the incident of 
such space debris. 
(b) APPROPRIATE
CONGRESSIONAL
COMMITTEES 
DEFINED.—In this section, the term ‘‘appropriate con-
gressional committees’’ means—
1649 
(1) the Committee on Armed Services and the 
Committee on Science, Space, and Technology of the 
House of Representatives; and 
(2) the Committee on Armed Services and Com-
mittee on Commerce, Science, and Transportation of 
the Senate. 
SEC. 1610A. NATIONAL SPACE COUNCIL BRIEFING ON 
THREATS TO UNITED STATES SPACE SYS-
TEMS. 
(a) IN GENERAL.—Not later than 90 days after the 
date of the enactment of this Act, the Secretary of Defense 
shall provide to the National Space Council, the Secretary 
of Commerce, the Secretary of Transportation, and the 
Administrator of the National Aeronautics and Space Ad-
ministration a briefing at the highest level of classification 
on the current assessment of the Department of Defense, 
as of the date of the briefing, regarding safety threats 
posed to United States civilian and commercial space sys-
tems in space by adversarial foreign governments and 
other foreign governments, with a particular emphasis on 
threats posed by China’s activities in space and debris 
arising from any ongoing or future work by China on anti- 
satellite weapons technology. 
(b) CONGRESSIONAL BRIEFING.—Not later than 15 
days after the date on which the Secretary of Defense pro-
1650 
vides the briefing under subsection (a), the Secretary shall 
provide such briefing to— 
(1) the Committees on Armed Services, Energy 
and Commerce, Transportation and Infrastructure, 
and Science, Space, and Technology of the House of 
Representatives; and 
(2) the Committees on Armed Services and 
Commerce, Science, and Transportation of the Sen-
ate. 
SEC. 1610B. LEVERAGING COMMERCIAL ON-ORBIT SAT-
ELLITE SERVICING. 
(a) FINDINGS.—Congress finds the following: 
(1) National security depends on reliable access 
to, and safe operations in, space. Modern society is 
reliant on space operations, but most spacecraft 
today are designed to be discarded at end-of-mission, 
leaving potential gaps in mission continuity and con-
tributing to risk in the space domain. 
(2) Existing and future critical Department of 
Defense missions operating in space and providing 
multidomain support would benefit from the applica-
tion of commercial On-orbit Servicing, Assembly, 
and Manufacturing (in this section referred to as 
‘‘OSAM’’) capabilities, which extend the longevity 
and operability of national security space systems
1651 
through inspection, repair, refueling, and mitigation 
of debris. 
(3) Because the domain in which space systems 
operate is increasingly congested, the risk of colli-
sions and orbital debris generation has increased, a 
risk that is exacerbated by a lack of utilization of 
OSAM services. A secure, stable, and accessible 
space domain is paramount to the unimpeded and 
resilient operations of civil, military, intelligence, and 
commercial space assets by the United States and 
its allies. OSAM technologies support Department of 
Defense strategy by improving the adaptability and 
efficiency of existing and future military space archi-
tectures. 
(b) SENSE OF CONGRESS.—It is the sense of Con-
gress that— 
(1) Congress strongly encourages the Secretary 
of Defense to invest in developing technologies to 
support the advancement of debris remediation, such 
as rendezvous, proximity operations, and debris re-
moval as an element of OSAM; 
(2) because of the importance of the space do-
main, the Secretary should seek ways to collaborate 
with United States industry partners and allied na-
tions;
1652 
(3) beyond technology development, the Sec-
retary and the intelligence community should con-
sider satellite servicing and active disposal as a via-
ble operational trade-off—in this way, in the future, 
a back-up disposal plan using direct retrieval should 
be a preferred and viable method for relevant or off- 
nominal missions. 
(c) REPORT.—Not later than December 3, 2021, the 
Secretary of Defense, in consultation with the Director of 
National Intelligence and the Administrator of the Na-
tional Aeronautics and Space Administration, shall submit 
to the appropriate congressional committees a report 
that— 
(1) identifies critical investment areas for the 
further development and usage of commercial OSAM 
technologies and capabilities to meet emerging and 
changing government space mission needs on-orbit; 
and 
(2) includes a plan for interagency engagement 
in the standardization and adoption of commercial 
OSAM interfaces for government space systems. 
(d) APPROPRIATE
CONGRESSIONAL
COMMITTEES 
DEFINED.—In this section, the term ‘‘appropriate con-
gressional committees’’ means— 
(1) the congressional defense committees;
1653 
(2) the Committee on Science, Space, and 
Technology and the Permanent Select Committee on 
Intelligence of the House of Representatives; and 
(3) the Committee on Commerce, Science, and 
Transportation and the Select Committee on Intel-
ligence of the Senate. 
SEC. 1610C. REPORT ON SENSING CAPABILITIES OF THE 
DEPARTMENT OF DEFENSE TO ASSIST FIGHT-
ING WILDFIRES. 
(a) REPORT.—Not later than 180 days after the date 
of the enactment of this Act, the Secretary of Defense, 
in consultation with the Director of National Intelligence 
and any other head of an agency or department the Sec-
retary determines appropriate, shall submit to the appro-
priate congressional committees a report on the capabili-
ties of the Department of Defense to assist fighting 
wildfires through the use and analysis of satellite and 
other aerial survey technology. 
(b) MATTERS INCLUDED.—The report under sub-
section (a) shall include the following: 
(1) An examination of the current and future 
sensing requirements for the wildfire fighting and 
analysis community. 
(2) Identification of assets of the Department 
of Defense and intelligence community that can pro-
1654 
vide data that is relevant to the requirements under 
paragraph (1), including an examination of such as-
sets that— 
(A) are currently available; 
(B) are in development; and 
(C) have been formally proposed by a de-
partment or agency of the Federal Government, 
but which have not yet been approved by Con-
gress. 
(3) With respect to the assets identified under 
paragraph (2)(A), an examination of how close the 
data such assets provide comes to meeting the wild-
fire management and suppression community needs. 
(4) An identification of the total and breakdown 
of costs reimbursed to the Department of Defense 
during the five-year period preceding the date of the 
report for reimbursable requests for assistance from 
lead departments or agencies of the Federal Govern-
ment responding to natural disasters. 
(5) A discussion of issues involved in producing 
unclassified products using unclassified and classi-
fied assets, and policy options for Congress regard-
ing that translation, including by explicitly address-
ing classification choices that could ease the applica-
1655 
tion of data from such assets to wildfire detection 
and tracking. 
(6) Identification of options to address gaps be-
tween requirements and capabilities to be met by ad-
ditional solutions, whether from the Department of 
Defense, the intelligence community, or from the 
civil or commercial domain. 
(7) A retrospective analysis to determine wheth-
er the existing data could have been used to defend 
against past fires. 
(8) Options for the Department of Defense to 
assist the Department of Agriculture, the Depart-
ment of the Interior, the Department of Energy, the 
National Aeronautics and Space Administration, the 
National Oceanic and Atmospheric Administration, 
the National Institute of Standards and Technology, 
the National Science Foundation, and State and 
local governments in identifying and responding to 
wildfires. 
(c) DEFINITIONS.—In this section: 
(1) The term ‘‘appropriate congressional com-
mittees’’ means the following: 
(A) The Committee on Armed Services, the 
Committee on Agriculture, the Committee on 
Natural Resources, the Committee on Science,
1656 
Space, and Technology, and the Permanent Se-
lect Committee on Intelligence of the House of 
Representatives. 
(B) The Committee on Armed Services, 
the Committee on Agriculture, Nutrition, and 
Forestry, the Committee on Commerce, Science, 
and Transportation, the Committee on Energy 
and Natural Resources, and the Select Com-
mittee on Intelligence of the Senate. 
(2) The term ‘‘intelligence community’’ has the 
meaning given that term in section 3 of the National 
Security Act of 1947 (50 U.S.C. 3003). 
SEC. 1610D. NON-GEOSTATIONARY ORBIT SATELLITE CON-
STELLATIONS. 
(a) FINDING.—Congress finds that modern high- 
throughput non-geostationary orbit satellite constellations 
provide robust commercial satellite communication capa-
bilities that enable current military operations and facili-
tate advanced communications networks that would pro-
vide significant quality of life enhancements for deployed 
personnel of the Navy. 
(b) REPORT.—Not later than 180 days after the date 
of the enactment of this Act, the Secretary of Defense, 
in consultation with the Secretaries of the military depart-
ments and heads of the Defense Agencies, shall submit
1657 
to the congressional defense committees a report on cur-
rent commercial satellite communication initiatives, par-
ticularly with respect to new non-geostationary orbit sat-
ellite technologies, the Navy has employed to increase sat-
ellite communication throughput to afloat platforms cur-
rently constrained by legacy capabilities. The report shall 
include the following: 
(1) A potential investment strategy concerning 
how to operationalize commercial satellite commu-
nication capabilities using non-geostationary orbit 
satellites across the fleet, including— 
(A) requisite funding required to ade-
quately prioritize and accelerate the integration 
of such capabilities into Navy warfighting sys-
tems; and 
(B) future-year spending projections for 
such efforts that align with other satellite com-
munication investments of the Department. 
