I 
118TH CONGRESS 
1ST SESSION H. R. 5786 
To establish in the National Nuclear Security Administration a Cybersecurity 
Risk Inventory, Assessment, and Mitigation Working Group. 
IN THE HOUSE OF REPRESENTATIVES 
SEPTEMBER 28, 2023 
Mr. CARBAJAL (for himself, Mr. BACON, and Mr. GALLAGHER) introduced the 
following bill; which was referred to the Committee on Armed Services 
A BILL 
To establish in the National Nuclear Security Administration 
a Cybersecurity Risk Inventory, Assessment, and Mitiga-
tion Working Group. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. CYBERSECURITY RISK INVENTORY, ASSESS-
MENT, AND MITIGATION WORKING GROUP. 
Subtitle A of title XXXII of the National Defense Au-
thorization Act for Fiscal Year 2000 (Public Law 106– 
65) is amended by adding at the end the following new 
section: 
VerDate Sep 11 2014 
04:16 Oct 01, 2023
Jkt 039200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H5786.IH
H5786
kjohnson on DSK7ZCZBW3PROD with $$_JOB
‘‘SEC. 3222. CYBERSECURITY RISK INVENTORY, ASSESS-
MENT, AND MITIGATION WORKING GROUP. 
‘‘(a) ESTABLISHMENT.—There is in the Administra-
tion a working group, to be known as the ‘Cybersecurity 
Risk Inventory, Assessment, and Mitigation Working 
Group’. 
‘‘(b) MEMBERSHIP.—Members of the working group 
shall include the Deputy Administrator for Defense Pro-
grams, the Associate Administrator for Information Man-
agement and Chief Information Officer, and staff from 
other offices as determined appropriate by the Deputy Ad-
ministrator and Associate Administrator. 
‘‘(c) COMPREHENSIVE
STRATEGY.—The working 
group shall prepare a comprehensive strategy for 
inventorying the range of National Nuclear Security Ad-
ministration systems that are potentially at risk in the 
operational technology and nuclear weapons information 
technology environments, assessing the systems at risk, 
and implementing risk mitigation actions. Such strategy 
shall incorporate key elements of effective cybersecurity 
risk management strategies, as identified by the Govern-
ment Accountability Office, including the specification 
of— 
‘‘(1) goals, objectives, activities, and perform-
ance measures; 
VerDate Sep 11 2014 
04:16 Oct 01, 2023
Jkt 039200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H5786.IH
H5786
kjohnson on DSK7ZCZBW3PROD with $$_JOB
‘‘(2) organizational roles, responsibilities, and 
coordination; 
‘‘(3) necessary resources needed to implement 
the strategy over the next ten years; and 
‘‘(4) detailed milestones and schedules for com-
pletion of tasks. 
‘‘(d) SUBMISSION TO CONGRESS.— 
‘‘(1) BRIEFING.—Not later than 120 days after 
the date of the enactment of this Act, the members 
of the working group shall provide to the congres-
sional defense committees a briefing on the plan of 
the working group plan to develop the strategy re-
quired under subsection (c). 
‘‘(2) SUBMISSION
OF
STRATEGY.—Not later 
than April 1, 2025, the working group shall submit 
the congressional defense committees a copy of the 
completed strategy. 
‘‘(e) TERMINATION.—The working group shall termi-
nate on the date that is five years after the date of the 
enactment of this section.’’. 
Æ 
VerDate Sep 11 2014 
04:16 Oct 01, 2023
Jkt 039200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6301
E:\BILLS\H5786.IH
H5786
kjohnson on DSK7ZCZBW3PROD with $$_JOB