478 
† HR 4310 PP
gram or related program more than one year apart, 
an identification of— 
‘‘(A) the measures the Under Secretary is 
taking or is planning to take to improve the in-
tegration of those schedules; and 
‘‘(B) the risks and challenges that impede 
the ability of the Department of Defense to fully 
integrate those schedules. 
‘‘(c) CONSIDERATION BY MILESTONE DECISION AU-
THORITY.—The Milestone Decision Authority shall include 
the report required by subsection (a) with respect to a major 
satellite acquisition program as part of the documentation 
used to approve the acquisition of the program. 
‘‘(d) SUBMITTAL OF REPORTS.—(1) In the case of a 
major satellite acquisition program initiated before the date 
of the enactment of the National Defense Authorization Act 
for Fiscal Year 2013, the Under Secretary shall submit the 
report required by subsection (a) with respect to the pro-
gram not later than one year after such date of enactment. 
‘‘(2) In the case of a major satellite acquisition pro-
gram initiated on or after the date of the enactment of the 
National Defense Authorization Act for Fiscal Year 2013, 
the Under Secretary shall submit the report required by 
subsection (a) with respect to the program at the time of 
the Milestone B approval of the program. 
VerDate Mar 15 2010 
01:32 Dec 07, 2012
Jkt 029200
PO 00000
Frm 00478
Fmt 6652
Sfmt 6203
E:\SENENR\H4310.PP
H4310
rfrederick on DSK6VPTVN1PROD with
479 
† HR 4310 PP
‘‘(e) NOTIFICATION
TO
CONGRESS
OF
NON-INTE-
GRATED ACQUISITION AND CAPABILITY DELIVERY SCHED-
ULES.—If, after submitting the report required by sub-
section (a) with respect to a major satellite acquisition pro-
gram, the Under Secretary determines that the schedules for 
the acquisition and the delivery of the capabilities of the 
components for the program, or a related program referred 
to in subsection (b)(1), provide for the acquisition or the 
delivery of the capabilities of at least two of the three com-
ponents for the program or related program more than one 
year apart, the Under Secretary shall, not later than 30 
days after making that determination, submit to the con-
gressional defense committees a report— 
‘‘(1) notifying the committees of that determina-
tion; and 
‘‘(2) identifying the measures the Under Sec-
retary is taking or is planning to take to improve the 
integration of those schedules. 
‘‘(f) DEFINITIONS.—In this section: 
‘‘(1) COMPONENTS.—The term ‘components’, 
with respect to a major satellite acquisition program, 
refers to any satellites acquired under the program 
and the ground equipment and user terminals nec-
essary for the operation of those satellites. 
VerDate Mar 15 2010 
01:32 Dec 07, 2012
Jkt 029200
PO 00000
Frm 00479
Fmt 6652
Sfmt 6203
E:\SENENR\H4310.PP
H4310
rfrederick on DSK6VPTVN1PROD with
480 
† HR 4310 PP
‘‘(2) 
MAJOR
SATELLITE
ACQUISITION
PRO-
GRAM.—The term ‘major satellite acquisition pro-
gram’ means a major defense acquisition program (as 
defined in section 2430 of this title) for the acquisi-
tion of a satellite. 
‘‘(3) MILESTONE B APPROVAL.—The term ‘Mile-
stone B approval’ has the meaning given that term in 
section 2366(e)(7) of this title.’’. 
(b) CLERICAL AMENDMENT.—The table of sections at 
the beginning of chapter 135 of such title, as so amended, 
is further amended by adding at the end the following new 
item: 
‘‘2276. Reports on integration of acquisition and capability delivery schedules for 
components for major satellite acquisition programs and funding 
for such programs.’’. 
SEC. 914. DEPARTMENT OF DEFENSE REPRESENTATION IN 
DISPUTE 
RESOLUTION 
REGARDING 
SUR-
RENDER 
OF 
DEPARTMENT 
OF 
DEFENSE 
BANDS 
OF 
ELECTROMAGNETIC 
FRE-
QUENCIES. 