(2) An integrated satellite communications ref-
erence architecture roadmap for the Navy to achieve 
a resilient, secure network for operationalizing com-
mercial satellite communication capabilities using 
non-geostationary orbit satellites across the Navy 
that is capable of leveraging multi-band and multi- 
orbit architectures, including requirements that en-
1658 
able maximum use of commercially available tech-
nologies. 
Subtitle B—Defense Intelligence 
and Intelligence-Related Activities 
SEC. 
1611. 
NOTIFICATION 
OF 
CERTAIN 
THREATS 
TO 
UNITED STATES ARMED FORCES BY FOREIGN 
GOVERNMENTS. 
(a) DETERMINATION THAT FOREIGN GOVERNMENT 
INTENDS TO CAUSE THE DEATH OF OR SERIOUS BODILY 
INJURY TO MEMBERS OF THE ARMED FORCES.—The 
Secretary of Defense shall carry out the notification re-
quirements under subsection (b) whenever the Secretary, 
in consultation with the Director of National Intelligence, 
determines with high confidence that, on or after the date 
of the enactment of this Act, an official of a foreign gov-
ernment plans or takes some other substantial step that— 
(1) is intended to cause the death of, or serious 
bodily injury to, any member of the United States 
Armed Forces, whether through direct means or in-
direct means, including through a promise or agree-
ment by the foreign government to pay anything of 
pecuniary value to an individual or organization in 
exchange for causing such death or injury; or 
(2) with respect to such a foreign government 
that the Secretary of State has determined, for pur-
1659 
poses of section 1754(c) of the Export Controls Act 
of 2018 (50 U.S.C. 4813), is a government that has 
repeatedly provided support for acts of international 
terrorism, is intended to cause the abduction, death 
of, or serious bodily injury to, any citizen or resident 
of the United States located in the United States, 
whether through direct or such indirect means. 
(b) NOTICE TO CONGRESS.— 
(1) NOTIFICATION.—Except as provided in 
paragraph (3), not later than 14 days after making 
a determination under subsection (a), the Secretary 
shall notify the congressional leadership, the con-
gressional intelligence committees and, consistent 
with the protection of sources and methods, the ap-
propriate congressional committees of such deter-
mination. Such notification shall include, at a min-
imum, the following: 
(A) A description of the nature and extent 
of the effort by the foreign government to tar-
get members of the United States Armed 
Forces or citizens or residents of the United 
States described in paragraph (2) of such sub-
section. 
(B) An assessment of what specific offi-
cials, agents, entities, and departments within
1660 
the foreign government ordered, authorized, or 
had knowledge of the effort. 
(C) An assessment of the motivations of 
the foreign government for undertaking such an 
effort. 
(D) An assessment of whether the effort of 
the foreign government was a substantial factor 
in the death or serious bodily injury of any 
member of the United States Armed Forces or 
citizen or resident of the United States de-
scribed in paragraph (2) of such subsection, or 
the abduction of such a citizen or resident. 
(E) Any other information the Secretary 
determines appropriate. 
(2) OPTION FOR BRIEFING.—Upon the request 
of a congressional recipient specified in paragraph 
(1) after being notified of a determination under 
such paragraph, the Secretary shall provide to the 
recipient a briefing on the contents of the notifica-
tion. 
(3) PROTECTION
OF
SOURCES
AND
METH-
ODS.—This subsection shall be carried out in a man-
ner that is consistent with the protection of sources 
and methods. 
(c) DEFINITIONS.—In this section:
1661 
(1) The term ‘‘anything of pecuniary value’’ has 
the meaning given that term in section 1958(b)(1) 
of title 18, United States Code. 
(2) The term ‘‘appropriate congressional com-
mittees’’ means the following: 
(A) The Committee on Armed Services and 
the Committee on Foreign Affairs of the House 
of Representatives. 
(B) The Committee on Armed Services and 
the Committee on Foreign Relations of the Sen-
ate. 
(3) The terms ‘‘congressional intelligence com-
mittees’’ and ‘‘intelligence community’’ have the 
meaning given those terms in section 3 of the Na-
tional Security Act of 1947 (50 U.S.C. 3003). 
(4) The term ‘‘congressional leadership’’ in-
cludes the following: 
(A) The majority leader of the Senate. 
(B) The minority leader of the Senate. 
(C) The Speaker of the House of Rep-
resentatives. 
(D) The minority leader of the House of 
Representatives. 
(5) The term ‘‘determines with high con-
fidence’’—
1663 
(7) The term ‘‘foreign government’’ means the 
government of a foreign country with which the 
United States is at peace. 
(8) The term ‘‘indirect means’’ means through, 
or with the assistance of, intermediaries. 
SEC. 1612. STRATEGY AND PLAN TO IMPLEMENT CERTAIN 
DEFENSE INTELLIGENCE REFORMS. 
(a) STRATEGY AND PLAN.—The Secretary of De-
fense, in coordination with the Director of National Intel-
ligence, shall develop and implement a strategy and plan 
to better support the intelligence priorities of the com-
manders of the combatant commands, including with re-
spect to efforts to counter in the open malign activities 
of adversaries of the United States. 
(b) MATTERS INCLUDED IN PLAN.—The plan under 
subsection (a) shall include the following: 
(1) A plan to adapt policies and procedures to 
assemble and release facts about the malign activi-
ties of an adversary described in such subsection in 
a timely way and in forms that allow for greater dis-
tribution and release. 
(2) A plan to develop and publish validated pri-
ority intelligence requirements of the commanders of 
the combatant commands.
1664 
(3) A plan to elevate open-source intelligence to 
a foundational intelligence for strategic intelligence 
that is treated on par with information collected 
from classified means (for example, human intel-
ligence, signals intelligence, and geospatial intel-
ligence). 
(4) A plan for expanding the use of unclassified 
intelligence in order to combat threats from 
disinformation and misinformation by foreign adver-
saries. 
(5) A review by each element of the intelligence 
community of the approaches used by that ele-
ment— 
(A) with respect to intelligence that has 
not been processed or analyzed, to separate out 
data from the sources and methods by which 
the data is obtained (commonly known as 
‘‘tearlining’’); and 
(B) with respect to finished intelligence 
products that relate to malign activities of an 
adversary described in subsection (a), to down-
grade the classification level of the product. 
(c) CONGRESSIONAL BRIEFING.—Not later than one 
year after the date of the enactment of this Act, and annu-
ally thereafter through December 31, 2026, the Secretary
1665 
and the Director shall jointly provide to the appropriate 
congressional committees a briefing on the strategy and 
plan under subsection (a). 
(d) APPROPRIATE
CONGRESSIONAL
COMMITTEES 
DEFINED.—In this section, the term ‘‘appropriate con-
gressional committees’’ means the following: 
(1) The congressional defense committees. 
(2) The Committee on the Judiciary and the 
Permanent Select Committee on Intelligence of the 
House of Representatives. 
(3) The Committee on the Judiciary and the 
Select Committee on Intelligence of the Senate. 
SEC. 1613. AUTHORITY OF UNDER SECRETARY OF DEFENSE 
FOR INTELLIGENCE AND SECURITY TO EN-
GAGE IN FUNDRAISING FOR CERTAIN NON-
PROFIT ORGANIZATIONS. 
Section 422 of title 10, United States Code, is 
amended by adding at the end the following new sub-
section: 
‘‘(c) FUNDRAISING.—(1) The Under Secretary of De-
fense for Intelligence and Security may engage in fund-
raising in an official capacity for the benefit of nonprofit 
organizations that provide support— 
‘‘(A) to surviving dependents of deceased em-
ployees of the Defense Intelligence Enterprise; or
1666 
‘‘(B) for the welfare, education, or recreation of 
employees and former employees of the Defense In-
telligence Enterprise and the dependents of such em-
ployees and former employees. 
‘‘(2) The Under Secretary may delegate the authority 
under paragraph (1) to— 
‘‘(A) the heads of the components of the De-
partment of Defense that are elements of the intel-
ligence community; 
‘‘(B) the senior intelligence officers of the 
Armed Forces and the regional and functional com-
batant commands; 
‘‘(C) the Director for Intelligence of the Joint 
Chiefs of Staff; and 
‘‘(D) the senior officials of other elements of 
the Department of Defense that perform intelligence 
functions. 
‘‘(3) Not later than seven days after the date on 
which the Under Secretary or an official specified in para-
graph (2) engages in fundraising pursuant to paragraph 
(1), or at the time at which the Under Secretary or an 
official makes a determination to engage in such fund-
raising, the Under Secretary shall notify the appropriate 
congressional committees of such fundraising. 
‘‘(4) In this subsection:
1667 
‘‘(A) The term ‘appropriate congressional com-
mittees’ means— 
‘‘(i) the Committees on Armed Services of 
the House of Representatives and the Senate; 
and 
‘‘(ii) the Permanent Select Committee on 
Intelligence of the House of Representatives 
and the Select Committee on Intelligence of the 
Senate. 
