H. R. 5515—504 
of Defense to the Department of Homeland Security, including 
the national cybersecurity and communications integration center 
(NCCIC) of the Department, or other locations as agreed upon 
by the Secretary of Defense and the Secretary of Homeland Security. 
(c) LIMITATION.—The authority under subsection (a) may not 
negatively impact the primary missions of the Department of 
Defense or the Department of Homeland Security. 
(d) ESTABLISHMENT OF PROCEDURES.— 
(1) IN GENERAL.—The Secretary of Defense and the Sec-
retary of Homeland Security shall establish procedures to carry 
out subsection (a), including procedures relating to the protec-
tion of and safeguards for maintenance of information held 
by the NCCIC regarding United States persons. 
(2) LIMITATION.—Nothing in this subsection may be con-
strued as providing authority to the Secretary of Defense to 
establish procedures regarding the NCCIC with respect to any 
matter outside the scope of this section. 
(e) NO EFFECT ON OTHER AUTHORITY TO PROVIDE SUPPORT.— 
Nothing in this section may be construed to limit the authority 
of an Executive department, military department, or independent 
establishment to provide any appropriate support, including cyber-
security support, or to provide, detail, or assign personnel, under 
any other law, rule, or regulation. 
(f) DEFINITIONS.—In this section, each of the terms ‘‘Executive 
department’’, ‘‘military department’’, and ‘‘independent establish-
ment’’, has the meaning given each of such terms, respectively, 
in chapter 1 of title 5, United States Code. 
(g) TERMINATION OF AUTHORITY.—This section shall terminate 
on September 30, 2022. 
SEC. 1651. PILOT PROGRAM ON REGIONAL CYBERSECURITY TRAINING 
CENTER FOR THE ARMY NATIONAL GUARD. 
(a) PILOT PROGRAM.—The Secretary of the Army may carry 
out a pilot program under which the Secretary establishes a 
National Guard training center to provide collaborative interagency 
education and training for members of the Army National Guard. 
(b) CENTER.— 
(1) TRAINING AND COOPERATION.—If the Secretary carries 
out the pilot program under subsection (a), the Secretary should 
ensure that the training center established under such sub-
section— 
(A) educates and trains members of the Army National 
Guard quickly and efficiently by concurrently training cyber 
protection teams and cyber network defense teams on a 
common standard in order to defend— 
(i) the information network of the Department of 
Defense in a State environment; 
(ii) while acting under title 10, United States Code, 
the information networks of State governments; and 
(iii) critical infrastructure; 
(B) fosters interagency cooperation by— 
(i) co-locating members of the Army National 
Guard with personnel of departments and agencies 
of the Federal Government and State governments; 
and
H. R. 5515—505 
(ii) providing an environment to develop inter-
agency relationship to coordinate responses and 
recovery efforts during and following a cyber attack; 
(C) collaborates with academic institutions to develop 
and implement curriculum for interagency education and 
training within the classroom; and 
(D) coordinates with the Persistent Cyber Training 
Environment of the Army Cyber Command in devising 
and implementing interagency education and training 
using physical and information technology infrastructure. 
(2) LOCATIONS.—If the Secretary carries out the pilot pro-
gram under subsection (a), the Secretary may select one 
National Guard facility at which to carry out the pilot program. 
The Secretary may select a facility that is located in an area 
that meets the following criteria: 
(A) The location has a need for cyber training, as 
measured by both the number of members of the Army 
National Guard that would apply for such training and 
the number of units of the Army National Guard that 
verify the unit would apply for such training. 
(B) The location has high capacity information and 
telecommunications infrastructure, including high speed 
fiber optic networks. 
(C) The location has personnel, technology, labora-
tories, and facilities to support proposed activities and has 
the opportunity for ongoing training, education, and 
research. 
(c) ACTIVITIES.—If the Secretary carries out the pilot program 
under subsection (a), the Secretary should ensure that the pilot 
program includes the following activities: 
(1) Providing joint education and training and accelerating 
training certifications for working in a cyber range. 
(2) Integrating education and training between the 
National Guard, law enforcement, and emergency medical and 
fire first responders. 
(3) Providing a program to continuously train the cyber 
network defense teams to not only defend the information net-
work of the Department of Defense, but to also provide edu-
cation and training on how to use defense capabilities of the 
team in a State environment. 
(4) Developing curriculum and educating the National 
Guard on the different missions carried out under titles 10 
and 32, United States Code, in order to enhance interagency 
coordination and create a common operating picture. 