Section 1062(b)(1) of the National Defense Authoriza-
tion Act for Fiscal Year 2000 (Public Law 106–65; 113 
Stat. 768; 47 U.S.C. 921 note) is amended— 
(1) in subparagraph (A), by striking ‘‘and’’ at 
the end; 
(2) in subparagraph (B), by striking the period 
at the end and inserting ‘‘; and’’; and 
VerDate Mar 15 2010 
01:32 Dec 07, 2012
Jkt 029200
PO 00000
Frm 00480
Fmt 6652
Sfmt 6203
E:\SENENR\H4310.PP
H4310
rfrederick on DSK6VPTVN1PROD with
481 
† HR 4310 PP
(3) by adding at the end the following new sub-
paragraph: 
‘‘(C) in the event of any dispute resolution 
process involving the surrender of use of such 
band, the Department of Defense has adequate 
representation to convey its views.’’. 
Subtitle C—Intelligence-Related 
and Cyber Matters 
SEC. 921. AUTHORITY TO PROVIDE GEOSPATIAL INTEL-
LIGENCE SUPPORT TO SECURITY ALLIANCES 
AND INTERNATIONAL AND REGIONAL ORGA-
NIZATIONS. 
(a) EXTENSION OF AUTHORITY TO SECURITY ALLI-
ANCES
AND INTERNATIONAL
AND REGIONAL ORGANIZA-
TIONS.—Section 443(a) of title 10, United States Code, is 
amended by inserting ‘‘, regional organizations with defense 
or security components, and international organizations 
and security alliances of which the United States is a mem-
ber’’ after ‘‘foreign countries’’. 
(b) CONFORMING AND CLERICAL AMENDMENTS.— 
(1) HEADING AMENDMENT.—The heading of sec-
tion 443 of such title is amended to read as follows: 
VerDate Mar 15 2010 
01:32 Dec 07, 2012
Jkt 029200
PO 00000
Frm 00481
Fmt 6652
Sfmt 6203
E:\SENENR\H4310.PP
H4310
rfrederick on DSK6VPTVN1PROD with
482 
† HR 4310 PP
‘‘§ 443. Imagery intelligence and geospatial informa-
tion: support for foreign countries, secu-
rity alliances, and international and re-
gional organizations’’. 
(2) TABLE OF SECTIONS.—The table of sections 
at the beginning of subchapter I of chapter 22 of such 
title is amended by striking the item relating to sec-
tion 443 and inserting the following new item: 
‘‘443. Imagery intelligence and geospatial information: support for foreign coun-
tries, security alliances, and international and regional organi-
zations.’’. 
SEC. 922. ARMY DISTRIBUTED COMMON GROUND SYSTEM. 
(a) ASSIGNMENT
OF RESPONSIBILITY
FOR OVER-
SIGHT.—The Secretary of the Army shall assign responsi-
bility for oversight of the development, acquisition, testing, 
and fielding of the Distributed Common Ground System 
(DCGS) cloud computing program of the Army to the Chief 
Information Officer of the Army ((CIO)/G–6). 
(b) REVIEW OF PROGRAM.— 
(1) IN GENERAL.—Not later than December 1, 
2012, the Chief Information Officer shall submit to 
the Secretary a report on a review of the Distributed 
Common Ground System cloud computing program of 
the Army conducted by the Chief Information Officer 
for purposes of this section. 
(2) ELEMENTS.—The report shall include the fol-
lowing: 
VerDate Mar 15 2010 
01:32 Dec 07, 2012
Jkt 029200
PO 00000
Frm 00482
Fmt 6652
Sfmt 6203
E:\SENENR\H4310.PP
H4310
rfrederick on DSK6VPTVN1PROD with
483 
† HR 4310 PP
(A) An assessment of the program in com-
parison with commercial products, if applicable, 
with respect to each of the following: 
(i) The effectiveness of analyst tools, 
user interfaces, and data visualization in 
supporting analyst missions and require-
ments. 