‘‘(B) The term ‘Defense Intelligence Enterprise’ 
has the meaning given that term in section 
426(b)(4)(B) of this title. 
‘‘(C) The term ‘fundraising’ means the raising 
of funds through the active participation in the pro-
motion, production, or presentation of an event de-
signed to raise funds and does not include the direct 
solicitation of money by any other means. 
‘‘(D) The term ‘intelligence community’ has the 
meaning given that term in section 3 of the National 
Security Act of 1947 (50 U.S.C. 3003).’’. 
SEC. 1614. EXECUTIVE AGENT FOR EXPLOSIVE ORDNANCE 
INTELLIGENCE. 
(a) IN GENERAL.—Subchapter I of chapter 21 of title 
10, United States Code, is amended by adding at the end 
the following new section:
1668 
‘‘§ 430c. Executive agent for explosive ordnance intel-
ligence 
‘‘(a) DESIGNATION.—The Secretary of Defense shall 
designate the Director of the Defense Intelligence Agency 
as the executive agent for explosive ordnance intelligence. 
‘‘(b) DEFINITIONS.—In this section: 
‘‘(1) The term ‘explosive ordnance intelligence’ 
means technical intelligence relating to explosive 
ordnance (as defined in section 283(d) of this title), 
including with respect to the processing, production, 
dissemination, integration, exploitation, evaluation, 
feedback, and analysis of explosive ordnance using 
the skills, techniques, principles, and knowledge of 
explosive ordnance disposal personnel regarding 
fuzing, firing systems, ordnance disassembly, and 
development of render safe techniques, procedures 
and tools, publications, and applied technologies. 
‘‘(2) The term ‘executive agent’ has the mean-
ing given the term ‘DoD Executive Agent’ in Direc-
tive 5101.1.’’. 
(b) CLERICAL AMENDMENT.—The table of sections 
at the beginning of such chapter is amended by inserting 
after the item relating to section 430b the following new 
item: 
‘‘430c. Executive agent for explosive ordnance intelligence.’’.
1669 
(c) DATE OF DESIGNATION.—The Secretary of De-
fense shall make the designation under section 430c of 
title 10, United States Code, as added by subsection (a), 
by not later than 30 days after the date of the enactment 
of this Act. 
SEC. 1615. INCLUSION OF EXPLOSIVE ORDNANCE INTEL-
LIGENCE IN DEFENSE INTELLIGENCE AGEN-
CY ACTIVITIES. 
Section 105 of the National Security Act of 1947 (50 
U.S.C. 3038) is amended— 
(1) in subsection (b)(5), by striking ‘‘human in-
telligence and’’ and inserting ‘‘explosive ordnance in-
telligence, human intelligence, and’’; and 
(2) by adding at the end the following new sub-
section: 
‘‘(e) EXPLOSIVE ORDNANCE INTELLIGENCE DE-
FINED.—In this section, the term ‘explosive ordnance in-
telligence’ means technical intelligence relating to explo-
sive ordnance (as defined in section 283(d) of title 10, 
United States Code), including with respect to the proc-
essing, production, dissemination, integration, exploi-
tation, evaluation, feedback, and analysis of explosive ord-
nance using the skills, techniques, principles, and knowl-
edge of explosive ordnance disposal personnel regarding 
fuzing, firing systems, ordnance disassembly, and develop-
1670 
ment of render safe techniques, procedures and tools, pub-
lications, and applied technologies.’’. 
SEC. 1616. MODIFICATION OF REQUIREMENT FOR ANNUAL 
REPORTS ON VULNERABILITIES EQUITIES 
PROCESS. 
Section 6720(c) of the Damon Paul Nelson and Mat-
thew Young Pollard Intelligence Authorization Act for 
Fiscal Years 2018, 2019, and 2020 (Public Law 116–92; 
50 U.S.C. 3316a) is amended— 
(1) in paragraph (1)— 
(A) in the matter preceding subparagraph 
(A), by striking ‘‘classified’’; 
(B) in subparagraph (B), by striking ‘‘; 
and’’ and inserting a semicolon; 
(C) in subparagraph (C), by striking the 
period at the end and inserting a semicolon; 
and 
(D) by adding at the end the following new 
subparagraphs: 
‘‘(E) 
the 
aggregate 
number 
of 
vulnerabilities disclosed to vendors or the public 
pursuant to the Vulnerabilities Equities Proc-
ess; 
‘‘(F) 
the 
aggregate 
number 
of 
vulnerabilities disclosed to vendors or the public
1671 
pursuant to the Vulnerabilities Equities Process 
known to have been patched; 
‘‘(G) 
the 
number 
of 
times 
the 
Vulnerabilities Equities Process resulted in a 
decision to disclose a vulnerability; 
‘‘(H) 
the 
number 
of 
times 
the 
Vulnerabilities Equities Process resulted in a 
decision not to disclose a vulnerability; 
‘‘(I) the number of times a decision de-
scribed in subparagraph (G) was the result of 
a unanimous agreement of the participants in 
the Vulnerabilities Equities Process; 
‘‘(J) the number of times a decision de-
scribed in subparagraph (H) was the result of 
a unanimous agreement of the participants in 
the Vulnerabilities Equities Process; 
‘‘(K) the number of appeals made through 
the Vulnerabilities Equities Process by partici-
pants in such process of a preliminary deter-
mination to disclose a vulnerability; 
‘‘(L) the number of appeals made through 
the Vulnerabilities Equities Process by partici-
pants in such process of a preliminary deter-
mination not to disclose a vulnerability;
1672 
‘‘(M) the number of times a preliminary 
determination was reversed pursuant to an ap-
peal described in subparagraph (K); and 
‘‘(N) the number of times a preliminary 
determination was reversed pursuant to an ap-
peal described in subparagraph (L).’’; and 
(2) by amending paragraph (2) to read as fol-
lows: 
‘‘(2) FORM AND PUBLICATION.— 
‘‘(A) FORM.—Each report submitted under 
paragraph (1) shall be submitted in unclassified 
form, but may include a classified annex. 
‘‘(B) PUBLICATION.—The Director shall 
make available to the public the unclassified 
portion of each report submitted under para-
graph (1).’’. 
Subtitle C—Nuclear Forces 
SEC. 1621. EXERCISES OF NUCLEAR COMMAND, CONTROL, 
AND COMMUNICATIONS SYSTEM. 
(a) REQUIREMENT.—Chapter 24 of title 10, United 
States Code, is amended by adding at the end the fol-
lowing new section:
1673 
‘‘§ 499b. Exercises of nuclear command, control, and 
communications system 
‘‘(a) REQUIRED EXERCISES.—Except as provided by 
subsection (b), beginning 2022, the President shall partici-
pate in a large-scale exercise of the nuclear command, con-
trol, and communications system during the first year of 
each term of the President, and may participate in such 
additional exercises as the President determines appro-
priate. 
‘‘(b) WAIVER.—The President may waive, on a case- 
by-case basis, the requirement to participate in an exercise 
under subsection (a) if the President— 
‘‘(1) determines that participating in such an 
exercise is infeasible by reason of a war declared by 
Congress, a national emergency declared by the 
President or Congress, a public health emergency 
declared by the Secretary of Health and Human 
Services under section 319 of the Public Health 
Service Act (42 U.S.C. 247d), or other similar exi-
gent circumstance; and 
‘‘(2) submits to the congressional defense com-
mittees a notice of the waiver and a description of 
such determination.’’.
1674 
(b) CLERICAL AMENDMENT.—The table of sections 
at the beginning of such chapter is amended by adding 
at the end the following new item: 
‘‘499b. Exercises of nuclear command, control, and communications system.’’. 
SEC. 1622. INDEPENDENT REVIEW OF NUCLEAR COMMAND, 
CONTROL, AND COMMUNICATIONS SYSTEM. 
(a) REVIEW.—Not later than 30 days after the date 
of the enactment of this Act, the Secretary of Defense 
shall seek to enter into an agreement with the National 
Academies of Sciences, Engineering, and Medicine under 
which the National Academies shall conduct a review of 
the current plans, policies, and programs of the nuclear 
command, control, and communications system, and such 
plans, policies, and programs that are planned through 
2030. 
(b) MATTERS INCLUDED.—The review under sub-
section (a) shall include a review of each of the following: 
(1) The plans, policies, and programs described 
in such subsection. 
(2) The programmatic challenges and risks to 
the nuclear command, control, and communications 
system. 
(3) Emerging technologies and how such tech-
nologies may be applied to the next generation of the 
nuclear command, control, and communications sys-
tem.
1675 
(4) The security and surety of the nuclear com-
mand, control, and communications system. 
(5) Threats to the nuclear command, control, 
and communications system that may occur through 
2030. 
(c) BRIEFING.—Not later than September 1, 2022, 
the National Academies shall provide the congressional de-
fense committees an interim briefing on the review under 
subsection (a). 