(d) NOTIFICATION REQUIRED.—If the Secretary carries out the 
pilot program under subsection (a), the Secretary shall provide 
immediate notification to the congressional defense committees that 
includes information relating to the resources required to carry 
out such pilot program, identification of units to be trained, the 
location of such training, and a description of agreements with 
Federal, State, local, and private sector entities. 
(e) SUNSET.—The authority provided under this section shall 
expire on the date that is two years after the date of the enactment 
of this Act. 
SEC. 1652. CYBERSPACE SOLARIUM COMMISSION. 
(a) ESTABLISHMENT.—
H. R. 5515—506 
(1) IN
GENERAL.—There is established a commission to 
develop a consensus on a strategic approach to defending the 
United States in cyberspace against cyber attacks of significant 
consequences. 
(2) DESIGNATION.—The commission established under para-
graph (1) shall be known as the ‘‘Cyberspace Solarium Commis-
sion’’ (in this section the ‘‘Commission’’). 
(b) MEMBERSHIP.— 
(1) COMPOSITION.—(A) Subject to subparagraph (B), the 
Commission shall be composed of the following members: 
(i) The Principal Deputy Director of National Intel-
ligence. 
(ii) The Deputy Secretary of Homeland Security. 
(iii) The Deputy Secretary of Defense. 
(iv) The Director of the Federal Bureau of Investiga-
tion. 
(v) Three members appointed by the majority leader 
of the Senate, in consultation with the Chairman of the 
Committee on Armed Services of the Senate, one of whom 
shall be a member of the Senate and two of whom shall 
not be. 
(vi) Two members appointed by the minority leader 
of the Senate, in consultation with the Ranking Member 
of the Committee on Armed Services of the Senate, one 
of whom shall be a member of the Senate and one of 
whom shall not be. 
(vii) Three members appointed by the Speaker of the 
House of Representatives, in consultation with the Chair-
man of the Committee on Armed Services of the House 
of Representatives, one of whom shall be a member of 
the House of Representatives and two of whom shall not 
be. 
(viii) Two members appointed by the minority leader 
of the House of Representatives, in consultation with the 
Ranking Member of the Committee on Armed Services 
of the House of Representatives, one of whom shall be 
a member of the House of Representatives and one of 
whom shall not be. 
(B)(i) The members of the Commission who are not mem-
bers of Congress and who are appointed under clauses (iv) 
through (vii) of subparagraph (A) shall be individuals who 
are nationally recognized for expertise, knowledge, or experi-
ence in— 
(I) cyber strategy or national-level strategies to combat 
long-term adversaries; 
(II) cyber technology and innovation; 
(III) use of intelligence information by national policy-
makers and military leaders; or 
(IV) the implementation, funding, or oversight of the 
national security policies of the United States. 
(ii) An official who appoints members of the Commission 
may not appoint an individual as a member of the Commission 
if such individual possesses any personal or financial interest 
in the discharge of any of the duties of the Commission. 
(iii) All members of the Commission described in clause 
(i) shall possess an appropriate security clearance in accordance
H. R. 5515—507 
with applicable provisions of law concerning the handling of 
classified information. 
(2) CO-CHAIRS.—(A) The Commission shall have two co- 
chairs, selected from among the members of the Commission. 
(B) One co-chair of the Commission shall be a member 
of the Democratic Party, and one co-chair shall be a member 
of the Republican Party. 
(C) The individuals who serve as the co-chairs of the 
Commission shall be jointly agreed upon by the President, 
the majority leader of the Senate, the minority leader of the 
Senate, the Speaker of the House of Representatives, and the 
minority leader of the House of Representatives. 
(c) APPOINTMENT; INITIAL MEETING.— 
(1) APPOINTMENT.—Members of the Commission shall be 
appointed not later than 45 days after the date of the enactment 
of this Act. 
(2) INITIAL MEETING.—The Commission shall hold its initial 
meeting on or before the date that is 60 days after the date 
of the enactment of this Act. 
(d) MEETINGS; QUORUM; VACANCIES.— 
(1) IN GENERAL.—After its initial meeting, the Commission 
shall meet upon the call of the co-chairs of the Commission. 
(2) QUORUM.—Seven members of the Commission shall con-
stitute a quorum for purposes of conducting business, except 
that two members of the Commission shall constitute a quorum 
for purposes of receiving testimony. 
(3) VACANCIES.—Any vacancy in the Commission shall not 
affect its powers, but shall be filled in the same manner in 
which the original appointment was made. 
(4) QUORUM WITH VACANCIES.—If vacancies in the Commis-
sion occur on any day after 45 days after the date of the 
enactment of this Act, a quorum shall consist of a majority 
of the members of the Commission as of such day. 
(e) ACTIONS OF COMMISSION.— 
(1) IN GENERAL.—The Commission shall act by resolution 
agreed to by a majority of the members of the Commission 
voting and present. 