(ii) Training requirements for ana-
lysts. 
(iii) Ease of use for analysts. 
(iv) Rates of progress in developing 
analyst tools and linking tools for standard 
workflows. 
(B) An assessment of the soundness of the 
past decisions of the Army, and the future plans 
of the Army, for acquiring and integrating ana-
lyst tools, user interfaces, and data visualization 
capabilities through government-sponsored cus-
tom development, leasing of commercial solu-
tions, and government open source development. 
(C) Such recommendations regarding the 
program as the Chief Information Officer con-
siders appropriate in light of the review under 
this subsection. 
VerDate Mar 15 2010 
01:32 Dec 07, 2012
Jkt 029200
PO 00000
Frm 00483
Fmt 6652
Sfmt 6203
E:\SENENR\H4310.PP
H4310
rfrederick on DSK6VPTVN1PROD with
484 
† HR 4310 PP
SEC. 923. RATIONALIZATION OF CYBER NETWORKS AND 
CYBER PERSONNEL OF THE DEPARTMENT OF 
DEFENSE. 
(a) IN GENERAL.—The Secretary of Defense shall take 
appropriate actions to substantially reduce the number of 
sub-networks and network enclaves across the Department 
of Defense, and the associated security and access manage-
ment controls, in order to achieve the following objectives 
for the Department: 
(1) Visibility for the United States Cyber Com-
mand in the operational and security status of all 
networks, network equipment, and computers. 
(2) Elimination of redundant network security 
infrastructure and personnel. 
(3) Rationalization and consolidation of cyber 
attack detection, diagnosis, and response resources, 
and elimination of gaps in security coverage. 
(4) Reduction of barriers to information sharing 
and enhancement of the capacity to rapidly create 
collaborative communities of interest. 
(5) Enhancement of access to information 
through authentication-based and identity-based ac-
cess controls. 
(6) Enhancement of the capacity to deploy, and 
achieve access to, enterprise-level services. 
VerDate Mar 15 2010 
01:32 Dec 07, 2012
Jkt 029200
PO 00000
Frm 00484
Fmt 6652
Sfmt 6203
E:\SENENR\H4310.PP
H4310
rfrederick on DSK6VPTVN1PROD with
485 
† HR 4310 PP
(7) Separation of server and end-user device 
computing to facilitate server and data center consoli-
dation and a more secure tiered and zoned network 
architecture. 
(b) PERSONNEL PLAN.— 
(1) IN GENERAL.—As part of the actions taken 
under subsection (a), the Secretary shall establish and 
carry out a plan to reassign personnel billets cur-
rently allocated to network operations and security 
that will become available pursuant to the reduction 
in network enclaves required by that subsection to 
tasks related to potential offensive cyber operations in 
order to achieve an appropriate balance between the 
offensive and defensive missions of the United States 
Cyber Command and its components. The plan shall 
include targets for the number of personnel to be reas-
signed to tasks related to offensive operations, and the 
rate at which such personnel shall be added to the 
workforce for such tasks. 
(2) DISPOSITION OF PERSONNEL.—In developing 
the plan required by paragraph (1), the Secretary 
shall— 
(A) determine whether the number of per-
sonnel required to be reassigned to tasks related 
to offensive operations in order to achieve the 
VerDate Mar 15 2010 
01:32 Dec 07, 2012
Jkt 029200
PO 00000
Frm 00485
Fmt 6652
Sfmt 6203
E:\SENENR\H4310.PP
H4310
rfrederick on DSK6VPTVN1PROD with
486 
† HR 4310 PP
balance described in paragraph (1) will be met, 
in pace and numbers, through the reassignment 
of personnel billets pursuant to the plan; and 
(B) if the Secretary determines that the 
number of personnel so required will not be so 
met (whether because of insufficient numbers of 
personnel in billets to be reassigned or because 
personnel available for reassignment cannot be 
trained or directed to tasks related to offensive 
operations), take appropriate actions to ensure 
the availability to the United States Cyber Com-
mand of appropriate numbers of personnel 
qualified to undertake tasks related to offensive 
operations. 