(d) REPORT.—Not later than March 1, 2023, the Na-
tional Academies shall submit to the Secretary and the 
congressional defense committees a report containing the 
review under subsection (a). 
SEC. 1623. REVIEW OF SAFETY, SECURITY, AND RELI-
ABILITY OF NUCLEAR WEAPONS AND RE-
LATED SYSTEMS. 
(a) FINDINGS.—Congress finds the following: 
(1) On December 20, 1990, Secretary of De-
fense Cheney chartered a five-person independent 
committee known as the Federal Advisory Com-
mittee on Nuclear Failsafe and Risk Reduction to 
assess the capability of the nuclear weapon com-
mand and control system to meet the dual require-
ments of assurance against unauthorized use of nu-
clear weapons and assurance of timely, reliable exe-
1676 
cution when authorized, and to identify opportunities 
for positive measures to enhance failsafe features. 
(2) The Federal Advisory Committee, chaired 
by Ambassador Jeane J. Kirkpatrick, recommended 
changes in the nuclear enterprise, as well as policy 
proposals to reduce the risks posed by unauthorized 
launches and miscalculation. 
(3) The Federal Advisory Committee found, un-
ambiguously, that ‘‘failsafe and oversight enhance-
ments are possible’’. 
(4) Since 1990, new threats to the nuclear en-
terprise have arisen in the cyber, space, and infor-
mation warfare domains. 
(5) Ensuring the continued assurance of the 
nuclear command, control, and communications in-
frastructure is essential to the national security of 
the United States. 
(b) REVIEW.—The Secretary of Defense shall provide 
for the conduct of an independent review of the safety, 
security, and reliability of covered nuclear systems. The 
Secretary shall ensure that such review is conducted in 
a manner similar to the review conducted by the Federal 
Advisory Committee on Nuclear Failsafe and Risk Reduc-
tion.
1677 
(c) MATTERS INCLUDED.—The review conducted 
pursuant to subsection (b) shall include the following: 
(1) Plans for modernizing the covered nuclear 
systems, including options and recommendations for 
technical, procedural, and policy measures that could 
strengthen safeguards, improve the security and reli-
ability of digital technologies, and prevent cyber-re-
lated and other risks that could lead to the unau-
thorized or inadvertent use of nuclear weapons as 
the result of an accident, misinterpretation, mis-
calculation, 
terrorism, 
unexpected 
technological 
breakthrough, or deliberate act. 
(2) Options and recommendations for nuclear 
risk reduction measures, focusing on confidence 
building and predictability, that the United States 
could carry out alone or with near-peer adversaries 
to strengthen safeguards against the unauthorized 
or inadvertent use of a nuclear weapon and to re-
duce nuclear risks. 
(d) SUBMISSION.—Not later than one year after the 
date of the enactment of this Act, the Secretary shall sub-
mit to the congressional defense committees the review 
conducted pursuant to subsection (b). 
(e) PREVIOUS REVIEW.—Not later than 30 days after 
the date of the enactment of this Act, the Secretary shall
1678 
submit to the congressional defense committees the final 
report of the Federal Advisory Committee on Nuclear 
Failsafe and Risk Reduction. 
(f) COVERED NUCLEAR SYSTEMS DEFINED.—In this 
section, the term ‘‘covered nuclear systems’’ means the fol-
lowing systems of the United States: 
(1) The nuclear weapons systems. 
(2) The nuclear command, control, and commu-
nications system. 
(3) The integrated tactical warning/attack as-
sessment system. 
SEC. 1624. REVIEW OF ENGINEERING AND MANUFAC-
TURING 
DEVELOPMENT 
CONTRACT 
FOR 
GROUND-BASED 
STRATEGIC 
DETERRENT 
PROGRAM. 
(a) FINDINGS.—Congress finds the following: 
(1) In September 2020, the Air Force awarded 
the engineering and manufacturing development con-
tract for the ground-based strategic deterrent pro-
gram. 
(2) The total development cost of the ground- 
based strategic deterrent program is expected to be 
approximately $100,000,000,000. 
(3) The Vice Chairman of the Joint Chiefs of 
Staff recently noted that ‘‘we have got to make [the
1679 
ground-based strategic deterrent program] more af-
fordable. A three-stage, solid rocket ICBM should 
not cost as much as the forecast says it costs for 
now. After meeting with the program office at Nor-
throp Grumman multiple times I think that program 
can come in significantly cheaper. It’s designed cor-
rectly. It’s a digital engineering process that should 
be able to build things quickly and much more effec-
tively.’’. 
(4) The Air Force has placed significant impor-
tance on digital engineering in achieving cost and 
schedule requirements with respect to the ground- 
based strategic deterrent program. 
(b) REVIEW.— 
(1) REQUIREMENT.—The Secretary of the Air 
Force shall provide for the conduct of a review of 
the implementation and the execution of the engi-
neering and manufacturing development contract for 
the ground-based strategic deterrent program. 
(2) MATTERS
INCLUDED.—The review under 
paragraph (1) shall include the following: 
(A) An analysis of the ability of the Air 
Force to implement industry best practices dur-
ing the engineering and manufacturing develop-
1680 
ment phase of the ground-based strategic deter-
rent program. 
(B) A review of the challenges the Air 
Force faces in implementing such industry best 
practices. 
(C) A review of the ability of the Air Force 
to leverage digital engineering during such engi-
neering and manufacturing development phase. 
(D) A review of any options that may be 
available to the Air Force to reduce cost and in-
troduce competition within the operations and 
maintenance phase of the ground-based stra-
tegic deterrent program. 
(E) Recommendations to improve the cost, 
schedule, and program management of the 
ground-based strategic deterrent program. 
(3) EXPERTISE.—The Secretary shall ensure 
that the review under paragraph (1) is conducted by 
individuals from the public and private sector, in-
cluding not fewer than two individuals— 
(A) who are not employees or officers of 
the Department of Defense or a contractor of 
the Department; and 
(B) who have experience outside of the de-
fense industry.
1681 
(4) PROVISION
OF
INFORMATION.—The Sec-
retary shall provide to the individuals conducting the 
review under paragraph (1) all information nec-
essary for the review. 
(5) SECURITY
CLEARANCES.—The Secretary 
shall ensure that each individual who conducts the 
review under paragraph (1) holds a security clear-
ance at the appropriate level for such review. 
(c) REPORT.—Not later than 270 days after the date 
of the enactment of this Act, the Secretary shall submit 
to the congressional defense committees a report con-
taining the review under subsection (b)(1). The report 
shall be submitted in unclassified form and shall include 
a classified annex. 
(d) BRIEFING.—Not later than 90 days after the date 
on which the Secretary submits the report under sub-
section (c), the Secretary shall provide to the congressional 
defense committees a briefing on implementing the rec-
ommendations contained in the review under subsection 
(b)(1). 
SEC. 1625. LONG-RANGE STANDOFF WEAPON. 
(a) LIMITATION.—The Secretary of the Air Force 
may not award a procurement contract for the long-range 
standoff weapon until the Secretary submits to the con-
gressional defense committees each of the following:
1682 
(1) An updated cost estimate for the procure-
ment portion of the long-range standoff weapon pro-
gram that is— 
(A) informed by the engineering and man-
ufacturing development contract, including with 
respect to any completed flight tests; and 
(B) independently validated by the Direc-
tor of Cost Assessment and Program Evalua-
tion. 
(2) A certification that the future-years defense 
program submitted to Congress under section 221 of 
title 10, United States Code, includes, or will in-
clude, estimated funding for the program in the 
amounts specified in the cost estimate under para-
graph (1). 
(3) A copy of the justification and approval 
documentation regarding the Secretary determining 
to award a sole-source contract for the program, in-
cluding with respect to how the Secretary will man-
age the cost of the program in the absence of com-
petition. 
(b) BRIEFING.—Not later than 90 days after the date 
of the enactment of this Act, the Secretary of the Air 
Force shall provide to the congressional defense commit-
tees a briefing on the execution of the engineering and
1683 
manufacturing development contract for the long-range 
standoff weapon, including with respect to— 
(1) how the timely development of the long- 
range standoff weapon may serve as a hedge to 
delays in other nuclear modernization efforts; 
(2) the effects of potential delays in the W80– 
4 warhead program on the ability of the long-range 
standoff weapon to achieve the initial operational ca-
pability schedule under section 217 of the National 
Defense Authorization Act for Fiscal Year 2014 
(Public Law 113–66; 127 Stat. 706), as most re-
cently amended by section 1668 of the National De-
fense Authorization Act for Fiscal Year 2020 (Pub-
lic Law 116–92; 133 Stat. 1774); 
(3) options to adjust the budget profile of the 
long-range standoff weapon program to ensure the 
program remains on schedule; 
(4) a plan to reconcile, with respect to the pro-
curement portion of the program, the Air Force 
service cost position and the estimate by the Direc-
tor of Cost Assessment and Program Evaluation; 
and 
(5) a plan to ensure best value to the United 
States for such procurement portion.