(2) PANELS.—The Commission may establish panels com-
posed of less than the full membership of the Commission 
for purposes of carrying out the duties of the Commission 
under this title. The actions of any such panel shall be subject 
to the review and control of the Commission. Any findings 
and determinations made by such a panel shall not be consid-
ered the findings and determinations of the Commission unless 
approved by the Commission. 
(3) DELEGATION.—Any member, agent, or staff of the 
Commission may, if authorized by the co-chairs of the Commis-
sion, take any action which the Commission is authorized to 
take pursuant to this title. 
(f) DUTIES.—The duties of the Commission are as follows: 
(1) To define the core objectives and priorities of the 
strategy described in subsection (a)(1). 
(2) To weigh the costs and benefits of various strategic 
options to defend the United States, including the political 
system of the United States, the national security industrial 
sector of the United States, and the innovation base of the
H. R. 5515—508 
United States. The options to be assessed should include deter-
rence, norms-based regimes, and active disruption of adversary 
attacks through persistent engagement. 
(3) To evaluate whether the options described in paragraph 
(2) are exclusive or complementary, the best means for exe-
cuting such options, and how the United States should incor-
porate and implement such options within its national strategy. 
(4) To review and make determinations on the difficult 
choices present within such options, among them what norms- 
based regimes the United States should seek to establish, how 
the United States should enforce such norms, how much dam-
age the United States should be willing to incur in a deterrence 
or persistent denial strategy, what attacks warrant response 
in a deterrence or persistent denial strategy, and how the 
United States can best execute these strategies. 
(5) To review adversarial strategies and intentions, current 
programs for the defense of the United States, and the capabili-
ties of the Federal Government to understand if and how adver-
saries are currently being deterred or thwarted in their aims 
and ambitions in cyberspace. 
(6) To evaluate the effectiveness of the current national 
cyber policy relating to cyberspace, cybersecurity, and cyber 
warfare to disrupt, defeat and deter cyber attacks. 
(7) In weighing the options for defending the United States, 
to consider possible structures and authorities that need to 
be established, revised, or augmented within the Federal 
Government. 
(g) POWERS OF COMMISSION.— 
(1) IN GENERAL.—(A) The Commission or, on the authoriza-
tion of the Commission, any subcommittee or member thereof, 
may, for the purpose of carrying out the provisions of this 
section— 
(i) hold such hearings and sit and act at such times 
and places, take such testimony, receive such evidence, 
and administer such oaths; and 
(ii) require, by subpoena or otherwise, the attendance 
and testimony of such witnesses and the production of 
such books, records, correspondence, memoranda, papers, 
and documents, as the Commission or such designated 
subcommittee or designated member considers necessary. 
(B) Subpoenas may be issued under subparagraph (A)(ii) 
under the signature of the co-chairs of the Commission, and 
may be served by any person designated by such co-chairs. 
(C) The provisions of sections 102 through 104 of the 
Revised Statutes of the United States (2 U.S.C. 192–194) shall 
apply in the case of any failure of a witness to comply with 
any subpoena or to testify when summoned under authority 
of this section. 
(2) CONTRACTING.—The Commission may, to such extent 
and in such amounts as are provided in advance in appropria-
tion Acts, enter into contracts to enable the Commission to 
discharge its duties under this title. 
(3) INFORMATION
FROM
FEDERAL
AGENCIES.—(A) The 
Commission may secure directly from any executive depart-
ment, agency, bureau, board, commission, office, independent
H. R. 5515—509 
establishment, or instrumentality of the Government informa-
tion, suggestions, estimates, and statistics for the purposes 
of this title. 
(B) Each such department, agency, bureau, board, commis-
sion, office, establishment, or instrumentality shall, to the 
extent authorized by law, furnish such information, suggestions, 
estimates, and statistics directly to the Commission, upon 
request of the co-chairs of the Commission. 
(C) The Commission shall handle and protect all classified 
information provided to it under this section in accordance 
with applicable statutes and regulations. 
(4) ASSISTANCE
FROM
FEDERAL
AGENCIES.—(A) The Sec-
retary of Defense shall provide to the Commission, on a nonre-
imbursable basis, such administrative services, funds, staff, 
facilities, and other support services as are necessary for the 
performance of the Commission’s duties under this title. 
(B) The Director of National Intelligence may provide the 
Commission, on a nonreimbursable basis, with such administra-
tive services, staff, and other support services as the Commis-
sion may request. 
(C) In addition to the assistance set forth in paragraphs 
(1) and (2), other departments and agencies of the United 
States may provide the Commission such services, funds, facili-
ties, staff, and other support as such departments and agencies 
consider advisable and as may be authorized by law. 