(3) ADDITIONAL ELEMENTS.—In developing the 
plan required by paragraph (1), the Secretary shall 
also— 
(A) identify targets for the number of per-
sonnel to be reassigned to tasks related to offen-
sive cyber operations, and the rate at which such 
personnel shall be added to the workforce for such 
tasks; and 
(B) identify targets for use of National 
Guard personnel to support cyber workforce ra-
VerDate Mar 15 2010 
01:32 Dec 07, 2012
Jkt 029200
PO 00000
Frm 00486
Fmt 6652
Sfmt 6203
E:\SENENR\H4310.PP
H4310
rfrederick on DSK6VPTVN1PROD with
487 
† HR 4310 PP
tionalization and the actions taken under sub-
section (a). 
(4) SUBMITTAL TO CONGRESS.—The Secretary 
shall submit the plan required by paragraph (1) to 
the congressional defense committees at the time of the 
submittal to Congress of the budget of the President 
for fiscal year 2014 pursuant to section 1105(a) of 
title 31, United States Code. 
SEC. 924. NEXT-GENERATION HOST-BASED CYBER SECU-
RITY SYSTEM FOR THE DEPARTMENT OF DE-
FENSE. 
(a) STRATEGY
FOR ACQUISITION
OF SYSTEM RE-
QUIRED.—The Chief Information Officer of the Department 
of Defense shall, in coordination with the Under Secretary 
of Defense for Acquisition, Technology, and Logistics, de-
velop a strategy to acquire next-generation host-based cyber-
security tools and capabilities (in this section referred to 
as a ‘‘next-generation system’’) for the Department of De-
fense. 
(b) ELEMENTS OF SYSTEM.—It is the sense of Congress 
that any next-generation system acquired under the strat-
egy required by subsection (a) should meet the following re-
quirements: 
(1) To overcome problems and limitations in 
current capabilities, the system should not rely on 
VerDate Mar 15 2010 
01:32 Dec 07, 2012
Jkt 029200
PO 00000
Frm 00487
Fmt 6652
Sfmt 6203
E:\SENENR\H4310.PP
H4310
rfrederick on DSK6VPTVN1PROD with
488 
† HR 4310 PP
anti-virus or signature-based threat detection tech-
niques that— 
(A) 
cannot 
address 
new 
or 
rapidly 
morphing threats: 
(B) consume substantial amounts of com-
munications capacity to remain current with 
known threats and to report current status; or 
(C) consume substantial amounts of re-
sources to store rapidly growing threat libraries. 
(2) The system should provide an open architec-
ture-based framework for so-called ‘‘plug-and-play’’ 
integration of a variety of types of deployable tools in 
addition to cyber intrusion detection tools, including 
tools for— 
(A) insider threat detection; 
(B) continuous monitoring and configura-
tion management; 
(C) remediation following infections; and 
(D) protection techniques that do not rely 
on detection of the attack, such as virtualization, 
and diversification of attack surfaces. 
(3) The system should be designed for ease of de-
ployment to potentially millions of host devices of tai-
lored security solutions depending on need and risk, 
and to be compatible with cloud-based, thin-client, 
VerDate Mar 15 2010 
01:32 Dec 07, 2012
Jkt 029200
PO 00000
Frm 00488
Fmt 6652
Sfmt 6203
E:\SENENR\H4310.PP
H4310
rfrederick on DSK6VPTVN1PROD with
489 
† HR 4310 PP
and virtualized environments as well as battlefield de-
vices and weapons systems. 