1684 
SEC. 1626. PROHIBITION ON REDUCTION OF THE INTER-
CONTINENTAL BALLISTIC MISSILES OF THE 
UNITED STATES. 
(a) PROHIBITION.—Except as provided in subsection 
(b), none of the funds authorized to be appropriated by 
this Act or otherwise made available for fiscal year 2022 
for the Department of Defense may be obligated or ex-
pended for the following, and the Department may not 
otherwise take any action to do the following: 
(1) Reduce, or prepare to reduce, the respon-
siveness or alert level of the intercontinental ballistic 
missiles of the United States. 
(2) Reduce, or prepare to reduce, the quantity 
of deployed intercontinental ballistic missiles of the 
United States to a number less than 400. 
(b) EXCEPTION.—The prohibition in subsection (a) 
shall not apply to any of the following activities: 
(1) The maintenance or sustainment of inter-
continental ballistic missiles. 
(2) Ensuring the safety, security, or reliability 
of intercontinental ballistic missiles.
1685 
SEC. 1627. LIMITATION ON AVAILABILITY OF CERTAIN 
FUNDS UNTIL SUBMISSION OF INFORMATION 
RELATING TO PROPOSED BUDGET FOR NU-
CLEAR-ARMED SEA-LAUNCHED CRUISE MIS-
SILE. 
Of the funds authorized to be appropriated by this 
Act or otherwise made available for fiscal year 2022 for 
the Department of Defense for travel by any personnel 
of the Office of the Secretary of the Navy, not more than 
75 percent may be obligated or expended until the Sec-
retary of the Navy submits to the congressional defense 
committees all written communications by personnel of the 
Department of Defense regarding the proposed budget 
amount or limitation for the nuclear-armed sea-launched 
cruise missile contained in the defense budget materials 
(as defined by section 231(f) of title 10, United States 
Code) for fiscal year 2022. 
SEC. 1628. LIMITATION ON AVAILABILITY OF CERTAIN 
FUNDS UNTIL SUBMISSION OF INFORMATION 
RELATING 
TO 
NUCLEAR-ARMED 
SEA- 
LAUNCHED CRUISE MISSILE. 
Of the funds authorized to be appropriated by this 
Act or otherwise made available for fiscal year 2022 for 
the Department of Defense for travel by any personnel 
of the Office of the Secretary of Defense (other than travel 
by the Secretary of Defense or the Deputy Secretary of
1686 
Defense), not more than 75 percent may be obligated or 
expended until the Secretary— 
(1) submits to the congressional defense com-
mittees the analysis of alternatives for the nuclear- 
armed sea-launched cruise missile; and 
(2) provides to such committees a briefing on 
such analysis of alternatives. 
SEC. 1629. ANNUAL CERTIFICATION ON READINESS OF MIN-
UTEMAN III INTERCONTINENTAL BALLISTIC 
MISSILES. 
Not later than March 1, 2022, and annually there-
after until the date on which the ground-based strategic 
deterrent weapon achieves initial operating capability, the 
Chairman of the Joint Chiefs of Staff shall certify to the 
congressional defense committees whether the state of the 
readiness of Minuteman III intercontinental ballistic mis-
siles requires placing heavy bombers equipped with nuclear 
gravity bombs or air-launched nuclear cruise missiles, and 
associated refueling tanker aircraft, on alert status. 
SEC. 1630. COST ESTIMATE TO RE-ALERT LONG-RANGE 
BOMBERS. 
(a) FINDINGS.—Congress finds the following: 
(1) On April 20th, 2021, before the Committee 
on Armed Services of the Senate, the Commander of 
the United States Strategic Command, Admiral
1687 
Charles A. Richard, said that the basic design cri-
teria in the triad is that ‘‘you cannot allow a failure 
of any one leg of the triad to prevent you from being 
able to do everything the President has ordered you 
to do.’’. 
(2) Admiral Richard further stated that in the 
event of one leg atrophying, ‘‘You are completely de-
pendent on the submarine leg, and I’ve already told 
the Secretary of Defense that under those conditions 
I would request to re-alert the bombers.’’. 
(b) COST ESTIMATE.—The Secretary of the Air 
Force shall develop a cost estimate with respect to re- 
alerting long-range bombers in the absence of a ground- 
based leg of the nuclear triad. 
SEC. 1631. NOTIFICATION REGARDING INTERCONTINENTAL 
BALLISTIC MISSILES OF CHINA. 
(a) REQUIREMENT.—If the Commander of the 
United States Strategic Command determines that the 
number of intercontinental ballistic missiles in the active 
inventory of China exceeds the number of intercontinental 
ballistic missiles in the active inventory of the United 
States, or that the number of nuclear warheads equipped 
on such missiles of China exceeds the number of nuclear 
warheads equipped on such missiles of the United States,
1688 
the Commander shall submit to the congressional defense 
committees— 
(1) a notification of such determination; 
(2) an assessment of the composition of the 
intercontinental ballistic missiles of China, including 
the types of nuclear warheads equipped on such mis-
siles; and 
(3) a strategy for deterring China. 
(b) FORM.—The notification under paragraph (1) of 
subsection (a) shall be submitted in unclassified form, and 
the assessment and strategy under paragraphs (2) and (3) 
of such subsection may be submitted in classified form. 
(c) TERMINATION.—The requirement under sub-
section (a) shall terminate on the date that is four years 
after the date of the enactment of this Act. 
SEC. 1632. INFORMATION REGARDING REVIEW OF MINUTE-
MAN III SERVICE LIFE EXTENSION PROGRAM. 
(a) REQUIREMENT.—The Secretary of Defense shall 
submit to the congressional defense committees all scoping 
documents relating to any covered review, including the 
names, titles, and backgrounds of the individuals of the 
federally funded research and development center who are 
conducting the review. The Secretary shall submit such 
information by the date that is the later of the following:
1689 
(1) 15 days after the date on which the covered 
review is initiated. 
(2) 15 days after the date of the enactment of 
this Act. 
(b) COVERED REVIEW.—In this section, the term 
‘‘covered review’’ means any review initiated in 2021 or 
2022 by a federally funded research and development cen-
ter regarding a service life extension program for Minute-
man III intercontinental ballistic missiles. 
SEC. 1633. SENSE OF CONGRESS REGARDING NUCLEAR 
POSTURE REVIEW. 
It is the sense of Congress that the nuclear posture 
review initiated in 2021 should address the following: 
(1) An assessment of the current and projected 
nuclear capabilities of Russia and China; 
(2) the role of nuclear forces in United States 
military strategy, planning, and programming; 
(3) the relationship between deterrence, tar-
geting, and arms control; 
(4) the role of missile defenses, conventional 
strike forces, and other capabilities play in deter-
mining the role and size of nuclear forces; 
(5) the levels and composition of nuclear deliv-
ery systems required to implement national strategy;
1690 
(6) the nuclear weapons complex required to 
implement such strategy, including with respect to 
modernization; and 
(7) the active and inactive nuclear weapons 
stockpile required to implement such strategy, in-
cluding with respect to the replacement and modi-
fication of nuclear weapons. 
SEC. 1634. REPORT ON GLOBAL NUCLEAR LEADERSHIP OF 
THE UNITED STATES. 
(a) REQUIREMENT.—Not later than one year after 
the date of the enactment of this Act, the Secretary of 
Energy, in consultation with the Secretary of State, the 
Secretary of Defense, the Chairman of the Nuclear Regu-
latory Commission, the Director of National Intelligence, 
and the Secretary of Commerce, shall submit to the appro-
priate congressional committees a report analyzing— 
(1) the opportunities for advancing the interests 
of the United States with respect to global nuclear 
safety, nuclear security, and nuclear nonprolifera-
tion; and 
(2) the risks to such interests of the United 
States, and the risks to wider foreign policy influ-
ence by the United States, posed by the dominance 
of Russia in the global nuclear energy market and 
the increasing supply by China to such market.
1691 
(b) MATTERS INCLUDED.—The report under sub-
section (a) shall include the following: 
(1) An assessment of the historical role of civil 
nuclear cooperation agreements and supply arrange-
ments made pursuant to the Atomic Energy Act of 
1954 (42 U.S.C. 2011 et seq.) in influencing the 
policies and practices of foreign governments con-
cerning nuclear safety, nuclear security, and nuclear 
nonproliferation, and the wider foreign policy inter-
ests, including— 
(A) a description of possible opportunities 
for using nuclear cooperation agreements and 
related exports to improve nuclear safety, nu-
clear security, and nuclear nonproliferation, and 
the foreign policy interests of the United States; 
(B) a description of potential risks associ-
ated with such agreements and nuclear exports; 
and 
(C) a description of the potential market 
for small and advanced reactor technologies. 