(D) The Commission shall receive the full and timely 
cooperation of any official, department, or agency of the United 
States Government whose assistance is necessary, as jointly 
determined by the co-chairs selected under subsection (b)(2), 
for the fulfillment of the duties of the Commission, including 
the provision of full and current briefings and analyses. 
(5) POSTAL SERVICES.—The Commission may use the United 
States postal services in the same manner and under the same 
conditions as the departments and agencies of the United 
States. 
(6) GIFTS.—No member or staff of the Commission may 
receive a gift or benefit by reason of the service of such member 
or staff to the Commission. 
(h) STAFF OF COMMISSION.— 
(1) IN
GENERAL.—(A) The co-chairs of the Commission, 
in accordance with rules agreed upon by the Commission, shall 
appoint and fix the compensation of a staff director and such 
other personnel as may be necessary to enable the Commission 
to carry out its duties, without regard to the provisions of 
title 5, United States Code, governing appointments in the 
competitive service, and without regard to the provisions of 
chapter 51 and subchapter III of chapter 53 of such title relating 
to classification and General Schedule pay rates, except that 
no rate of pay fixed under this subsection may exceed the 
equivalent of that payable to a person occupying a position 
at level V of the Executive Schedule under section 5316 of 
such title. 
(B) Any Federal Government employee may be detailed 
to the Commission without reimbursement from the Commis-
sion, and such detailee shall retain the rights, status, and 
privileges of his or her regular employment without interrup-
tion.
H. R. 5515—510 
(C) All staff of the Commission shall possess a security 
clearance in accordance with applicable laws and regulations 
concerning the handling of classified information. 
(2) CONSULTANT SERVICES.—(A) The Commission may pro-
cure the services of experts and consultants in accordance with 
section 3109 of title 5, United States Code, but at rates not 
to exceed the daily rate paid a person occupying a position 
at level IV of the Executive Schedule under section 5315 of 
such title. 
(B) All experts and consultants employed by the Commis-
sion shall possess a security clearance in accordance with 
applicable laws and regulations concerning the handling of 
classified information. 
(i) COMPENSATION AND TRAVEL EXPENSES.— 
(1) COMPENSATION.—(A) Except as provided in paragraph 
(2), each member of the Commission may be compensated at 
not to exceed the daily equivalent of the annual rate of basic 
pay in effect for a position at level IV of the Executive Schedule 
under section 5315 of title 5, United States Code, for each 
day during which that member is engaged in the actual 
performance of the duties of the Commission under this title. 
(B) Members of the Commission who are officers or 
employees of the United States or Members of Congress shall 
receive no additional pay by reason of their service on the 
Commission. 
(2) TRAVEL EXPENSES.—While away from their homes or 
regular places of business in the performance of services for 
the Commission, members of the Commission may be allowed 
travel expenses, including per diem in lieu of subsistence, in 
the same manner as persons employed intermittently in the 
Government service are allowed expenses under section 5703 
of title 5, United States Code. 
(j) TREATMENT OF INFORMATION RELATING TO NATIONAL SECU-
RITY.— 
(1) IN GENERAL.—(A) The Director of National Intelligence 
shall assume responsibility for the handling and disposition 
of any information related to the national security of the United 
States that is received, considered, or used by the Commission 
under this title. 
(B) Any information related to the national security of 
the United States that is provided to the Commission by a 
congressional intelligence committees or the congressional 
armed services committees may not be further provided or 
released without the approval of the chairman of such commit-
tees. 
(2) ACCESS AFTER TERMINATION OF COMMISSION.—Notwith-
standing any other provision of law, after the termination of 
the Commission under subsection (k)(2), only the members 
and designated staff of the congressional intelligence commit-
tees, the Director of National Intelligence (and the designees 
of the Director), and such other officials of the executive branch 
as the President may designate shall have access to information 
related to the national security of the United States that is 
received, considered, or used by the Commission. 
(k) FINAL REPORT; TERMINATION.—
H. R. 5515—511 
(1) FINAL REPORT.—Not later than September 1, 2019, the 
Commission shall submit to the congressional defense commit-
tees, the congressional intelligence committees, the Committee 
on Homeland Security of the House of Representatives, the 
Committee on Homeland Security and Governmental Affairs 
of the Senate, the Director of National Intelligence, and the 
Secretary of Defense, and the Secretary of Homeland Security 
a final report on the findings of the Commission. 
(2) TERMINATION.—(A) The Commission, and all the 
authorities of this section, shall terminate at the end of the 
120-day period beginning on the date on which the final report 
under paragraph (1) is submitted to the congressional defense 
and intelligence committees. 
