H. R. 7776—520 
(B) The administrative processes required to shift bil-
lets and existing funding to cyber squadrons. 
(C) The responsibilities and functions performed by 
military personnel and civilian personnel. 
(D) The benefits and risks to the Space Force approach 
of transferring billets to cyber squadrons. 
(2) ROADMAP.—The review under subsection (a) shall 
include a transition roadmap that outlines a comprehensive 
transition for the transfer of billets described in paragraph 
(1) by not later than September 30, 2024. 
SEC. 1539. INDEPENDENT REVIEW OF POSTURE AND STAFFING LEVELS 
OF OFFICE OF THE CHIEF INFORMATION OFFICER. 
(a) IN GENERAL.—Not later than 180 days after the date of 
the enactment of this Act, the Secretary of Defense shall seek 
to enter into an agreement with an appropriate non-Department 
of Defense entity for the conduct of a comprehensive review of 
the posture and adequacy of the staffing levels of the Office of 
the Chief Information Officer of the Department of Defense, as 
of the date of the enactment of this Act. 
(b) MATTERS FOR CONSIDERATION.—An agreement under sub-
section (a) shall specify that the review conducted under the agree-
ment shall include the evaluation of each of the following: 
(1) Any limitations or constraints of the Office of the Chief 
Information Officer in performing the entirety of the respon-
sibilities specified in section 142(b) of title 10, United States 
Code, and responsibilities assigned by the Secretary of Defense, 
based on the staffing levels of the Office as of the date of 
the enactment of this Act. 
(2) The composition of civilian, military, and contractor 
personnel assigned to the Office of the Chief Information 
Officer, as of such date, including the occupational series and 
military occupational specialties of such personnel, relative to 
the responsibilities specified in paragraph (1). 
(3) The organizational construct of the Office of the Chief 
Information Officer, as of such date. 
(c) RECOMMENDATIONS.—An agreement under subsection (a) 
shall specify that the review conducted under the agreement shall 
include recommendations for the Chief Information Officer and 
the congressional defense committees, including recommendations 
derived from the matters for consideration specified under sub-
section (b). 
(d) SUBMISSION.—Not later than 30 days after the date of 
the completion of the review under subsection (a), the Secretary 
of Defense shall submit to the congressional defense committees 
a copy of the review. 
SEC. 1540. INDEPENDENT ASSESSMENT OF CIVILIAN CYBERSECURITY 
RESERVE FOR DEPARTMENT OF DEFENSE. 
(a) IN GENERAL.—Not later than 90 days after the date of 
enactment of this Act, the Secretary of Defense shall seek to enter 
into an agreement with a nonprofit entity or a federally funded 
research and development center with expertise in cybersecurity 
and workforce management to conduct an assessment of the feasi-
bility and advisability of creating and maintaining a civilian cyber-
security reserve corps to enable the Department of Defense and 
military services to provide qualified civilian manpower to the 
Department of Defense to effectively respond to significant cyber
H. R. 7776—521 
incidents or to assist in solving other exceptionally difficult cyber 
workforce-related challenges. 
(b) CONSIDERATION OF PRIOR REPORT.— 
(1) IN GENERAL.—In conducting the assessment required 
by subsection (a), the entity or center shall take into consider-
ation the results of the evaluation of nontraditional cyber sup-
port to the Department of Defense required by section 1730 
of the William M. (Mac) Thornberry National Defense 
Authorization Act for Fiscal Year 2021 (Public Law 116–283). 
(2) LIMITATION ON AVAILABILITY OF FUNDS PENDING SUBMIS-
SION OF REPORT.—Of the funds authorized to be appropriated 
by this Act or otherwise made available for fiscal year 2023 
for the Under Secretary of Defense for Policy, not more than 
75 percent may be obligated or expended until the date on 
which the Principal Cyber Advisor submits the report ref-
erenced in paragraph (1). 
(c) ELEMENTS.—The assessment conducted under subsection 
(a) shall include analysis of the following matters: 
(1) The feasibility of the concept of a civilian cybersecurity 
reserve program, including an analysis of the available talent 
pool, potential impact on employers, and propensity to serve. 