(2) An assessment of the competitiveness of the 
United States against Russia and China in the glob-
al nuclear energy market, including— 
(A) a comparison of nuclear reactor re-
search and design by Russia and China with
1692 
analogous research and design by the United 
States; 
(B) a comparison of the ability of Russia 
and China to produce and export nuclear tech-
nology with analogous abilities of the United 
States; 
(C) a description of the factors enabling 
progress made by Russia and China regarding 
civil nuclear technology; 
(D) a comparison of the export policies of 
the United States with regard to civil nuclear 
technology, including the role, if any, of finan-
cial support, with such policies of Russia and 
China; 
(E) a list of specific reactor designs, in-
cluding fuel characteristics, that Russia and 
China have offered for export; and 
(F) details of any agreements made by 
Russia or China for exporting nuclear tech-
nology, including the duration, purchase price, 
potential profitability, any provisions regarding 
spent fuel take back, related regulatory support, 
and any other elements that compromise a com-
petitive offer.
1693 
(3) An assessment, if applicable, of the means 
by which Russia or China uses foreign-origin dual- 
use nuclear technology for military purposes. 
(4) Recommendations for regulatory or legisla-
tive actions for developing a robust free-enterprise 
response designed to improve the competitiveness of 
the United States in the global nuclear energy mar-
ket. 
(c) APPROPRIATE CONGRESSIONAL COMMITTEES DE-
FINED.—In this section, the term ‘‘appropriate congres-
sional committees’’ means— 
(1) the congressional defense committees; 
(2) the Committee on Energy and Natural Re-
sources, the Committee on Foreign Relations, and 
the Select Committee on Intelligence of the Senate; 
and 
(3) the Committee on Energy and Commerce, 
the Committee on Foreign Affairs, and the Perma-
nent Select Committee on Intelligence of the House 
of Representatives. 
Subtitle D—Missile Defense 
Programs 
SEC. 1641. DIRECTED ENERGY PROGRAMS FOR BALLISTIC 
AND HYPERSONIC MISSILE DEFENSE. 
(a) FINDINGS.—Congress finds the following:
1694 
(1) In the fiscal year 2021 budget request of 
the Department of Defense, the Secretary of De-
fense removed all funding from the Missile Defense 
Agency to conduct research, engineering, or develop-
ment for directed energy technologies that could be 
applicable for ballistic and hypersonic missile de-
fense, and this removal of funding continued in the 
fiscal year 2022 budget request of the Department, 
despite Congress appropriating funding for fiscal 
year 2021 for these efforts. 
(2) In January 2020, an independent Senior 
Executive Review Team noted that ‘‘If successfully 
developed, the unique features of diode pumped al-
kali laser, an efficient electrically powered, relatively 
short wavelength gas laser with the potential to de-
liver megawatt power with near diffraction limited 
beam quality from a single aperture would provide 
the Department of Defense and the Missile Defense 
Agency with an important strategic technology with 
the potential for an attractive size, weight, and 
power. Such a system would have potential capa-
bility use cases across all services/agencies.’’. How-
ever, the Under Secretary of Defense for Research 
and Engineering did not support continued inves-
1695 
tigation of this promising technology by the Missile 
Defense Agency. 
(3) In addition to diode pumped alkali lasers, 
there are other directed energy applications that 
have the potential to contribute to ballistic and 
hypersonic missile defense architecture, including 
microwave and short pulse lasers technologies. 
(b) SENSE OF CONGRESS.—It is the sense of Con-
gress that the Director of the Missile Defense Agency 
should continue to fund promising directed energy tech-
nologies for ballistic and hypersonic missile defense, in co-
ordination with the directed energy roadmap of the Under 
Secretary of Defense for Research and Engineering, with 
the intent to transfer technologies to the military depart-
ments as appropriate. 
(c) AUTHORITY OF THE MISSILE DEFENSE AGEN-
CY.— 
(1) DELEGATION.—The Secretary of Defense 
shall delegate to the Director of the Missile Defense 
Agency the authority to budget for, direct, and man-
age directed energy programs applicable for ballistic 
and hypersonic missile defense missions, in coordina-
tion with other directed energy efforts of the De-
partment of Defense.
1696 
(2) PRIORITIZATION.—In budgeting for and di-
recting directed energy programs applicable for bal-
listic and hypersonic defensive missions pursuant to 
paragraph (1), the Director of the Missile Defense 
Agency shall— 
(A) prioritize the early research and devel-
opment of technologies; and 
(B) address the transition of such tech-
nologies to industry to support future oper-
ationally relevant capabilities. 
SEC. 1642. NOTIFICATION OF CHANGES TO NON-STANDARD 
ACQUISITION AND REQUIREMENTS PROC-
ESSES AND RESPONSIBILITIES OF MISSILE 
DEFENSE AGENCY. 
(a) NOTICE AND WAIT.— 
(1) REQUIREMENT.—The Secretary of Defense 
may not make any changes to the missile defense 
non-standard acquisition and requirements processes 
and responsibilities described in paragraph (2) until 
the Secretary, without delegation, on or after the 
date of the enactment of this Act— 
(A) has consulted with the Under Sec-
retary of Defense for Research and Engineer-
ing, the Under Secretary of Defense for Acqui-
sition and Sustainment, the Under Secretary of
1697 
Defense for Policy, the Secretaries of the mili-
tary departments, the Chairman of the Joint 
Chiefs of Staff, the Commander of the United 
States Strategic Command, the Commander of 
the United States Northern Command, and the 
Director of the Missile Defense Agency; 
(B) certifies to the congressional defense 
committees that the Secretary has coordinated 
the changes with, and received the views of, the 
individuals referred to in subparagraph (A); 
(C) submits to the congressional defense 
committees a report that contains— 
(i) a description of the changes, the 
rationale for the changes, and the views of 
the individuals referred to in subparagraph 
(A) with respect to such changes; 
(ii) a certification that the changes 
will not impair the missile defense capabili-
ties of the United States nor degrade the 
unique special acquisition authorities of the 
Missile Defense Agency; and 
(iii) with respect to any such changes 
to 
Department 
of 
Defense 
Directive 
5134.09, a final draft of the proposed
1698 
modified directive, both in an electronic 
format and in a hard copy format; 
(D) with respect to any such changes to 
Department of Defense Directive 5134.09, pro-
vides to such committees a briefing on the pro-
posed modified directive described in subpara-
graph (C)(ii); and 
(E) a period of 120 days has elapsed fol-
lowing the date on which the Secretary submits 
the report under subparagraph (C). 
(2) NON-STANDARD
ACQUISITION
AND
RE-
QUIREMENTS
PROCESSES
AND
RESPONSIBILITIES 
DESCRIBED.—The non-standard acquisition and re-
quirements processes and responsibilities described 
in this paragraph are such processes and responsibil-
ities described in— 
(A) the memorandum of the Secretary of 
Defense titled ‘‘Missile Defense Program Direc-
tion’’ signed on January 2, 2002; 
(B) Department of Defense Directive 
5134.09, as in effect on the date of the enact-
ment of this Act; and 
(C) United States Strategic Command In-
struction 538–3 titled ‘‘MD Warfighter Involve-
ment Process’’.
1699 
(b) CONFORMING AMENDMENTS.— 
(1) FY20 NDAA.—Section 1688 of the National 
Defense Authorization Act for Fiscal Year 2020 
(Public Law 116– 92; 133 Stat. 1787) is amended— 
(A) by striking subsection (b); and 
(B) by redesignating subsection (c) as sub-
section (b). 
(2) FY21 NDAA.—Section 1641 of the William 
M. (Mac) Thornberry National Defense Authoriza-
tion Act for Fiscal Year 2021 (Public Law 116– 
283; 134 Stat. 4061) is amended— 
(A) by striking subsection (c); and 
(B) by redesignating subsection (d) as sub-
section (c). 
SEC. 1643. MISSILE DEFENSE RADAR IN HAWAII. 
(a) SENSE OF CONGRESS.—It is the sense of Con-
gress that— 
(1) Hawaii should have discrimination radar 
coverage against intercontinental ballistic missiles 
that is equivalent to such coverage provided to the 
contiguous United States and Alaska once the long 
range discrimination radar achieves operational ca-
pability at Clear Air Force Base, Alaska; and 
(2) to achieve such equivalent discrimination 
radar coverage, the Secretary of Defense, acting
1700 
through the Director of the Missile Defense Agency, 
should— 
(A) restore the discrimination radar for 
homeland defense planned to be located in Ha-
waii; and 
(B) request adequate funding for the radar 
in the future-years defense program submitted 
to Congress under section 221 of title 10, 
United States Code, for the radar to achieve 
operational capability by not later than Decem-
ber 31, 2028, when the next generation inter-
ceptor is anticipated to achieve initial operating 
capability. 
(b) CERTIFICATION.—As a part of the defense budget 
materials (as defined in section 239 of title 10, United 
States Code) for fiscal year 2023, the Director of the Mis-
sile Defense Agency shall certify to the congressional de-
fense committees that— 
(1) the future-years defense program submitted 
to Congress under section 221 of title 10, United 
States Code, in 2022 includes adequate amounts of 
estimated funding to develop, construct, test, and in-
tegrate into the missile defense system the discrimi-
nation radar for homeland defense planned to be lo-
cated in Hawaii; and
1701 
(2) such radar and associated in-flight inter-
ceptor communications system data terminal will be 
operational by not later than December 31, 2028. 