(B) The Commission may use the 120-day period referred 
to in paragraph (1) for the purposes of concluding its activities, 
including providing testimony to Congress concerning the final 
report referred to in that paragraph and disseminating the 
report. 
(l) ASSESSMENTS OF FINAL REPORT.—Not later than 60 days 
after receipt of the final report under subsection (k)(1), the Director 
of National Intelligence, the Secretary of Defense, and the Secretary 
of Homeland Security shall each submit to the congressional intel-
ligence committees and the congressional defense committees an 
assessment by the Director or the Secretary, as the case may 
be, of the final report. Each assessment shall include such comments 
on the findings and recommendations contained in the final report 
as the Director or Secretary, as the case may be, considers appro-
priate. 
(m) INAPPLICABILITY
OF
CERTAIN
ADMINISTRATIVE
PROVI-
SIONS.— 
(1) FEDERAL ADVISORY COMMITTEE ACT.—The provisions of 
the Federal Advisory Committee Act (5 U.S.C. App.) shall not 
apply to the activities of the Commission under this section. 
(2) FREEDOM OF INFORMATION ACT.—The provisions of sec-
tion 552 of title 5, United States Code (commonly referred 
to as the Freedom of Information Act), shall not apply to 
the activities, records, and proceedings of the Commission under 
this section. 
(n) FUNDING.— 
(1) AUTHORIZATION
OF
APPROPRIATIONS.—Of the amount 
authorized to be appropriated for fiscal year 2019 by this Act, 
as specified in the funding tables in division D, $4,000,000 
may be used to carry out this section. 
(2) AVAILABILITY IN GENERAL.—Subject to paragraph (1), 
the Secretary of Defense shall make available to the Commis-
sion such amounts as the Commission may require for purposes 
of the activities of the Commission under this section. 
(3) DURATION OF AVAILABILITY.—Amounts made available 
to the Commission under paragraph (2) shall remain available 
until expended. 
(o) CONGRESSIONAL INTELLIGENCE COMMITTEES DEFINED.—In 
this section, the term ‘‘congressional intelligence committees’’ 
means— 
(1) the Select Committee on Intelligence of the Senate; 
and 
(2) the Permanent Select Committee on Intelligence of the 
House of Representatives.
H. R. 5515—512 
SEC. 1653. STUDY AND REPORT ON RESERVE COMPONENT CYBER 
CIVIL SUPPORT TEAMS. 
(a) STUDY REQUIRED.—The Secretaries concerned shall conduct 
a study on the feasibility and advisability of the establishment 
of reserve component cyber civil support teams for each State. 
(b) ELEMENTS.—The study under subsection (a) shall include 
the following: 
(1) An examination of the potential ability of the teams 
referred to in such subsection to respond to an attack, natural 
disaster, or other large-scale incident affecting computer net-
works, electronics, or cyber capabilities, including an analysis 
of the following: 
(A) The command structure and lines of authority for 
such teams. 
(B) The operational capabilities of such teams. 
(C) The legal authorities available to and constraints 
placed on such teams. 
(D) The amount of funding and other resources that 
would be required by the Department of Defense to orga-
nize, train, and equip such teams. 
(2) An analysis of the current use of reserve and active 
duty components in the Department of Defense and an expla-
nation of how the establishment of such teams may affect 
the ability of the Department of Defense to— 
(A) organize, train, equip, and employ the Cyber Mis-
sion Force, and other organic cyber forces; and 
(B) perform the national defense missions and defense 
support to civil authorities for cyber incident response. 
(3) An explanation of how the establishment of such teams 
may affect the ability of the Department of Homeland Security 
to— 
(A) organize, train, equip, and employ cyber incident 
response teams; and 
(B) perform civilian cyber response missions. 
(4) An explanation as to how the establishment of such 
teams would fit into the current missions of the Department 
of Defense and the Department of Homeland Security. 
(5) An analysis of current and projected State civilian and 
private sector cyber response capabilities and services, 
including an identification of any gaps in such capabilities 
and services, and including an analysis of the following: 
(A) Whether such teams would be, on a risk- and 
cost-adjusted basis, of use for each State. 
(B) How the establishment of such teams may impact 
Federal, State, and private sector resourcing for State 
civilian and private sector cyber response capabilities and 
services. 
(6) An identification of the potential role of such teams 
with respect to the principles and processes set forth in— 
(A) Presidential Policy Directive 20 (United States 
Cyber Operations Policy); 
(B) Presidential Policy Directive 21 (Critical Infrastruc-
ture Security and Resilience); and 
(C) Presidential Policy Directive 41 (United States 
Cyber Incident Coordination). 