(2) The likelihood of utilizing civilian cybersecurity reserv-
ists to augment the existing Department of Defense workforce, 
including an assessment of the duration of periods of activation. 
(3) The result of outreach conducted with industry and 
State and Federal Government agencies employing individuals 
likely to meet qualification criteria for service in such a pro-
gram. 
(4) The necessity for participants to access classified 
information, and the need to maintain appropriate security 
clearances as a participant in the program, including while 
not in Federal service. 
(5) Appropriate compensation and benefits for members 
of such a program. 
(6) Activities that members may undertake as part of their 
duties. 
(7) Methods for identifying and recruiting members, 
including alternative methods to traditional qualifications 
requirements. 
(8) Methods for preventing conflicts of interest or other 
ethical concerns as a result of participation in such a program. 
(9) Resources, including funding levels, necessary to carry 
out such a program. 
(10) Potential penalties or other adverse action taken 
against individuals who do not respond to activation when 
called. 
(11) Any other matters the Secretary considers relevant 
for the purpose of this assessment. 
(d) REPORTS.— 
(1) IN GENERAL.—Not later than 270 days after the date 
on which the Secretary enters into the agreement described 
in subsection (a), such entity or center shall submit to the 
Secretary a report on the results of the research and analysis 
under such subsection. 
(2) SUBMISSION TO CONGRESS.—Not later than one year 
after the date of enactment of this Act, the Secretary of Defense
H. R. 7776—522 
shall submit to the Committees on Armed Services of the Senate 
and House of Representatives each of the following: 
(A) A copy of the report submitted under paragraph 
(1) without change. 
(B) Any comments, changes, recommendations, or other 
information provided by the Secretary of Defense relating 
to the research and analysis conducted under subsection 
(a) and contained in such report, including a specific rec-
ommendation on whether a civilian cybersecurity reserve 
should be established, as described in such subsection, 
or with modification. 
SEC. 1541. COMPREHENSIVE REVIEW OF CYBER EXCEPTED SERVICE. 
(a) IN GENERAL.—Not later than 180 days after the date of 
enactment of this Act, the Chief Information Officer of the Depart-
ment of Defense and the Under Secretary of Defense for Personnel 
and Readiness, in coordination with the Chief Digital and Artificial 
Intelligence Officer and the Principal Cyber Advisor of the Depart-
ment, shall conduct a comprehensive review of the Cyber Excepted 
Service established pursuant to section 1599f of title 10, United 
States Code. 
(b) ELEMENTS.—The review required under subsection (a) shall 
include the following: 
(1) An assessment of barriers to participation in Cyber 
Excepted Service positions, including— 
(A) criteria for eligibility of potential Department of 
Defense components and entities for participation in the 
Cyber Excepted Service; 
(B) potential and structural limitations of the Cyber 
Excepted Service, including impediments to mobility or 
advancement by civilian employees currently in billets 
coded for Cyber Excepted Service; 
(C) challenges to transition between competitive and 
excepted service; 
(D) matters relating to pay disparity and challenges 
with compensation relative to the skill sets and value of 
such civilian employees in the private sector; 
(E) differences between compensation, incentives, bene-
fits, and access to career-broadening experiences; 
(F) the eligibility for participation in the Cyber 
Excepted Service of civilian employees who are assigned 
to the Office of the Chief Digital and Artificial Intelligence 
Officer; 
(G) the current and necessary mechanisms to deconflict 
occasions when individuals can be considered eligible for 
two or more excepted service systems; and 
(H) any other barriers as determined by the Secretary. 
(2) An evaluation of the process used in accepting applica-
tions, assessing candidates, and the process for and effect of 
adhering to provisions of law establishing preferences for hiring 
eligible veterans, and selecting applicants for vacancies to be 
filled by an individual for a Cyber Excepted Service position. 
(3) An evaluation of current efforts to recruit and retain 
employees in Cyber Excepted Service positions. 