SEC. 1644. GUAM INTEGRATED AIR AND MISSILE DEFENSE 
SYSTEM. 
(a) ARCHITECTURE
AND ACQUISITION.—The Sec-
retary of Defense shall identify the architecture and acqui-
sition approach for implementing a 360-degree integrated 
air and missile defense capability to defend the people, in-
frastructure, and territory of Guam from advanced cruise, 
ballistic, and hypersonic missile threats. 
(b) REQUIREMENTS.—The architecture identified 
under subsection (a) shall have the ability to— 
(1) integrate numerous multi-domain sensors, 
interceptors, and command and control systems 
while maintaining high kill chain performance 
against advanced threats; 
(2) address robust discrimination and electro-
magnetic compatibility with other sensors; 
(3) engage directly, or coordinate engagements 
with other integrated air and missile defense sys-
tems, to defeat the spectrum of cruise, ballistic, and 
hypersonic threats; 
(4) leverage existing programs of record to ex-
pedite the development and deployment of the archi-
1702 
tecture during the five-year period beginning on the 
date of the enactment of this Act, with an objective 
of achieving initial operating capability in 2025, in-
cluding with respect to— 
(A) the Aegis ballistic missile defense sys-
tem; 
(B) standard missile–3 and –6 variants; 
(C) the terminal high altitude area defense 
system; 
(D) the Patriot air and missile defense sys-
tem; 
(E) the integrated battle control system; 
and 
(F) the lower tier air and missile defense 
sensor and other lower tier capabilities, as ap-
plicable; 
(5) integrate future systems and interceptors 
that have the capability to defeat hypersonic missiles 
in the glide and terminal phases, including integra-
tion of passive measures to protect assets in Guam; 
and 
(6) incentivize competition within the acquisi-
tion of the architecture and rapid procurement and 
deployment wherever possible.
1703 
(c) REPORT.—Not later than 60 days after the date 
of the enactment of this Act, the Secretary shall submit 
to the congressional defense committees a report on the 
architecture and acquisition approach identified under 
subsection (a). 
SEC. 1645. LIMITATION ON AVAILABILITY OF FUNDS UNTIL 
RECEIPT OF CERTAIN REPORT ON GUAM. 
Of the funds authorized to be appropriated by this 
Act or otherwise made available for fiscal year 2022 for 
the Department of Defense for the Office of Cost Assess-
ment and Program Evaluation, not more than 75 percent 
may be obligated or expended until the date on which the 
Secretary of Defense submits to the congressional defense 
committees the report on the defense of Guam from inte-
grated air and missile threats required by section 1650 
of the William M. (Mac) Thornberry National Defense Au-
thorization Act for Fiscal Year 2021(Public Law 116– 
283). 
SEC. 1646. REPEAL OF TRANSITION OF BALLISTIC MISSILE 
DEFENSE PROGRAMS TO MILITARY DEPART-
MENTS. 
Section 1676 of the National Defense Authorization 
Act for Fiscal Year 2018 (Public Law 115–91; 10 U.S.C. 
2431 note) is amended by striking subsection (b).
1704 
SEC. 1647. CERTIFICATION REQUIRED FOR RUSSIA AND 
CHINA TO TOUR CERTAIN MISSILE DEFENSE 
SITES. 
(a) CERTIFICATION.—Before the Secretary of De-
fense makes a determination with respect to allowing a 
foreign national of Russia or China to tour a covered site, 
the Secretary shall submit to the congressional defense 
committees a certification that— 
(1) the Secretary has determined that such tour 
is in the national security interest of the United 
States, including the justifications for such deter-
mination; and 
(2) the Secretary will not share any technical 
data relating to the covered site with the foreign na-
tionals. 
(b) TIMING.—The Secretary may not conduct a tour 
described in subsection (a) until a period of 45 days has 
elapsed following the date on which the Secretary submits 
the certification for that tour under such subsection. 
(c) COVERED SITE.—In this section, the term ‘‘cov-
ered site’’ means any of the following: 
(1) The combat information center of a naval 
ship equipped with the Aegis ballistic missile defense 
system. 
(2) An Aegis Ashore site.
1705 
(3) A terminal high altitude area defense bat-
tery. 
(4) A ground-based midcourse defense inter-
ceptor silo. 
SEC. 1648. SENSE OF CONGRESS ON NEXT GENERATION IN-
TERCEPTOR PROGRAM. 
It is the sense of Congress that— 
(1) in accordance with the national missile de-
fense policy under section 1681 of the National De-
fense Authorization Act for Fiscal Year 2017 (Pub-
lic Law 114– 328; 10 U.S.C. 2431 note), it is in the 
national security interest of the United States to de-
sign, test, and begin deployment of the next genera-
tion interceptor by not later than September 30, 
2028; and 
(2) the Secretary of Defense should— 
(A) maintain competition for the next gen-
eration interceptor program through, at a min-
imum, the critical design reviews of the pro-
gram; 
(B) uphold ‘‘fly before you buy’’ principals 
in carrying out such program; 
(C) continue to incorporate lessons learned 
from the redesigned kill vehicle program to 
avoid any similar technical issues; and
1706 
(D) continue to maintain continuous en-
gagement with the intelligence community to 
ensure the next generation interceptor program 
is outpacing intercontinental ballistic missile 
threats to the homeland of the United States 
posed by rogue nations. 
SEC. 1649. STUDIES BY PRIVATE SCIENTIFIC ADVISORY 
GROUP KNOWN AS JASON. 
(a) STUDY ON DISCRIMINATION CAPABILITIES OF 
THE BALLISTIC MISSILE DEFENSE SYSTEM.— 
(1) FINDINGS.—Congress finds the following: 
(A) Section 237 of the National Defense 
Authorization Act for Fiscal Year 2010 (Public 
Law 111–84; 123 Stat. 2236) required the Sec-
retary of Defense to enter into an arrangement 
with the private scientific advisory group known 
as JASON under which JASON carried out a 
study on the discrimination capabilities and lim-
itations of the ballistic missile defense system of 
the United States. 
(B) Since the completion of this study, 
rogue nation threats have changed and capabili-
ties of the missile defense system have evolved. 
(2) UPDATE.—The Secretary of Defense shall 
enter into an arrangement with the private scientific
1707 
advisory group known as JASON under which 
JASON shall carry out an update to the study con-
ducted pursuant to section 237 of the National De-
fense Authorization Act for Fiscal Year 2010 (Pub-
lic Law 111–84; 123 Stat. 2236) on the discrimina-
tion capabilities and limitations of the missile de-
fense system of the United States, including such 
discrimination capabilities that exist or are planned 
as of the date of the study. 
(3) REPORT.—Not later than one year after the 
date of enactment of this Act, the Secretary shall 
submit to the appropriate congressional committees 
a report containing the study. 
(4) FORM.—The report under paragraph (2) 
may be submitted in classified form, but shall con-
tain an unclassified summary. 
(b) REPORT ON JASON.—Not later than 90 days 
after the date of the enactment of this Act, the Under 
Secretary of Defense for Acquisition and Sustainment 
shall submit to the congressional defense committees a re-
port on the private scientific advisory group known as 
JASON. The report shall include the following: 
(1) The status of the contract awarded by the 
Secretary of Defense to JASON.
1708 
(2) Identification of the studies undertaken by 
JASON during the two fiscal years occurring before 
the date of the report. 
(3) The level of funding required to ensure the 
continued ability of JASON to provide high-quality 
technical, scientifically informed advice to the De-
partment of Defense and the broader United States 
Government. 
(4) Whether the Under Secretary is committed 
to ensuring adequate funding and continued depart-
mental support for JASON. 
(5) Any impediments encountered by the Under 
Secretary in continuing to contract with JASON. 
SEC. 1650. REPORT ON SENIOR LEADERSHIP OF MISSILE 
DEFENSE AGENCY. 
Not later than 60 days after the date of the enact-
ment of this Act, the Director of the Missile Defense 
Agency shall submit to the congressional defense commit-
tees a report detailing the following: 
(1) The responsibilities of the positions of the 
Director, Sea-based Weapons Systems, and the Dep-
uty Director of the Missile Defense Agency. 
(2) The role of the officials who occupy these 
positions with respect to the functional combatant 
commands with missile defense requirements.
1709 
(3) The rationale and benefit of having an offi-
cial in these positions who is a general officer or flag 
officer versus a civilian. 
SEC. 1650A. SENSE OF CONGRESS ON AEGIS ASHORE SITES 
IN POLAND AND ROMANIA. 
