H. R. 2810—465 
and maintenance of software-based cyber tools and applications, 
consideration of agile or iterative development practices, agile 
acquisition practices, and other similar best practices of 
commercial industry. 
(2) CONSIDERATIONS.—In carrying out the evaluation 
required by subsection (a), the Commander shall assess require-
ments for implementing the practices described in paragraph 
(1) and consider changes to established acquisition practices 
that may be necessary to implement the practices described 
in such paragraph, including changes to the following: 
(A) The requirements process. 
(B) Contracting. 
(C) Testing. 
(D) User involvement in the development process. 
(E) Program management. 
(F) Milestone reviews and approvals. 
(G) The definitions of ‘‘research and development’’, 
‘‘procurement’’, and ‘‘sustainment’’. 
(H) The constraints of current appropriations account 
definitions. 
(d) ASSESSMENT OF TRAINING AND EDUCATION REQUIREMENTS.— 
In carrying out the evaluation required by subsection (a), the Com-
mander shall assess training and education requirements for per-
sonnel in all areas and at all levels of management relevant to 
the successful adoption of new acquisition models and methods 
for developing, acquiring, and maintaining cyber tools and applica-
tions as described in such subsection. 
(e) SERVICES AND EXPERTISE.—In carrying out the evaluation 
required by subsection (a), the Commander shall— 
(1) obtain services and expertise from— 
(A) the Defense Digital Service; and 
(B) federally funded research and development centers, 
such as the Software Engineering Institute and the MITRE 
Corporation; and 
(2) consult with such commercial software companies as 
the Commander considers appropriate to learn about relevant 
commercial best practices. 
(f) RECOMMENDATIONS.— 
(1) IN GENERAL.—Not later than 120 days after the date 
of the enactment of this Act, the Commander shall submit 
to the Secretary of Defense recommendations for experimenting 
with or adopting new acquisition methods identified pursuant 
to the evaluation under subsection (a), including recommenda-
tions for any actions that should be carried out to ensure 
the successful implementation of such methods. 
(2) CONGRESSIONAL BRIEFING.—Not later than 14 days after 
submitting recommendations to the Secretary under paragraph 
(1), the Commander shall provide to the congressional defense 
committees a briefing on the recommendations. 
(g) PRESERVATION
OF EXISTING AUTHORITY.—The evaluation 
required under subsection (a) is intended to inform future acquisi-
tion approaches. Nothing in this section shall be construed to limit 
or impede the Commander in exercising the authority provided 
under section 807 of the National Defense Authorization Act for 
Fiscal Year 2016 (Public Law 114–92; 10 U.S.C. 2224 note).
H. R. 2810—466 
(h) AGILE OR ITERATIVE DEVELOPMENT DEFINED.—In this sec-
tion, the term ‘‘agile or iterative development’’, with respect to 
software— 
(1) means acquisition pursuant to a method for delivering 
multiple, rapid, incremental capabilities to the user for oper-
ational use, evaluation, and feedback not exclusively linked 
to any single, proprietary method or process; and 
(2) involves— 
(A) the incremental development and fielding of 
capabilities, commonly called ‘‘spirals’’, ‘‘spins’’, or ‘‘sprints’’, 
which can be measured in a few weeks or months; and 
(B) continuous participation and collaboration by users, 
testers, and requirements authorities. 
SEC. 1643. ASSESSMENT OF DEFENSE CRITICAL ELECTRIC INFRA-
STRUCTURE. 
Section 1650(b)(1) of the National Defense Authorization Act 
for fiscal year 2017 (114–328; 10 U.S.C. 2224 note) is amended— 
(1) in subparagraph (C), by striking ‘‘and’’ at the end; 
(2) in subparagraph (D), by striking the period at the 
end and inserting ‘‘; and’’; and 
(3) by adding at the end the following: 
‘‘(E) to assess the strategic benefits derived from, and 
the challenges associated with, isolating military infra-
structure from the national electric grid and the use of 
microgrids.’’. 
SEC. 1644. CYBER POSTURE REVIEW. 
(a) REQUIREMENT FOR COMPREHENSIVE REVIEW.—In order to 
clarify the near-term policy and strategy of the United States with 
respect to cyber deterrence, the Secretary of Defense shall conduct 
a comprehensive review of the cyber posture of the United States 
over the posture review period. 
(b) CONSULTATION.—The Secretary of Defense shall conduct 
the review under subsection (a) in consultation with the Director 
of National Intelligence, the Attorney General, the Secretary of 
Homeland Security, and the Secretary of State, as appropriate. 
(c) ELEMENTS OF REVIEW.—The review conducted under sub-
section (a) shall include, for the posture review period, the following 
elements: 
(1) The role of cyber forces in the military strategy, plan-
ning, and programming of the United States. 
(2) Review of the role of cyber operations in combatant 
commander operational planning, the ability of combatant com-
manders to respond to hostile acts by adversaries, and the 
ability of combatant commanders to engage and build capacity 
with allies. 
(3) A review of the law, policies, and authorities relating 
to, and necessary for the United States to maintain, a safe, 
reliable, and credible cyber posture for responding to cyber 
attacks and for deterrence in cyberspace. 
(4) A declaratory policy relating to the responses of the 
United States to cyber attacks of significant consequence. 
(5) Proposed norms for the conduct of offensive cyber oper-
ations for deterrence and in crisis and conflict. 