(4) A description of current performance metrics used in 
evaluating the Cyber Excepted Service.
H. R. 7776—523 
(5) An assessment of how current efforts to develop, sustain, 
and improve the Cyber Excepted Service are integrated into 
the strategic workforce planning of the Department. 
(6) Current metrics for— 
(A) the number of employees in Cyber Excepted Service 
positions, disaggregated by occupation, grade, and level 
or pay band; 
(B) the placement of employees in Cyber Excepted 
Service positions, disaggregated by military department, 
Defense agency, or other component within the Depart-
ment; 
(C) the total number of veterans hired; 
(D) the number of separations of employees in Cyber 
Excepted Service positions, disaggregated by occupation, 
grade, and level or pay band; 
(E) the number of retirements of employees in Cyber 
Excepted Service positions, disaggregated by occupation, 
grade, and level or pay band; 
(F) the number and amounts of recruitment, relocation, 
and retention incentives paid to employees in Cyber 
Excepted Service positions, disaggregated by occupation, 
grade, and level or pay band; and 
(G) the number of employees who declined transition 
to qualified Cyber Excepted Service positions. 
(7) An assessment of the training provided to supervisors 
of employees in Cyber Excepted Service positions on the use 
of the new authorities. 
(8) An assessment of the implementation of section 
1599f(a)(1)(A) of title 10, United States Code, including— 
(A) how each military department, Defense agency, 
or other component within the Department is incorporating 
or intends to incorporate Cyber Excepted Service personnel 
in their cyber mission workforce; and 
(B) how the Cyber Excepted Service has allowed each 
military department, Defense agency, or other component 
within the Department to establish, recruit and retain 
personnel to fill cyber mission workforce needs. 
(9) Recommendations for the Secretary of Defense and the 
congressional defense committees with respect to the improve-
ment of the Cyber Excepted Service, including recommendations 
derived from the consideration of the elements specified in 
paragraphs (1) through (8). 
(c) SUBMISSION.—Not later than 30 days after the completion 
of the review under subsection (a), the Chief Information Officer 
shall submit to the congressional defense committees a copy of 
the review. 
(d) ANNUAL UPDATE.—Not later than one year after the submis-
sion of the review under subsection (c), and not less frequently 
than once each year thereafter until September 30, 2028, the Sec-
retary of Defense shall submit to the Committee on Armed Services 
of the Senate and the Committee on Armed Services of the House 
of Representatives an update on progress made in enacting rec-
ommendations identified pursuant to paragraph (9) of subsection 
(b) and a detailed report on Cyber Excepted Service positions during 
the most recent one-year period, including— 
(1) the metrics described in paragraph (6) of such sub-
section;
H. R. 7776—524 
(2) an updated assessment under paragraph (8) of such 
subsection from the current reporting period; 
(3) an updated assessment on the effect of section 1599f 
of title 10, United States Code, on the ability of the Department 
to recruit, retain, and develop cyber professionals in the Depart-
ment over the current reporting period; 
(4) an updated assessment on the barriers to participation 
described in paragraph (1) of subsection (b) from the current 
reporting period; 
(5) proposed modifications to the Cyber Excepted Service; 
and 
(6) such other matters as the Secretary considers appro-
priate. 
(e) DEFINITIONS.—In this section: 
(1) The term ‘‘Cyber Excepted Service’’ consists of those 
positions established under section 1599f(a)(1)(A) of title 10, 
United States Code. 
(2) The term ‘‘Cyber Excepted Service position’’ means a 
position in the Cyber Excepted Service. 
Subtitle D—Reports and Other Matters 
SEC. 1551. PILOT PROGRAM FOR SHARING CYBER CAPABILITIES AND 
RELATED INFORMATION WITH FOREIGN OPERATIONAL 
PARTNERS. 