(c) SUBMITTAL TO CONGRESS.—The Chief Informa-
tion Office shall submit to Congress a report setting forth 
the strategy required by subsection (a) together with the 
budget justification materials of the Department of Defense 
submitted to Congress with the budget of the President for 
fiscal year 2015 pursuant to section 1105(a) of title 31, 
United States Code. 
SEC. 925. IMPROVEMENTS OF SECURITY, QUALITY, AND 
COMPETITION IN COMPUTER SOFTWARE PRO-
CURED BY THE DEPARTMENT OF DEFENSE. 
(a) COMPREHENSIVE PROGRAM ON IMPROVEMENT OF 
PROCUREMENT
OF COMPUTER SOFTWARE.—The Under 
Secretary of Defense for Acquisition, Technology, and Lo-
gistics shall, in coordination with the Chief Information Of-
ficer of the Department of Defense, develop a comprehensive 
program for improvements of the security, quality, and 
competition in the computer software procured by the De-
partment of Defense for covered systems 
(b) UPDATE
OF DEVELOPMENT
AND ACQUISITION 
MODELS.— 
(1) IN GENERAL.—The Under Secretary of De-
fense for Acquisition, Technology, and Logistics shall, 
in coordination with the Chief Information Officer, 
VerDate Mar 15 2010 
01:32 Dec 07, 2012
Jkt 029200
PO 00000
Frm 00489
Fmt 6652
Sfmt 6203
E:\SENENR\H4310.PP
H4310
rfrederick on DSK6VPTVN1PROD with
490 
† HR 4310 PP
provide for the development of updates and improve-
ments to one or more existing best-practice develop-
ment and acquisition models (such as the Capability 
Maturity Model Integration) in order to provide ex-
plicit guidance under such model or models for im-
proved assurance, security, quality, and resiliency in 
the computer software developed and procured by the 
Department. 
(2) ELEMENTS.—Any update or improvement to 
a development and acquisition model under this sub-
section shall— 
(A) include diagnostic methods that enable 
evaluations of conformance to the processes and 
best practices of the model for achieving quality, 
assurance, and security throughout the life cycle 
of software products concerned; and 
(B) be compatible with the variety of cur-
rent agile and incremental software development 
methodologies. 
(c) REQUIREMENTS
FOR SECURE CODE DEVELOP-
MENT PRACTICES.—The Under Secretary shall, in coordi-
nation with the Chief Information Officer— 
(1) direct the Director of the Defense Information 
Systems Agency to modify the Application Security 
and Development Security Technical Implementation 
VerDate Mar 15 2010 
01:32 Dec 07, 2012
Jkt 029200
PO 00000
Frm 00490
Fmt 6652
Sfmt 6203
E:\SENENR\H4310.PP
H4310
rfrederick on DSK6VPTVN1PROD with
491 
† HR 4310 PP
Guide (STIG) to require (rather than highly rec-
ommend) the use of automated static vulnerability 
analysis tools in the computer software code develop-
ment phase, and in development and operational test-
ing, to identify and remediate security vulnerabilities 
for covered systems; 
(2) develop a list of qualified government and 
private-sector static analysis tools and third-party 
testing organizations to support the requirement 
under paragraph (1); 
(3) direct the Director— 
(A) to designate secure software coding 
standards; and 
(B) to modify the Security Technical Imple-
mentation Guide to reference the approved 
standards; and 
(4) develop guidance and direction for Depart-
ment program managers to require government soft-
ware development and maintenance organizations 
and contractors to identify and implement, through 
contract statements of work, a secure software coding 
plan that includes verifiable processes and practices. 