(6) Guidance for the development of a cyber deterrence 
strategy (which may include activities, capability efforts, and
H. R. 2810—467 
operations other than cyber activities, cyber capability efforts, 
and cyber operations), including— 
(A) a review and assessment of various approaches 
to cyber deterrence, determined in consultation with 
experts from Government, academia, and industry; 
(B) a comparison of the strengths and weaknesses of 
the approaches identified under subparagraph (A) relative 
to the threat and to each other; and 
(C) an explanation of how the cyber deterrence strategy 
will inform country-specific deterrence campaign plans 
focused on key leadership of Russia, China, Iran, North 
Korea, and any other country the Secretary considers 
appropriate. 
(7) Identification of the steps that should be taken to bolster 
stability in cyberspace and, more broadly, stability between 
major powers, taking into account— 
(A) the analysis and gaming of escalation dynamics 
in various scenarios; and 
(B) consideration of the spiral escalatory effects of coun-
tries 
developing 
increasingly 
potent 
offensive 
cyber 
capabilities. 
(8) A determination of whether sufficient personnel are 
trained and equipped to meet validated cyber requirements. 
(9) Such other matters as the Secretary considers appro-
priate. 
(d) REPORT.— 
(1) IN GENERAL.—The Secretary of Defense shall submit 
to the congressional defense committees a report on the results 
of the cyber posture review conducted under subsection (a). 
(2) FORM OF REPORT.—The report under paragraph (1) may 
be submitted in unclassified form or classified form, as nec-
essary. 
(3) LIMITATION ON AVAILABILITY OF FUNDS.—Of the funds 
authorized to be appropriated by this Act or otherwise made 
available for fiscal year 2018 for operations and maintenance 
for the Office of the Assistant Secretary of Defense for Public 
Affairs, not more than 85 percent may be obligated or expended 
until the date on which the Secretary of Defense submits to 
the congressional defense committees the report under para-
graph (1). 
(e) POSTURE REVIEW PERIOD DEFINED.—In this section, the 
term ‘‘posture review period’’ means the period beginning on the 
date that is five years after the date of the enactment of this 
Act and ending on the date that is 10 years after such date of 
enactment. 
SEC. 1645. BRIEFING ON CYBER CAPABILITY AND READINESS SHORT-
FALLS. 
(a) BRIEFING REQUIRED.—Not later than 180 days after the 
date of the enactment of this Act, the Secretary of the Army 
shall provide to the Committees on Armed Services of Senate and 
the House of Representatives a briefing on the ability of the Army 
Combat Training Centers to provide sufficient cyber training for 
deploying forces. 
(b) ELEMENTS.—The briefing under subsection (a) shall 
include—
H. R. 2810—468 
(1) an assessment of the pre-rotational training require-
ments for all deploying Army forces relating to the conduct 
of, and response to, cyber electromagnetic activities; 
(2) an assessment of the training capabilities of the Army 
Combat Training Centers with respect to cyber electromagnetic 
activities; and 
(3) recommendations for any improvements to training cur-
ricula, exercises, or infrastructure capabilities that may be 
needed to fill gaps in cyber training capabilities as such gaps 
are identified in the assessments under paragraphs (1) and 
(2). 
(c) ADDITIONAL CONSIDERATIONS.—In preparing the briefing 
under subsection (a), the Secretary of the Army shall take into 
account the resources available within a 10-mile radius of the 
Army Combat Training Centers that could be used to address 
potential cyber capability and readiness shortfalls, including 
resources from other military departments, defense agencies, and 
field activities. 
(d) CYBER ELECTROMAGNETIC ACTIVITIES DEFINED.—In this sec-
tion, the term ‘‘cyber electromagnetic activities’’ has the meaning 
given the term in the Army Field Manual 3–38 titled ‘‘Cyber Electro-
magnetic Activities’’. 
SEC. 1646. BRIEFING ON CYBER APPLICATIONS OF BLOCKCHAIN TECH-
NOLOGY. 
(a) BRIEFING REQUIRED.—Not later than 180 days after the 
date of the enactment of this Act, the Secretary of Defense, in 
consultation with the heads of such other departments and agencies 
of the Federal Government as the Secretary considers appropriate, 
shall provide to the appropriate committees of Congress a briefing 
on the cyber applications of blockchain technology. 
(b) ELEMENTS.—The briefing under subsection (a) shall 
include— 
(1) a description of potential offensive and defensive cyber 
applications of blockchain technology and other distributed 
database technologies; 
(2) an assessment of efforts by foreign powers, extremist 
organizations, and criminal networks to utilize such tech-
nologies; 
(3) an assessment of the use or planned use of such tech-
nologies by the Federal Government and critical infrastructure 
networks; and 
(4) an assessment of the vulnerabilities of critical infra-
structure networks to cyber attacks. 
(c) FORM OF BRIEFING.—The briefing under subsection (a) shall 
be provided in unclassified form, but may include a classified supple-
ment. 
(d) APPROPRIATE COMMITTEES OF CONGRESS DEFINED.—In this 
section, the term ‘‘appropriate committees of Congress’’ means— 
(1) the Committee on Armed Services, the Select Committee 
on Intelligence, the Committee on Banking, Housing, and 
Urban Affairs, and the Committee on Homeland Security and 
Governmental Affairs of the Senate; and 
(2) the Committee on Armed Services, the Permanent Select 
Committee on Intelligence, the Committee on Financial Serv-
ices, and the Committee on Homeland Security of the House 
of Representatives.