(a) AUTHORIZATION.—Chapter 19 of title 10, United States Code, 
is amended by adding at the end the following new section: 
‘‘§ 398. Pilot program for sharing cyber capabilities and 
related information with foreign operational part-
ners 
‘‘(a) AUTHORITY TO ESTABLISH PILOT PROGRAM TO SHARE CYBER 
CAPABILITIES.—The Secretary of Defense may, with the concurrence 
of the Secretary of State, provide cyber capabilities and related 
information developed or procured by the Department of Defense 
to foreign countries or organizations described in subsection (b) 
without compensation, to meet operational imperatives if the Sec-
retary of Defense determines that the provision of such cyber 
capabilities is in the national security interests of the United States. 
‘‘(b) LIST OF FOREIGN COUNTRIES.—The Secretary of Defense, 
with the concurrence of the Secretary of State, shall— 
‘‘(1) establish— 
‘‘(A) a list of foreign countries that the Secretary of 
Defense considers suitable for sharing of cyber capabilities 
and related information under the authority established 
under paragraph (a); and 
‘‘(B) criteria for establishing the list under subpara-
graph (A); 
‘‘(2) not later than 14 days after establishing the list 
required by paragraph (a), submit to the appropriate commit-
tees of Congress such list; and 
‘‘(3) notify the appropriate committees of Congress in 
writing of any changes to the list established under clause 
(1) at least 14 days prior to the adoption of any such changes. 
‘‘(c) PROCEDURES.—Prior to the first use of the authority pro-
vided by subsection (a), the Secretaries of Defense and State shall—
H. R. 7776—525 
‘‘(1) establish and submit to the appropriate committees 
of Congress procedures for a coordination process for subsection 
(a) that is consistent with the operational timelines required 
to support the national security of the United States; and 
‘‘(2) notify the appropriate committees of Congress in 
writing of any changes to the procedures established under 
paragraph (1) at least 14 days prior to the adoption of any 
such changes. 
‘‘(d) NOTIFICATION REQUIRED.—(1) The Secretary of Defense 
and Secretary of State jointly shall promptly submit to the appro-
priate committees of Congress notice in writing of any use of the 
authority provided by subsection (a) no later than 48 hours following 
the use of the authority. 
‘‘(2) Notification under paragraph (1) shall include a certifi-
cation that the provision of the cyber capabilities was in the national 
security interests of the United States. 
‘‘(3) The notification under paragraph (1) shall include an anal-
ysis of whether the transfer and the underlying operational impera-
tive could have been met using another authority. 
‘‘(e) TERMINATION.—The authority established under paragraph 
(a) shall terminate on the date that is 3 years after the date 
on which this authority becomes law. 
‘‘(f) DEFINITIONS.—In this section: 
‘‘(1) The term ‘appropriate committees of Congress’ means— 
‘‘(A) the congressional defense committees; 
‘‘(B) the Committee on Foreign Relations of the Senate; 
and 
‘‘(C) Committee on Foreign Affairs of the House of 
Representatives. 
‘‘(2) The term ‘cyber capability’ means a device or computer 
program, including any combination of software, firmware, or 
hardware, designed to create an effect in or through cyberspace. 
‘‘(g) RULE OF CONSTRUCTION.—Nothing in this section shall 
be construed as amending, diminishing, or otherwise impacting 
reporting or other obligations under the War Powers Resolution.’’. 
(b) TABLE OF SECTIONS AMENDMENT.—The table of sections 
at the beginning of such chapter is amended by adding at the 
end the following new item: 
‘‘398. Pilot program for sharing cyber capabilities and related information with for-
eign operational partners.’’. 
SEC. 1552. DEMONSTRATION PROGRAM FOR CYBER AND INFORMATION 
TECHNOLOGY BUDGET DATA ANALYTICS. 
(a) DEMONSTRATION PROGRAM.— 
(1) REQUIREMENT.—Not later than February 1, 2024, the 
Chief Information Officer of the Department of Defense shall, 
in coordination with the Chief Digital and Artificial Intelligence 
Officer, complete a pilot program to demonstrate the application 
of advanced data analytics to the fiscal year 2024 budget data 
of a military department for the purpose of identifying total 
cyber and information technology spending and the distribution 
of such resources across budget line items that are and are 
not identified, labeled, or categorized in a manner that would 
indicate that funds included in such line items will be expended 
on cyber and information technology activities. 