(7) An explanation of how such teams may interact with 
other organizations and elements of the Federal Government
H. R. 5515—513 
that have responsibilities under the Presidential Policy Direc-
tives referred to in paragraph (6). 
(8) Any effects on the privacy and civil liberties of United 
States persons that may result from the establishment of such 
teams. 
(9) Any other considerations determined to be relevant 
by the Secretaries concerned. 
(c) REPORT REQUIRED.—Not later than 180 days after the date 
of the enactment of this Act, the Secretaries concerned shall submit 
to the appropriate congressional committees a report that includes— 
(1) the results of the study conducted under subsection 
(a), including an explanation of each element described in sub-
section (b); and 
(2) the final determination of the Secretaries with respect 
to the feasibility and advisability of establishing reserve compo-
nent cyber civil support teams for each State. 
(d) DEFINITIONS.—In this section: 
(1) The term ‘‘appropriate congressional committees’’ 
means— 
(A) the congressional defense committees; 
(B) the Committee on Homeland Security of the House 
of Representatives; and 
(C) the Committee on Homeland Security and Govern-
mental Affairs of the Senate. 
(2) The term ‘‘reserve component cyber civil support team’’ 
means a team that— 
(A) is comprised of members of the reserve components; 
(B) is organized, trained, equipped, and sustained by 
the Department of Defense for the purpose of assisting 
State authorities in preparing for and responding to cyber 
incidents, cyber emergencies, and cyber attacks; and 
(C) operates principally under the command and con-
trol of the Chief Executive of the State in which the team 
is located. 
(3) The term ‘‘Secretaries concerned’’ means the Secretary 
of Defense and the Secretary of Homeland Security acting 
jointly. 
(4) The term ‘‘State’’ means each of the several States, 
the District of Columbia, the Commonwealth of Puerto Rico, 
and the United States Virgin Islands. 
SEC. 1654. IDENTIFICATION OF COUNTRIES OF CONCERN REGARDING 
CYBERSECURITY. 
(a) IDENTIFICATION OF COUNTRIES OF CONCERN.—Not later than 
180 days after the date of the enactment of this Act, the Secretary 
of Defense shall create a list of countries that pose a risk to 
the cybersecurity of United States defense and national security 
systems and infrastructure. Such list shall reflect the level of threat 
posed by each country included on such list. In creating such 
list, the Secretary shall take in to account the following: 
(1) A foreign government’s activities that pose force protec-
tion or cybersecurity risk to the personnel, financial systems, 
critical infrastructure, or information systems of the United 
States or coalition forces.
H. R. 5515—514 
(2) A foreign government’s willingness and record of pro-
viding financing, logistics, training or intelligence to other per-
sons, countries or entities posing a force protection or cybersecu-
rity risk to the personnel, financial systems, critical infrastruc-
ture, or information systems of the United States or coalition 
forces. 
(3) A foreign government’s engagement in foreign intel-
ligence activities against the United States for the purpose 
of undermining United States national security. 
(4) A foreign government’s knowing participation in 
transnational organized crime or criminal activity. 
(5) A foreign government’s cyber activities and operations 
to affect the supply chain of the United States Government. 
(6) A foreign government’s use of cyber means to unlawfully 
or inappropriately obtain intellectual property from the United 
States Government or United States persons. 
(b) UPDATES.—The Secretary shall continuously update and 
maintain the list under subsection (a) to preempt obsolescence. 
(c) REPORT TO CONGRESS.—Not later than one year after the 
date of the enactment of this Act, the Secretary shall submit to 
the appropriate committees of Congress the list created pursuant 
to subsection (a) and any accompanying analysis that contributed 
to the creation of the list. 
SEC. 1655. MITIGATION OF RISKS TO NATIONAL SECURITY POSED BY 
PROVIDERS OF INFORMATION TECHNOLOGY PRODUCTS 
AND SERVICES WHO HAVE OBLIGATIONS TO FOREIGN 
GOVERNMENTS. 
(a) DISCLOSURE REQUIRED.—Subject to the regulations issued 
under subsection (b), the Department of Defense may not use a 
product, service, or system procured or acquired after the date 
of the enactment of this Act relating to information or operational 
technology, cybersecurity, an industrial control system, or weapons 
system provided by a person unless that person discloses to the 
Secretary of Defense the following: 
(1) Whether, and if so, when, within five years before 
or at any time after the date of the enactment of this Act, 
the person has allowed a foreign government to review the 
code of a non-commercial product, system, or service developed 
for the Department, or whether the person is under any obliga-
tion to allow a foreign person or government to review the 
code of a non-commercial product, system, or service developed 
for the Department as a condition of entering into an agreement 
for sale or other transaction with a foreign government or 
with a foreign person on behalf of such a government. 