(d) VERIFICATION OF EFFECTIVE IMPLEMENTATION.— 
The Under Secretary shall, in coordination with the Chief 
Information Officer, develop guidance and direction for De-
VerDate Mar 15 2010 
01:32 Dec 07, 2012
Jkt 029200
PO 00000
Frm 00491
Fmt 6652
Sfmt 6203
E:\SENENR\H4310.PP
H4310
rfrederick on DSK6VPTVN1PROD with
492 
† HR 4310 PP
partment program managers for covered systems to do as 
follows: 
(1) To require evidence that government software 
development and maintenance organizations and con-
tractors are conforming in computer software coding 
to— 
(A) approved secure coding standards of the 
Department during software development, up-
grade and maintenance activities, including 
through the use of inspection and appraisals; 
(B) an applicable best practice development 
and acquisition model; and 
(C) the requirement established pursuant to 
subsection (b)(1). 
(2) To make appropriate use of authorized soft-
ware code assessment centers (whether a government 
center, Federally funded research and development 
center, or government contractor) to evaluate applica-
tions and software products for conformance to secure 
coding requirements. 
(e) STUDY
ON ADDITIONAL MEANS
OF IMPROVING 
SOFTWARE SECURITY.— 
(1) IN GENERAL.—The Under Secretary shall, in 
coordination with the Chief Information Officer, pro-
vide for a study of potential mechanisms for obtain-
VerDate Mar 15 2010 
01:32 Dec 07, 2012
Jkt 029200
PO 00000
Frm 00492
Fmt 6652
Sfmt 6203
E:\SENENR\H4310.PP
H4310
rfrederick on DSK6VPTVN1PROD with
493 
† HR 4310 PP
ing higher quality and secure development of com-
puter software for the Department. 
(2) MECHANISMS TO BE STUDIED.—The mecha-
nisms studied under paragraph (1) may include the 
following: 
(A) Liability for defects or vulnerabilities 
in software code. 
(B) So-called ‘‘clawback’’ provisions on 
earned fees that enable the Department to recoup 
funds for security vulnerabilities discovered after 
software is delivered. 
(C) Exemption from liability for rigorous 
conformance with secure development processes. 
(D) Warranties against software defects and 
vulnerabilities. 
(f) SOFTWARE REPOSITORIES
AND COLLABORATIVE 
DEVELOPMENT
ENVIRONMENTS.—The Under Secretary 
shall, in consultation with the Chief Information Officer— 
(1) establish or require the use of one or more ex-
isting computer software repositories and collabo-
rative computer software development environments 
(such as Forge.mil managed by the Defense Informa-
tion Systems Agency) for covered systems for purposes 
of— 
VerDate Mar 15 2010 
01:32 Dec 07, 2012
Jkt 029200
PO 00000
Frm 00493
Fmt 6652
Sfmt 6203
E:\SENENR\H4310.PP
H4310
rfrederick on DSK6VPTVN1PROD with
509 
† HR 4310 PP
(1) conduct an inventory of all existing software 
licenses in favor of the Department of Defense, includ-
ing licenses in use and licenses not in use, on an ap-
plication-by-application basis; 
(2) compare the number of software licenses in 
use, and the manner of their use by Department em-
ployees, with the number of software licenses available 
to the Department and the product use rights con-
tained in such licenses; 
(3) assess the needs of the Department and the 
components of the Department for software licenses 
during the two fiscal years next following the date of 
the completion of the inventory; and 
(4) determine means by which the Department 
can achieve the greatest possible economies of scale 
and cost-savings in the procurement, use, and optimi-
zation of software licenses. 
(b) PERFORMANCE PLAN.— 
(1) IN GENERAL.—If the Chief Information Offi-
cer determines through an inventory conducted under 
subsection (a) that the number of existing software li-
censes, on an application-by-application basis, of the 
Department and the components of the Department 
exceeds the needs of the Department for such software 
licenses, the Secretary of Defense shall, not later than 
VerDate Mar 15 2010 
01:32 Dec 07, 2012
Jkt 029200
PO 00000
Frm 00509
Fmt 6652
Sfmt 6203
E:\SENENR\H4310.PP
H4310
rfrederick on DSK6VPTVN1PROD with