It is the sense of Congress that— 
(1) both Poland and Romania, which host Aegis 
Ashore sites of the United States, are vital allies of 
the United States; 
(2) the contributions provided by these Aegis 
Ashore sites help ensure the defenses of Poland, Ro-
mania, the United States, and the member states of 
the North Atlantic Treaty Organization; and 
(3) it is vital that the construction of the Aegis 
Ashore site in Redzikowo, Poland, is completed and 
brought online at the earliest possible date. 
Subtitle E—Other Matters 
SEC. 1651. COOPERATIVE THREAT REDUCTION FUNDS. 
(a) FUNDING ALLOCATION.—Of the $344,849,000 
authorized to be appropriated to the Department of De-
fense for fiscal year 2022 in section 301 and made avail-
able by the funding table in division D for the Department 
of Defense Cooperative Threat Reduction Program estab-
lished under section 1321 of the Department of Defense 
Cooperative Threat Reduction Act (50 U.S.C. 3711), the
1710 
following amounts may be obligated for the purposes spec-
ified: 
(1) For strategic offensive arms elimination, 
$2,997,000. 
(2) For chemical security and elimination, 
$13,250,000. 
(3) For global nuclear security, $17,767,000. 
(4) 
For 
biological 
threat 
reduction, 
$124,022,000. 
(5) For proliferation prevention, $58,754,000. 
(6) For activities designated as Other Program 
Support, $23,059,000. 
(b) SPECIFICATION OF COOPERATIVE THREAT RE-
DUCTION FUNDS.—Funds appropriated pursuant to the 
authorization of appropriations in section 301 and made 
available by the funding table in division D for the Depart-
ment of Defense Cooperative Threat Reduction Program 
shall be available for obligation for fiscal years 2022, 
2023, and 2024. 
SEC. 1652. ESTABLISHMENT OF OFFICE TO ADDRESS UN-
IDENTIFIED AERIAL PHENOMENA. 
(a) ESTABLISHMENT.—Not later than 180 days after 
the date of the enactment of this Act, the Secretary of 
Defense, in coordination with the Director of National In-
telligence, shall establish an office within the Office of the
1711 
Secretary of Defense to carry out, on a Department-wide 
basis, the mission currently performed by the Unidentified 
Aerial Phenomenon Task Force as of the date of the en-
actment of this Act. 
(b) DUTIES.—The duties of the office established 
under subsection (a) shall include the following: 
(1) Developing procedures to synchronize and 
standardize the collection, reporting, and analysis of 
incidents regarding unidentified aerial phenomena 
across the Department of Defense. 
(2) Developing processes and procedures to en-
sure that such incidents from each military depart-
ment are reported and incorporated in a centralized 
repository. 
(3) Establishing procedures to require the time-
ly and consistent reporting of such incidents. 
(4) Evaluating links between unidentified aerial 
phenomena and adversarial foreign governments, 
other foreign governments, or nonstate actors. 
(5) Evaluating the threat that such incidents 
present to the United States. 
(6) Coordinating with other departments and 
agencies of the Federal Government, as appropriate.
1712 
(7) Coordinating with allies and partners of the 
United States, as appropriate, to better assess the 
nature and extent of unidentified aerial phenomena. 
(c) ANNUAL REPORT.— 
(1) REQUIREMENT.—Not later than December 
31, 2022, and annually thereafter until December 
31, 2026, the Secretary of Defense shall submit to 
the appropriate congressional committees a report 
on unidentified aerial phenomena. 
(2) ELEMENTS.—Each report under paragraph 
(1) shall include, with respect to the year covered by 
the report, the following information: 
(A) An analysis of data and intelligence re-
ceived through reports of unidentified aerial 
phenomena. 
(B) An analysis of data relating to uniden-
tified aerial phenomena collected through— 
(i) geospatial intelligence; 
(ii) signals intelligence; 
(iii) human intelligence; and 
(iv) measurement and signals intel-
ligence. 
(C) The number of reported incidents of 
unidentified aerial phenomena over restricted 
air space of the United States.
1713 
(D) An analysis of such incidents identified 
under subparagraph (C). 
(E) Identification of potential aerospace or 
other threats posed by unidentified aerial phe-
nomena to the national security of the United 
States. 
(F) An assessment of any activity regard-
ing unidentified aerial phenomena that can be 
attributed to one or more adversarial foreign 
governments. 
(G) Identification of any incidents or pat-
terns regarding unidentified aerial phenomena 
that indicate a potential adversarial foreign gov-
ernment may have achieved a breakthrough 
aerospace capability. 
(H) An update on the coordination by the 
United States with allies and partners on ef-
forts to track, understand, and address uniden-
tified aerial phenomena. 
(I) An update on any efforts underway on 
the ability to capture or exploit discovered un-
identified aerial phenomena. 
(J) An assessment of any health-related ef-
fects for individuals that have encountered un-
identified aerial phenomena.
1714 
(d) TASK FORCE.—Not later than the date on which 
the Secretary establishes the office under subsection (a), 
the Secretary shall terminate the Unidentified Aerial Phe-
nomenon Task Force. 
(e) DEFINITIONS.—In this section: 
(1) The term ‘‘appropriate congressional com-
mittees’’ means the following: 
(A) The Committee on Armed Services, the 
Committee on Foreign Affairs, and the Perma-
nent Select Committee on Intelligence of the 
House of Representatives. 
(B) The Committee on Armed Services, 
the Committee on Foreign Relations, and the 
Select Committee on Intelligence of the Senate. 
(2) The term ‘‘unidentified aerial phenomena’’ 
means airborne objects witnessed by a pilot or air-
crew member that are not immediately identifiable. 
SEC. 1653. MATTERS REGARDING INTEGRATED DETER-
RENCE REVIEW. 
(a) REPORTS.—Not later than 30 days after the date 
on which the Integrated Deterrence Review that com-
menced during 2021 is submitted to the congressional de-
fense committees, the Secretary of Defense shall submit 
to the congressional defense committees the following:
1715 
(1) Each report, assessment, and guidance doc-
ument produced by the Department of Defense pur-
suant to the Integrated Deterrence Review or during 
subsequent actions taken to implement the conclu-
sions of the Integrated Deterrence Review, including 
with respect to each covered review. 
(2) A report explaining how each such covered 
review differs from the previous such review. 
(b) CERTIFICATIONS.—Not later than 30 days after 
the date on which a covered review is submitted to the 
congressional defense committees, the Chairman of the 
Joint Chiefs of Staff, the Vice Chairman of the Joint 
Chiefs of Staff, and the Commander of the United States 
Strategic Command shall each directly submit to such 
committees— 
(1) a certification regarding whether the Chair-
man, Vice Chairman, or Commander, as the case 
may be, had the opportunity to provide input into 
the covered review; and 
(2) a description of the degree to which the cov-
ered reviews differ from the military advice con-
tained in such input (or, if there was no opportunity 
to provide such input, would have been contained in 
the input if so provided).
1716 
(c) COVERED REVIEW DEFINED.—In this section, 
the term ‘‘covered review’’ means— 
(1) the Missile Defense Review that commenced 
during 2021; and 
(2) the Nuclear Posture Review that com-
menced during 2021. 
SEC. 1654. SENSE OF CONGRESS ON INDEMNIFICATION AND 
THE 
CONVENTIONAL 
PROMPT 
GLOBAL 
STRIKE WEAPON SYSTEM. 
It is the sense of Congress that— 
(1) the conventional prompt global strike weap-
on system of the Navy, for which the Secretary of 
the Navy has declined to provide indemnification, 
will have more than twice the TNT equivalent of the 
bomb used in the 1993 World Trade Center bomb-
ing that resulted in many casualties and more than 
$3,300,000,000 in insurance claims in 2021 dol-
lars—an amount that is $1,100,000,000 greater 
than the insurance limits currently available from 
private insurance underwriters; 
(2) the term ‘‘unusually hazardous’’ used in Ex-
ecutive Order 10789, as amended, pursuant to pub-
lic Law 85–804 (50 U.S.C. 1431 et seq.) should be 
objectively and consistently applied to weapons sys-
tems and programs whose physical properties inher-
1717 
ently possess substantial explosive energy whose 
misapplication or accidental ignition could result in 
catastrophic material destruction and human inju-
ries and deaths; 
(3) an inconsistent and arbitrary application of 
such Executive Order and law may create significant 
risk for the industrial base and loss of critical de-
fense capabilities; and 
(4) the Secretary of the Navy should— 
(A) take maximum practicable advantage 
of existing statutory authority to provide in-
demnification for large rocket programs employ-
ing ‘‘unusually hazardous’’ propulsion systems 
for both nuclear and non-nuclear strategic sys-
tems; and 
(B) develop a policy for more consistently 
applying such authority. 
SEC. 1655. DECLASSIFICATION REVIEW RELATING TO 
TESTS IN THE MARSHALL ISLANDS. 
(a) REQUIREMENT.—The Secretary of Defense, in 
coordination with the Secretary of Energy, shall conduct 
a declassification review of documents relating to nuclear, 
ballistic missile, or chemical weapons tests conducted by 
the United States in the Marshall Islands, including with