(2) Whether, and if so, when, within five years before 
or at any time after the date of the enactment of this Act, 
the person has allowed a foreign government listed in section 
1654 to review the source code of a product, system, or service 
that the Department is using or intends to use, or is under 
any obligation to allow a foreign person or government to 
review the source code of a product, system, or service that 
the Department is using or intends to use as a condition of 
entering into an agreement for sale or other transaction with 
a foreign government or with a foreign person on behalf of 
such a government.
H. R. 5515—515 
(3) Whether or not the person holds or has sought a license 
pursuant to the Export Administration Regulations under sub-
chapter C of chapter VII of title 15, Code of Federal Regulations, 
the International Traffic in Arms Regulations under subchapter 
M of chapter I of title 22, Code of Federal Regulations, or 
successor regulations, for information technology products, 
components, software, or services that contain code custom- 
developed for the non-commercial product, system, or service 
the Department is using or intends to use. 
(b) REGULATIONS.— 
(1) IN GENERAL.—The Secretary of Defense shall issue regu-
lations regarding the implementation of subsection (a). 
(2) UNIFORM
REVIEW
PROCESS.—If information obtained 
from a person under subsection (a) or the contents of the 
registry under subsection (f) are the subject of a request under 
section 552 of title 5, United States Code (commonly referred 
to as the ‘‘Freedom of Information Act’’), the Secretary of 
Defense shall conduct a uniform review process, without regard 
to the office holding the information, to determine if the 
information is exempt from disclosure under such section 552. 
(c) PROCUREMENT.—Procurement contracts for covered products 
or systems shall include a clause requiring the information con-
tained in subsection (a) be disclosed during the period of the contract 
if an entity becomes aware of information requiring disclosure 
required pursuant to such subsection, including any mitigation 
measures taken or anticipated. 
(d) MITIGATION OF RISKS.— 
(1) IN GENERAL.—If, after reviewing a disclosure made by 
a person under subsection (a), the Secretary determines that 
the disclosure relating to a product, system, or service entails 
a risk to the national security infrastructure or data of the 
United States, or any national security system under the control 
of the Department, the Secretary shall take such measures 
as the Secretary considers appropriate to mitigate such risks, 
including, as the Secretary considers appropriate, by condi-
tioning any agreement for the use, procurement, or acquisition 
of the product, system, or service on the inclusion of enforceable 
conditions or requirements that would mitigate such risks. 
(2) THIRD-PARTY TESTING STANDARD.—Not later than two 
years after the date of the enactment of this Act the Secretary 
shall develop such third-party testing standard as the Secretary 
considers acceptable for commercial off the shelf (COTS) prod-
ucts, systems, or services to use when dealing with foreign 
governments. 
(e) EXEMPTION OF OPEN SOURCE SOFTWARE.—This section shall 
not apply to open source software. 
(f) ESTABLISHMENT OF REGISTRY.—Not later than one year after 
the date of the enactment of this Act, the Secretary of Defense 
shall— 
(1) establish within the operational capabilities of the Com-
mittee for National Security Systems (CNSS) or within such 
other agency as the Secretary considers appropriate a registry 
containing the information disclosed under subsection (a); and 
(2) upon request, make such information available to any 
agency conducting a procurement pursuant to the Federal 
Acquisition Regulations or the Defense Federal Acquisition 
Regulations.
H. R. 5515—516 
(g) ANNUAL REPORTS.—Not later than one year after the date 
of the enactment of this Act and not less frequently than once 
each year thereafter, the Secretary of Defense shall submit to 
the appropriate committees of Congress a report detailing the 
number, scope, product classifications, and mitigation agreements 
related to each product, system, and service for which a disclosure 
is made under subsection (a). 
(h) DEFINITIONS.—In this section: 
(1) APPROPRIATE COMMITTEES OF CONGRESS DEFINED.—The 
term ‘‘appropriate committees of Congress’’ means— 
(A) the Committee on Armed Services, the Select Com-
mittee on Intelligence, and the Committee on Homeland 
Security and Governmental Affairs of the Senate; and 
(B) the Committee on Armed Services, the Permanent 
Select Committee on Intelligence, the Committee on Home-
land Security, and the Committee on Oversight and 
Government Reform of the House of Representatives. 
(2) COMMERCIAL ITEM.—The term ‘‘commercial item’’ has 
the meaning given such term in section 103 of title 41, United 
States Code. 
(3) INFORMATION
TECHNOLOGY.—The term ‘‘information 
technology’’ has the meaning given such term in section 11101 
of title 40, United States Code. 