(2) COORDINATION WITH MILITARY DEPARTMENTS.—In car-
rying out the demonstration program under subsection (a),
H. R. 7776—526 
the Chief Information Officer shall, in coordination with the 
Secretary of the Air Force, the Secretary of the Army, and 
the Secretary of the Navy, select a military department for 
participation in the demonstration program. 
(b) ELEMENTS.—The demonstration program under subsection 
(a) shall include— 
(1) efforts to identify planned expenditures for cyber and 
information technology that are not captured in the total figures 
for cyber and information technology reported annually to Con-
gress in support of the President’s budget submission and in 
budget documents and briefings to Congress on the cyber and 
information technology programs and activities; 
(2) efforts to improve transparency in cyber and information 
technology budget information to identify cyber and information 
technology activities funded out of noncyber and noninformation 
technology budget lines, including by the use of qualitative 
techniques such as semantic analysis or natural language proc-
essing technologies; 
(3) metrics developed to assess the effectiveness of the 
demonstration program; 
(4) a cost tradeoff analysis of implementing these cyber 
and information technology data analytics across the entire 
budget of the Department of Defense; 
(5) existing or planned efforts to use these data analytics 
to make budget decisions; and 
(6) existing or planned efforts to incorporate these data 
analytics into materials presented to Congress through the 
budget submission process. 
(c) BRIEFING.— 
(1) INITIAL BRIEFING.—Not later than 120 days after the 
date of the enactment of this Act, the Chief Information Officer 
shall provide the Committees on Armed Services of the Senate 
and the House of Representatives a briefing on the plans and 
status of the Chief Information Officer with respect to the 
demonstration program under subsection (a). 
(2) FINAL BRIEFING.—Not later than March 1, 2024, the 
Chief Information Officer shall provide the Committees on 
Armed Services of the Senate and the House of Representatives 
a briefing on the results and findings of the Chief Information 
Officer with respect to the demonstration program under sub-
section (a), including the following: 
(A) Recommendations for expansion of the demonstra-
tion program to the entire cyber and information technology 
budget of the Department. 
(B) Plans for incorporating data analytics into the 
congressional budget submission process for the cyber and 
information technology budget of the Department. 
SEC. 1553. PLAN FOR COMMERCIAL CLOUD TEST AND EVALUATION. 
(a) POLICY AND PLAN.—Not later than 180 days after the date 
of enactment of this Act, the Secretary of Defense, in consultation 
with commercial industry, shall implement a policy and plan for 
test and evaluation of the cybersecurity of the clouds of commercial 
cloud service providers that provide, or are intended to provide, 
storage or computing of classified data of the Department of 
Defense.
H. R. 7776—527 
(b) CONTENTS.—The policy and plan under subsection (a) shall 
include the following: 
(1) A requirement that, beginning on the date of the enact-
ment of this Act, future contracts with cloud service providers 
for storage or computing of classified data of the Department 
include provisions that permit the Secretary to conduct inde-
pendent, threat-realistic assessments of the commercial cloud 
infrastructure, including with respect to— 
(A) the storage, compute, and enabling elements, 
including the control plane and virtualization hypervisor 
for mission elements of the Department supported by the 
cloud provider; and 
(B) the supporting systems used in the fulfillment, 
facilitation, or operations relating to the mission of the 
Department under the contract, including the interfaces 
with these systems. 
(2) An explanation as to how the Secretary intends to 
proceed on amending existing contracts with cloud service pro-
viders to permit the same level of assessments required for 
future contracts under paragraph (1). 
(3) Identification and description of any proposed tiered 
test and evaluation requirements aligned with different impact 
and classification levels. 
(c) WAIVER AUTHORITY.—The Secretary may include in the 
policy and plan under subsection (a) an authority to waive any 
requirement under subsection (b) if the waiver is jointly approved 
by the Chief Information Officer of the Department of Defense 
and the Director of Operational Test and Evaluation. 
(d) SUBMISSION.—Not later than 180 days after the date of 
enactment of this Act, the Secretary shall submit to the Committees 
on Armed Services of the Senate and the House of Representatives 
the policy and plan under subsection (a). 
(e) THREAT-REALISTIC ASSESSMENT DEFINED.—In this section, 
the term ‘‘threat-realistic assessments’’ means, with respect to 
commercial cloud infrastructure, activities that— 
(1) are designed to accurately emulate cyber threats from 
advanced nation state adversaries, such as Russia and China; 
and 
(2) include cooperative penetration testing and no-notice 
threat-emulation activities where personnel of the Department 
of Defense attempt to penetrate and gain control of the cloud- 
provider facilities, networks, systems, and defenses associated 
with, or which enable, the supported missions of the Depart-
ment. 
SEC. 1554. ROADMAP AND IMPLEMENTATION PLAN FOR CYBER ADOP-
TION OF ARTIFICIAL INTELLIGENCE. 
(a) ROADMAP AND IMPLEMENTATION PLAN REQUIRED.—Not later 
than 270 days after the date of the enactment of this Act, the 
Commander of the United States Cyber Command and the Chief 
Information Officer of the Department of Defense, in coordination 
with the Chief Digital and Artificial Intelligence Officer of the 
Department, the Director of the Defense Advanced Research 
Projects Agency, the Director of the National Security Agency, 
and the Under Secretary of Defense for Research and Engineering, 
shall jointly develop a five-year roadmap and implementation plan 
for rapidly adopting and acquiring artificial intelligence systems,
H. R. 7776—528 
applications, and supporting data and data management processes 
for the Cyberspace Operations Forces of the Department of Defense. 
(b) 
ELEMENTS.—The 
roadmap 
and 
implementation 
plan 
required by subsection (a) shall include the following: 
(1) Identification and prioritization of artificial intelligence 
systems, applications, data identification, and processing to 
cyber missions within the Department, and ameliorating 
threats to, and from, artificial intelligence systems, including— 
(A) advancing the cybersecurity of Department systems 
with artificial intelligence; 
(B) uses of artificial intelligence for cyber effects oper-
ations; 
(C) assessing and mitigating vulnerabilities of artificial 
intelligence systems supporting cybersecurity and cyber 
operations to attacks; and 
(D) defending against adversary artificial intelligence- 
based cyber attacks. 
(2) A plan to develop, acquire, adopt, and sustain the 
artificial intelligence systems, applications, data, and processing 
identified in paragraph (1). 
(3) Roles and responsibilities for the following for adopting 
and acquiring artificial intelligence systems, applications, and 
data to cyber missions within the Department: 
(A) The Commander of the United States Cyber Com-
mand. 
(B) The Commander of Joint-Force Headquarters 
Department of Defense Information Networks. 
(C) The Chief Information Officer of the Department. 
(D) The Chief Digital and Artificial Intelligence Officer 
of the Department. 
(E) The Under Secretary of Defense for Research and 
Engineering. 
(F) The Secretaries of the military departments. 
(G) The Director of the National Security Agency. 
(4) Identification of currently deployed, adopted, and 
acquired artificial intelligence systems, applications, ongoing 
prototypes, and data. 
(5) Identification of current capability and skill gaps that 
must be addressed prior to the development and adoption of 
artificial intelligence applications identified in paragraph (1). 
(6) Identification of opportunities to solicit operator utility 
feedback through inclusion into research and development proc-
esses and wargaming or experimentation events by developing 
a roadmap for such processes and events, as well as a formal-
ized process for capturing and tracking lessons learned from 
such events to inform the development community. 
(7) Identification of long-term technology gaps for fulfilling 
the Department’s cyber warfighter mission to be addressed 
by research relating to artificial intelligence by the science 
and technology enterprise within the Department. 
(8) Definition of a maturity model describing desired cyber 
capabilities, agnostic of the enabling technology solutions, 
including phases in the maturity model or identified milestones 
and clearly identified areas for collaboration with relevant 
commercial off the shelf and government off the shelf developers 
to address requirements supporting capability gaps.