(4) NATIONAL SECURITY SYSTEM.—The term ‘‘national secu-
rity system’’ has the meaning given such term in section 3552(b) 
of title 44, United States Code. 
(5) NON-COMMERCIAL PRODUCT, SYSTEM, OR SERVICE.—The 
term ‘‘non-commercial product, system, or service’’ means a 
product, system, or service that does not meet the criteria 
of a commercial item. 
(6) OPEN SOURCE SOFTWARE.—The term ‘‘open source soft-
ware’’ means software for which the human-readable source 
code is available for use, study, re-use, modification, enhance-
ment, and re-distribution by the users of such software. 
SEC. 1656. REPORT ON CYBERSECURITY APPRENTICE PROGRAM. 
Not later than 240 days after the date of the enactment of 
this Act, the Secretary of Defense shall submit to the congressional 
defense committees a report on the feasibility of establishing a 
Cybersecurity Apprentice Program to support on-the-job training 
for certain cybersecurity positions and facilitate the acquisition 
of cybersecurity certifications. 
SEC. 1657. REPORT ON ENHANCEMENT OF SOFTWARE SECURITY FOR 
CRITICAL SYSTEMS. 
(a) REPORT REQUIRED.—Not later than March 1, 2019, the 
Principal Cyber Adviser to the Secretary of Defense, the Under 
Secretary of Defense for Research and Engineering, and the Chief 
Information Officer of the Department of Defense shall jointly 
submit to the congressional defense committees a report on a study, 
based on the authorities specified in subsection (b), on the costs, 
benefits, technical merits, and other merits of applying the tech-
nologies described in subsection (c) to the vulnerability assessment 
and remediation of the following systems: 
(1) Nuclear systems and nuclear command and control. 
(2) A critical subset of conventional power projection 
capabilities. 
(3) Cyber command and control.
H. R. 5515—517 
(4) Other defense critical infrastructure. 
(b) BASIS FOR CONDUCT OF STUDY.—The study required for 
purposes of subsection (a) shall be conducted pursuant to the fol-
lowing: 
(1) Section 1640 of the National Defense Authorization 
Act for Fiscal Year 2018 (Public Law 115–91). 
(2) Section 1650 of the National Defense Authorization 
Act for Fiscal Year 2017 (10 U.S.C. 2224 note). 
(3) Section 1647 of the National Defense Authorization 
Act for Fiscal Year 2016 (Public Law 114–92; 129 Stat. 1118). 
(4) Section 937 of the National Defense Authorization Act 
for Fiscal Year 2014 (Public Law 113–66; 10 U.S.C. 2224 note). 
(c) TECHNOLOGIES.—The technologies described in this sub-
section include the following: 
(1) Technology acquired, developed, and used by Combat 
Support Agencies of the Department of Defense to discover 
flaws and weaknesses in software code by inputting immense 
quantities of pseudo-random data (commonly referred to as 
‘‘fuzz’’) to identify inputs that cause the software to fail or 
degrade. 
(2) Cloud-based software fuzzing-as-a-service to continu-
ously test the security of Department of Defense software 
repositories at large scale. 
(3) Formal programming and protocol language for software 
code development and other methods and tools developed under 
various programs such as the High Assurance Cyber Military 
Systems program of the Defense Advanced Research Projects 
Agency. 
(4) The binary analysis and symbolic execution software 
security tools developed under the Cyber Grand Challenge of 
the Defense Advanced Research Projects Agency. 
(5) Any other advanced or immature technologies with 
respect to which the Department of Defense determines there 
is particular potential for application to the vulnerability 
assessment and remediation of the systems specified in sub-
section (a). 
Subtitle D—Nuclear Forces 
SEC. 1661. UNDER SECRETARY OF DEFENSE FOR RESEARCH AND 
ENGINEERING AND THE NUCLEAR WEAPONS COUNCIL. 
Section 179(a) of title 10, United States Code, is amended— 
(1) in paragraph (1), by striking ‘‘, Technology, and Logis-
tics’’ and inserting ‘‘and Sustainment’’; 
(2) by redesignating paragraphs (4) and (5) as paragraphs 
(5) and (6), respectively; and 
(3) by inserting after paragraph (3) the following new para-
graph (4): 
‘‘(4) The Under Secretary of Defense for Research and 
Engineering.’’. 
SEC. 1662. LONG-RANGE STANDOFF WEAPON REQUIREMENTS. 
Subparagraphs (A) and (B) of section 217(a)(1) of the National 
Defense Authorization Act for Fiscal Year 2014 (Public Law 113– 
66; 127 Stat. 706) are amended to read as follows: