718 
† HR 5515 EAS 
‘‘(d) CONGRESSIONAL
OVERSIGHT.—The Secretary 
shall brief the congressional defense committees about any 
military activities or operations in cyberspace, including 
clandestine military activities or operations in cyberspace, 
occurring during the previous quarter during the quarterly 
briefing required by section 484 of this title. 
‘‘(e) RULE OF CONSTRUCTION.—Nothing in this sec-
tion shall be construed to limit the authority of the Sec-
retary to conduct military activities or operations in cyber-
space, including clandestine activities or operations in 
cyberspace, or to alter or otherwise affect the War Powers 
Resolution (50 U.S.C. 1541–1548), the Authorization for 
Use of Military Force (Public Law 107–40; 50 U.S.C. 1541 
note), or reporting of sensitive military cyber activities or 
operations required by section 130j of this title. 
‘‘(f) DEFINITIONS.—In this section: 
‘‘(1) The term ‘clandestine military activity or 
operation in cyberspace’ means a military activity or 
operation carried out in cyberspace, or associated pre-
paratory actions, authorized by the President or the 
Secretary that— 
‘‘(A) is marked by, held in, or conducted 
with secrecy, where the intent is that the activity 
or operation will not be apparent or acknowl-
edged publicly; and
719 
† HR 5515 EAS 
‘‘(B) is to be carried out— 
‘‘(i) as part of a military operation 
plan approved by the President or the Sec-
retary in anticipation of hostilities or as di-
rected by the President or the Secretary 
against— 
‘‘(I) adversaries (as defined by the 
National Security Strategy); or 
‘‘(II) other emergent national se-
curity threats; 
‘‘(ii) to deter, safeguard, or defend 
against attacks or malicious cyber activities 
against the United States or Department of 
Defense information, networks, systems, in-
stallations, facilities, or other assets; or 
‘‘(iii) in support of other information 
related capabilities such as military decep-
tion and psychological operations. 
‘‘(2) The term ‘foreign power’ has the meaning 
given such term in section 101 of the Foreign Intel-
ligence Surveillance Act of 1978 (50 U.S.C. 1801). 
‘‘(3) The term ‘United States person’ has the 
meaning given such term in such section.’’; and
720 
† HR 5515 EAS 
(3) in subsection (a), as designated by para-
graph (1), by striking ‘‘(as’’ and all that follows 
through ‘‘))’’. 
SEC. 1623. ACTIVE DEFENSE AND SURVEILLANCE AGAINST 
RUSSIAN FEDERATION ATTACKS IN CYBER-
SPACE. 
(a) AUTHORITY TO DISRUPT, DEFEAT, AND DETER 
CYBER ATTACKS.— 
(1) IN GENERAL.—In the event that the National 
Command Authority determines that the Russian 
Federation is conducting an active, systematic, and 
ongoing campaign of attacks against the government 
or people of the United States in cyberspace, the Na-
tional Command Authority may authorize the Com-
mander of the United States Cyber Command, acting 
through the Cyber Mission Forces assigned to the 
United States Cyber Command, to take appropriate 
and proportional action in cyberspace to disrupt, de-
feat, and deter such attacks under the authority and 
policy of the Secretary of Defense to conduct cyber op-
erations and information operations as traditional 
military activities. 
(2) NOTIFICATION AND REPORTING.— 
(A) NOTIFICATION OF OPERATIONS.—IN ex-
ercising the authority provided in paragraph
721 
† HR 5515 EAS 
(1), the Secretary shall provide notices to the 
congressional defense committees in accordance 
with section 130(f) of title 10, United States 
Code. 
(B) QUARTERLY REPORTS BY COMMANDER 
OF THE UNITED STATES CYBER COMMAND.— 
(i) IN GENERAL.—In any fiscal year 
in which the Commander of the United 
States Cyber Command carries out an ac-
tion under paragraph (1), the Secretary of 
Defense shall, not less frequently than quar-
terly, submit to the congressional defense 
committees a report on the actions of the 
Commander under such paragraph in such 
fiscal year. 
(ii) MANNER OF REPORTING.—Reports 
submitted under clause (i) shall be sub-
mitted in a manner that is consistent with 
the recurring quarterly report required by 
section 484 of title 10, United States Code. 
(b) SURVEILLANCE.— 
(1) IN GENERAL.—The Secretary of Defense, act-
ing through the Commander of the United States 
Cyber Command and the cyber mission forces of such 
command, may conduct surveillance in networks out-
722 
† HR 5515 EAS 
side the United States of personnel and organizations 
engaged at the behest or in support of the Russian 
Federation in— 
(A) stealing and releasing confidential in-
formation from United States persons or sup-
porting organizations who are campaigning for 
public office; 
(B) generating and planting information 
and narratives, including the purchase of adver-
tisements, in social and other media intended to 
mislead, sharpen social and political conflicts, or 
otherwise manipulate perceptions and opinions 
of the people of the United States; 
(C) creating networks of subverted com-
puters and associated false accounts on social 
media platforms for the purpose of spreading 
and amplifying the impact of information and 
narratives intended to mislead, sharpen social 
and political conflicts, or otherwise manipulate 
perceptions and opinions of the people of the 
United States; and 
(D) developing or using cyber capabilities— 
(i) to disable, disrupt, or destroy crit-
ical infrastructure of the United States; or 
(ii) to cause—
723 
† HR 5515 EAS 
(I) 
casualties 
among 
United 
States persons or persons of allies of 
the United States; 
(II) significant damage to private 
or public property; 
(III) significant economic disrup-
tion; 
(IV) an effect, whether individ-
ually or in aggregate, comparable to 
that of an armed attack or one that 
imperils a vital national security in-
terest of the United States; or 
(V) significant disruption of the 
normal functioning of United States 
democratic society or government, in-
cluding attacks against or incidents 
involving critical infrastructure that 
could damage systems used to provide 
key services to the public or govern-
ment. 
(2) PRIVATE SECTOR COOPERATION.— 
(A) IN
GENERAL.—The Secretary shall 
make arrangements, directly or through other 
government organizations, with private sector 
media representatives and organizations, includ-
724 
† HR 5515 EAS 
ing social media companies, on a voluntary 
basis, using the results of the surveillance under 
paragraph (1) to assist in the identification of 
such malicious individuals and organizations 
and associated false or counterfeit accounts cre-
ated on social media platforms. 
(B) SECURITY CLEARANCES.—In carrying 
out subparagraph (A), the Secretary may grant 
such security clearances to individuals of media 
organizations as the Secretary considers nec-
essary and appropriate to share evidence that 
supports the Secretary’s conclusions regarding 
the individuals and organizations engaged in the 
activities described in paragraph (1). 
(c) ANNUAL REPORT.—Not less frequently than once 
each year, the Secretary shall submit to the congressional 
defense committees and the congressional intelligence com-
mittees (as defined in section 3 of the National Security 
Act of 1947 (50 U.S.C. 3003)) a report on— 
(1) the scope and intensity of the Russian Fed-
eration’s information operations and attacks through 
cyberspace against the government or people of the 
United States observed by the cyber mission forces of 
the United States Cyber Command and the National 
Security Agency;
725 
† HR 5515 EAS 
(2) adjustments of the Department of Defense in 
the response directed or recommended by the Sec-
retary with respect to such operations and attacks; 
and 
(3) whether the authorities under subsections (a) 
and (b) should be expanded to include other foreign 
powers, such as the Islamic Republic of Iran and the 
People’s Republic of China. 
SEC. 1624. REORGANIZATION AND CONSOLIDATION OF CER-
TAIN CYBER PROVISIONS. 
(a) IN GENERAL.—Part I of subtitle A of title 10, 
United States Code, is amended— 
(1) by transferring sections 130g, 130j, and 130k 
to chapter 19; and 
(2) in chapter 19, by redesignating sections 
130g, 130j, and 130k, as transferred by subparagraph 
(A), as sections 394, 395, and 396, respectively. 
(b) CONFORMING AMENDMENT.—Section 108(m) of the 
Cybersecurity Information Sharing Act of 2015 (6 U.S.C. 
1507(m)) is amended by striking ‘‘under section 130g’’ and 
inserting ‘‘under section 394’’. 
(c) CLERICAL AMENDMENTS.—(1) The table of sections 
at the beginning of chapter 3 of title 10, United States Code, 
is amended by striking the items relating to sections 130g, 
130j, and 130k.
726 
† HR 5515 EAS 
(2) The table of sections at the beginning of chapter 
19 of such title is amended by adding at the end the fol-
lowing new items: 
‘‘394. Authorities concerning military cyber operations. 
‘‘395. Notification requirements for sensitive military cyber operations. 
‘‘396. Notification requirements for cyber weapons.’’. 
SEC. 1625. DESIGNATION OF OFFICIAL FOR MATTERS RE-
LATING TO INTEGRATING CYBERSECURITY 
AND INDUSTRIAL CONTROL SYSTEMS WITHIN 
THE DEPARTMENT OF DEFENSE. 
(a) DESIGNATION OF INTEGRATING OFFICIAL.—Not 
later than 180 days after the date of the enactment of this 
Act, the Secretary of Defense shall designate one official to 
be responsible for matters relating to integrating cybersecu-
rity and industrial control systems within the Department 
of Defense. 
(b) RESPONSIBILITIES.—The official designated pur-
suant to subsection (a) shall be responsible for matters de-
scribed in such subsection at all levels of command, from 
the Department to the facility using industrial control sys-
tems, including developing Department-wide certification 
standards for integration of industrial control systems and 
taking into consideration frameworks set forth by the Na-
tional Institute of Standards and Technology for the cyber-
security of such systems.
727 
† HR 5515 EAS 
SEC. 1626. ASSISTANCE FOR SMALL MANUFACTURERS IN 
THE DEFENSE INDUSTRIAL SUPPLY CHAIN 
ON MATTERS RELATING TO CYBERSECURITY. 
(a) 
DISSEMINATION
OF
CYBERSECURITY
RE-
SOURCES.— 
(1) IN GENERAL.—The Under Secretary of De-
fense for Research and Engineering, in consultation 
with the Director of the National Institute of Stand-
ards and Technology, shall take such actions as may 
be necessary to enhance awareness of cybersecurity 
threats among small manufacturers in the defense in-
dustrial supply chain. 
(2) PRIORITY.—The Under Secretary of Defense 
for Research and Engineering shall prioritize efforts 
to increase awareness to help reduce cybersecurity 
risks faced by small manufacturers described in para-
graph (1). 
(3) SECTOR
FOCUS.—The Under Secretary of 
Defense for Research and Engineering shall carry out 
this subsection with a focus on such industry sectors 
as the Under Secretary considers critical. 
(4) OUTREACH EVENTS.—Under paragraph (1), 
the Under Secretary of Defense for Research and En-
gineering shall conduct outreach to support activities 
consistent with this section. Such outreach may in-
728 
† HR 5515 EAS 
clude live events with a physical presence and out-
reach conducted through Internet websites. 
(b) 
VOLUNTARY
CYBERSECURITY
SELF-ASSESS-
MENTS.—The Under Secretary of Defense for Research and 
Engineering shall develop mechanisms to provide assistance 
to help small manufacturers conduct voluntary self-assess-
ments in order to understand operating environments, cy-
bersecurity requirements, and existing vulnerabilities, in-
cluding through the Mentor Prote´ge´ Program, small busi-
ness programs, and engagements with defense laboratories 
and test ranges. 
(c) TRANSFER OF RESEARCH FINDINGS AND EXPER-
TISE.— 
(1) IN GENERAL.—The Under Secretary of De-
fense for Research and Engineering shall promote the 
transfer of appropriate technology and techniques de-
veloped in the Department of Defense to small manu-
facturers throughout the United States to implement 
security measures that are adequate to protect covered 
defense information, including controlled unclassified 
information. 
(2) COORDINATION WITH OTHER FEDERAL EX-
PERTISE AND CAPABILITIES.—The Under Secretary of 
Defense for Research and Engineering shall coordi-
nate efforts, when appropriate, with the expertise and
729 
† HR 5515 EAS 
capabilities that exist in Federal agencies and feder-
ally sponsored laboratories. 
(3) AGREEMENTS.—In carrying out this sub-
section, the Under Secretary of Defense for Research 
and Engineering may enter into agreements with pri-
vate industry, institutes of higher education, or a 
State, United States territory, local, or tribal govern-
ment to ensure breadth and depth of coverage to the 
United States defense industrial base and to leverage 
resources. 
(d) DEFENSE
ACQUISITION
WORKFORCE
CYBER 
TRAINING PROGRAM.—The Secretary of Defense shall estab-
lish a cyber counseling certification program, or approve 
a similar existing program, to certify small business profes-
sionals and other relevant acquisition staff within the De-
partment of Defense to provide cyber planning assistance 
to small manufacturers in the defense industrial supply 
chain. 
(e) AUTHORITIES.—In executing this program, the 
Secretary may use the following authorities: 
(1) The Manufacturing Technology Program es-
tablished under section 2521 of title 10, United States 
Code.
730 
† HR 5515 EAS 
(2) The Centers for Science, Technology, and En-
gineering Partnership program under section 2368 of 
title 10, United States Code. 
(3) The Manufacturing Engineering Education 
Program established under section 2196 of title 10, 
United States Code. 
(4) The Small Business Innovation Research 
program. 
(5) The mentor-prote´ge´ program. 
(6) Other legal authorities as the Secretary 
deems necessary for the effective and efficient execu-
tion of the program. 
(f) DEFINITIONS.—In this section: 
(1) RESOURCES.—The term ‘‘resources’’ means 
guidelines, tools, best practices, standards, methodolo-
gies, and other ways of providing information. 
(2) SMALL
BUSINESS
CONCERN.—The term 
‘‘small business concern’’ means a small business con-
cern as that term is used in section 3 of the Small 
Business Act (15 U.S.C. 632). 
(3) SMALL MANUFACTURER.—The term ‘‘small 
manufacturer’’ means a small business concern that is 
a manufacturer. 
(4) STATE.—The term ‘‘State’’ means each of the 
several States, Territories, and possessions of the
731 
† HR 5515 EAS 
United States, the District of Columbia, and the Com-
monwealth of Puerto Rico. 
SEC. 1627. MODIFICATION OF ACQUISITION AUTHORITY OF 
THE COMMANDER OF THE UNITED STATES 
CYBER COMMAND. 
(a) MODIFICATION OF LIMITATION ON USE OF CYBER 
OPERATIONS PROCUREMENT FUND.—Subsection (e) of sec-
tion 807 of the National Defense Authorization Act for Fis-
cal Year 2016 (Public Law 114–92; 10 U.S.C. 2224 note) 
is amended— 
(1) by striking ‘‘$75,000,000’’ and inserting 
‘‘$250,000,000’’; and 
(2) by striking ‘‘2021’’ and inserting ‘‘2025’’. 
(b) EXTENSION ON SUNSET.—Subsection (i)(1) of such 
section is amended by striking ‘‘September 30, 2021’’ and 
inserting ‘‘September 30, 2025’’. 
SEC. 1628. EMAIL AND INTERNET WEBSITE SECURITY AND 
AUTHENTICATION. 
(a) IMPLEMENTATION OF PLAN REQUIRED.—Except 
as provided by subsection (b), the Secretary of Defense shall 
develop and implement the plan outlined in Binding Oper-
ational Directive 18–01, issued by the Secretary of Home-
land Security on October 16, 2017, relating to email secu-
rity and authentication and Internet website security, ac-
cording to the schedule established by the Binding Oper-
732 
† HR 5515 EAS 
ational Directive for the rest of the Executive Branch begin-
ning with the date of enactment of this Act. 
(b) ELEMENTS.—The actions required of the Secretary 
of Defense under subsection (a) include the following: 
(1) The adoption of the START Transport Layer 
Security (STARTTLS) protocol for encryption. 
(2) Enforcement of Sender Policy Framework 
(SPF), Domain Keys Identified Mail (DKIM), and 
Domain-based Message Authentication, Reporting, 
and Conformance (DMARC) for email authentication. 
(3) Implementation of Hypertext Transfer Pro-
tocol Strict Transport Security (HSTS). 
(c) WAIVER.—The Secretary may waive the require-
ments of subsection (a) if the Secretary submits to the con-
gressional defense committees a certification that existing 
or planned security measures for the Department of Defense 
either meet or exceed the information security requirements 
of Binding Operational Directive 18–01. 
(d) FUTURE BINDING OPERATIONAL DIRECTIVES.— 
The Chief Information Officer of the Department of Defense 
shall notify the congressional defense committees within 180 
days of the issuance by the Secretary of Homeland Security 
after the date of the enactment of this Act of any Binding 
Operational Directive for cybersecurity whether the Depart-
ment of Defense will comply with the Directive or how the
733 
† HR 5515 EAS 
Department of Defense plans to meet or exceed the security 
objectives of the Directive. 
SEC. 1629. MATTERS PERTAINING TO THE SHARKSEER CY-
BERSECURITY PROGRAM. 
(a) TRANSFER OF PROGRAM.—Not later than March 
1, 2019, the Secretary of Defense shall transfer the 
Sharkseer cybersecurity program from the National Secu-
rity Agency to the Defense Information Systems Agency, in-
cluding all associated funding and, as the Secretary con-
siders necessary, personnel. 
(b) LIMITATION ON FUNDING FOR THE INFORMATION 
SYSTEMS SECURITY PROGRAM.—Of the funds authorized to 
be appropriated by this Act or otherwise made available 
for fiscal year 2019 or any subsequent fiscal year for re-
search, development, test, and evaluation for the Informa-
tion Systems Security Program for the National Security 
Agency, not more than 90 percent may be obligated or ex-
pended unless the Principal Cyber Advisor certifies to the 
congressional defense committees that the operations and 
maintenance funding for the Sharkseer program for fiscal 
year 2019 and the subsequent fiscal years of the current 
Future Years Defense Program are available or pro-
grammed. 
(c) SHARKSEER BREAK AND INSPECT CAPABILITY.—
734 
† HR 5515 EAS 
(1) IN GENERAL.—The Secretary of Defense shall 
ensure that the decryption capability described in sec-
tion 1636 of the Carl Levin and Howard P. ‘‘Buck’’ 
McKeon National Defense Authorization Act for Fis-
cal Year 2015 (Public Law 113–291) is provided by 
the break and inspect subsystem of the Sharkseer cy-
bersecurity program, unless the Principal Cyber Advi-
sor notifies the congressional defense committees on or 
before the date that is 90 days after the date of the 
enactment of this Act that a superior enterprise solu-
tion will be operational before October 1, 2019. 
(2) INTEGRATION
OF
CAPABILITY.—The Sec-
retary shall take such actions as are necessary to inte-
grate the break and inspect subsystem of the 
Sharkseer cybersecurity program with the Department 
of Defense public key infrastructure. 
(d) VISIBILITY TO ENDPOINTS.—The Secretary shall 
take such actions as are necessary to enable, by October 1, 
2020, the Sharkseer cybersecurity program and computer 
network defense service providers to instantly and auto-
matically determine the specific identity and location of 
computer hosts and other endpoints that received or sent 
malware detected by the Sharkseer cybersecurity program 
or other network perimeter defenses.
735 
† HR 5515 EAS 
(e) SANDBOX AS A SERVICE.—The Secretary shall use 
the Sharkseer cybersecurity program sandbox-as-a-service 
capability as an enterprise solution and terminate all other 
such projects, unless the Principal Cyber Advisor notifies 
the congressional defense committees on or before the date 
that is 90 days after the date of the enactment of this Act 
that a superior enterprise solution will be operational before 
October 1, 2019. 
(f) AUTHORIZATION OF APPROPRIATIONS FOR BAND-
WIDTH EXPANSION.—There is authorized to be appro-
priated $20,000,000 for procurement, defense-wide, for the 
Defense Information Systems Agency to increase the band-
width of the Sharkseer cybersecurity program to match the 
bandwidth of communications entering the Internet access 
points of the Department of Defense. 
SEC. 1630. PILOT PROGRAM ON MODELING AND SIMULA-
TION IN SUPPORT OF MILITARY HOMELAND 
DEFENSE OPERATIONS IN CONNECTION WITH 
CYBER ATTACKS ON CRITICAL INFRASTRUC-
TURE. 
(a) PILOT PROGRAM REQUIRED.— 
(1) IN
GENERAL.—The Assistant Secretary of 
Defense for Homeland Defense and Global Security 
shall carry out a pilot program that uses the results 
of research exercises of local government, industry,
736 
† HR 5515 EAS 
and military responses to combined natural disasters 
and cyber attacks on critical infrastructure in order 
to identify and develop means of improving such re-
sponses to such combined disasters and attacks. 
(2) DISCHARGE.—The Assistant Secretary shall 
carry out the pilot program through the United States 
Northern Command and the United States Cyber 
Command. 
(3) RESEARCH EXERCISES.—The pilot program 
shall be based on lessons learned from the so-called 
‘‘Jack Voltaic’’ research exercises conducted by the 
Army Cyber Institute, industry partners of the Insti-
tute, and New York, New York, and Houston, Texas. 
(b) PURPOSE.—The purpose of the pilot program shall 
be to accomplish the following: 
(1) The development and demonstration of risk 
analysis methodologies, and the application of com-
mercial simulation and modeling capabilities, based 
on artificial intelligence and hyperscale cloud com-
puting technologies, for use by the Federal Govern-
ments, States, and localities, as applicable— 
(A) to assess defense critical infrastructure 
vulnerabilities and interdependencies to improve 
military resiliency;
737 
† HR 5515 EAS 
(B) to determine the likely effectiveness of 
attacks described in subsection (a)(1), and coun-
termeasures, tactics, and tools supporting respon-
sive military homeland defense operations; 
(C) to train personnel in incident response; 
(D) to conduct exercises and test scenarios; 
and 
(E) to foster collaboration and learning be-
tween and among departments and agencies of 
the Federal Government, State and local govern-
ments, and private entities responsible for crit-
ical infrastructure. 
(2) The development and demonstration of the 
foundations for establishing and maintaining a pro-
gram of record for a shared high-fidelity, interactive, 
affordable, cloud-based modeling and simulation of 
critical infrastructure systems and incident response 
capabilities that can simulate complex cyber and 
physical attacks and disruptions on individual and 
multiple sectors on national, regional, State, and 
local scales. 
(c) REPORT.— 
(1) IN GENERAL.—At the same time the budget 
of the President for fiscal year 2020 is submitted to 
Congress pursuant to section 1105(a) of title 31,
738 
† HR 5515 EAS 
United States Code, the Assistant Secretary shall, in 
consultation with the Secretary of Homeland Secu-
rity, submit to the congressional defense committees a 
report on the pilot program. 
(2) CONTENTS.—The report required by para-
graph (1) shall include the following: 
(A) A description of the results of the exer-
cises described in subsection (a)(3) and any other 
exercises conducted as part of the pilot program 
as of the date of the report. 
(B) A list of the cybersecurity units of the 
National Guard and Reserves, and a description 
and assessment of the progress of the Assistant 
Secretary and the National Governors’ Associa-
tion in promoting multi-State mutual assistance 
compacts to share resources with respect to com-
bined natural disaster and cyber attacks de-
scribed in subsection (a)(1) as well as an assess-
ment of how the National Guard’s ability to op-
erate under dual jurisdictions and their existing 
relationships at the State and local level could be 
used in these types of events. 
(C) A description of the risk analysis meth-
odologies and modeling and simulation capabili-
ties developed and demonstrated pursuant to the
739 
† HR 5515 EAS 
pilot program, and an assessment of the poten-
tial for future growth of commercial technology 
in support of the homeland defense mission of the 
Department of Defense. 
(D) Such recommendations as the Secretary 
considers appropriate regarding the establish-
ment of a program of record for the Department 
on further development and sustainment of risk 
analysis methodologies and advanced, large-scale 
modeling and simulation on critical infrastruc-
ture and cyber warfare. 
(E) Lessons learned from the use of novel 
risk analysis methodologies and large-scale mod-
eling and simulation carried out under the pilot 
program regarding vulnerabilities, required ca-
pabilities, and reconfigured force structure, co-
ordination practices, and policy. 
(F) Planned steps for implementing the les-
sons described in subparagraph (E). 
(d) FUNDING.—Of the amounts authorized to be ap-
propriated for fiscal year 2019 by section 201 for research, 
development, test, and evaluation for the Army and avail-
able for Advanced Concepts and Simulation (Program Ele-
ment (62308A)), $10,000,000 may be available for the pilot 
program.
740 
† HR 5515 EAS 
SEC. 1631. SECURITY PRODUCT INTEGRATION FRAMEWORK. 
(a) FINDINGS.—Congress makes the following findings: 
(1) The Department of Defense requires a stand-
ard, enterprise-wide, security product integration 
framework (SPIF) that provides a machine-to-ma-
chine data exchange architecture and protocol to 
achieve interoperability and automated orchestration 
and coordinated action between and among cybersecu-
rity services, devices, appliances, agents, applications, 
tools, and command and control centers. 
(2) Information security products and services 
need to be engineered to consume and act on informa-
tion, direction, and cues from other security elements 
on a network through this framework. 
(3) A security product integration framework 
should ideally be non-proprietary or designed as a 
modular open system. 
(4) A security integration framework is essential 
to achieve the speed, scale, and agility of response re-
quired for cyber warfare, and to reduce the cost and 
time needed to integrate new products and services 
into the existing security environment. 
(b) DEMONSTRATION PROGRAM.—The Principal Cyber 
Adviser, the Chief Information Officer, and the Commander 
of the United States Cyber Command shall select a network 
or network segment and associated computer network de-
741 
† HR 5515 EAS 
fense service provider to conduct a demonstration and eval-
uation of one or more existing security product integration 
frameworks, including modifying network security systems 
to enable such systems to ingest, publish, subscribe, tip and 
cue, and request information or services from each other. 
SEC. 1632. REPORT ON ENHANCEMENT OF SOFTWARE SECU-
RITY FOR CRITICAL SYSTEMS. 
(a) REPORT REQUIRED.—Not later than March 1, 
2019, the Principal Cyber Adviser to the Secretary of De-
fense and the Chief Information Officer of the Department 
of Defense shall jointly submit to the congressional defense 
committees a report on a study, based on the authorities 
specified in subsection (b), on the costs, benefits, technical 
merits, and other merits of applying the technology de-
scribed in subsection (c) to the vulnerability assessment and 
remediation of the following: 
(1) Nuclear systems and nuclear command and 
control. 
(2) A critical subset of conventional power pro-
jection capabilities. 
(3) Cyber command and control. 
(4) Other defense critical infrastructure 
(b) BASIS FOR CONDUCT OF STUDY.—The study re-
quired for purposes of subsection (a) shall be conducted pur-
suant to the following:
742 
† HR 5515 EAS 
(1) Section 1640 of the National Defense Author-
ization Act for Fiscal Year 2018 (Public Law 115– 
91). 
(2) Section 1650 of the National Defense Author-
ization Act for Fiscal Year 2017 (10 U.S.C. 2224 
note). 
(3) Section 1647 of the National Defense Author-
ization Act for Fiscal Year 2016 (Public Law 114– 
92; 129 Stat. 1118). 
(c) TECHNOLOGIES.—The technologies described in 
this subsection are the following: 
(1) Technology developed and used by Combat 
Support Agencies of the Department of Defense to dis-
cover flaws and weaknesses in software code by 
inputting immense quantities of pseudo-random data 
(commonly referred to as ‘‘fuzz’’) to identify inputs 
that cause the software to fail. 
(2) Cloud-based software fuzzing-as-a-service to 
continuously test the security of Department of De-
fense software repositories at large scale. 
(3) Formal programming and protocol language 
for software code development and other methods and 
tools developed under the High Assurance Cyber Mili-
tary Systems program of the Defense Advanced Re-
search Projects Agency.
743 
† HR 5515 EAS 
(4) The binary analysis and symbolic execution 
software security tools developed under the Cyber 
Grand Challenge of the Defense Advanced Research 
Projects Agency. 
SEC. 1633. COMPLY TO CONNECT AND CYBERSECURITY 
SCORECARD. 
(a) LIMITATION.—After October 1, 2019, no funds may 
be obligated or expended to prepare the cybersecurity score-
card for the Secretary of Defense unless the Department of 
Defense is implementing a funded capability to meet the 
requirements— 
(1) established by the Chief Information Officer 
and the Commander of United States Cyber Com-
mand pursuant to section 1653 of the National De-
fense Authorization for Fiscal Year 2017 (Public Law 
114–328; 10 U.S.C. 2224 note); and 
(2) set forth in the Information Security Contin-
uous Monitoring Strategy, the Comply-to-Connect 
Strategy, the Enterprise Patch Management Service 
Strategy and Concept of Operations, and the User Ac-
tivity Monitoring Strategy. 
(b) REPORT.—Not later than January 10, 2019, the 
Director of Cost Assessment and Program Evaluation shall 
submit to the congressional defense committees a report
744 
† HR 5515 EAS 
comparing the current capabilities of the Department of De-
fense to— 
(1) the requirements described in subsection (a); 
and 
(2) the capabilities deployed by the Department 
of Homeland Security and the General Services Ad-
ministration under the Continuous Diagnostics and 
Mitigation program across the non-Department of De-
fense departments and agencies of the Federal Govern-
ment. 
(c) RISK THRESHOLDS.—The Chief Information Offi-
cer of the Department of Defense, in coordination with the 
Principal Cyber Advisor, the Director of Operations of the 
Joint Staff, and the Commander of United States Cyber 
Command, shall establish risk thresholds for systems and 
network operations that, when exceeded, would trigger 
heightened security measures, such as enhanced monitoring 
and access policy changes. 
(d) ENTERPRISE GOVERNANCE, RISK, AND COMPLI-
ANCE PLAN.—Not later than 180 days after the date of the 
enactment of this Act, the Chief Information Officer and 
the Principal Cyber Advisor shall develop a plan to imple-
ment an enterprise governance, risk, and compliance plat-
form and process to maintain current status of all informa-
745 
† HR 5515 EAS 
tion and operational technology assets, vulnerabilities, 
threats, and mitigations. 
SEC. 1634. CYBERSPACE SOLARIUM COMMISSION. 
(a) ESTABLISHMENT.— 
(1) IN GENERAL.—There is established a com-
mission to develop a consensus on a strategic ap-
proach to protecting the crucial advantages of the 
United States in cyberspace against the attempts of 
adversaries to erode such advantages. 
(2) DESIGNATION.—The commission established 
under paragraph (1) shall be known as the ‘‘Cyber-
space Solarium Commission’’ (in this section the 
‘‘Commission’’). 
(b) MEMBERSHIP.— 
(1) COMPOSITION.—(A) Subject to subparagraph 
(B), the Commission shall be composed of 13 mem-
bers, as follows: 
(i) The Principal Deputy Director of Na-
tional Intelligence. 
(ii) The Deputy Secretary of Homeland Se-
curity. 
(iii) The Deputy Secretary of Defense. 
(iv) Three members appointed by the major-
ity leader of the Senate, in consultation with the 
Chairman of the Committee on Armed Services
746 
† HR 5515 EAS 
of the Senate, one of whom shall be a member of 
the Senate and two of whom shall not be. 
(v) Two members appointed by the minority 
leader of the Senate, in consultation with the 
Ranking Member of the Committee on Armed 
Services of the Senate, one of whom shall be a 
member of the Senate and one of whom shall not 
be. 
(vi) Three members appointed by the Speak-
er of the House of Representatives, in consulta-
tion with the Chairman of the Committee on 
Armed Services of the House of Representatives, 
one of whom shall be a member of the House of 
Representatives and two of whom shall not be. 
(vii) Two members appointed by the minor-
ity leader of the House of Representatives, in 
consultation with the Ranking Member of the 
Committee on Armed Services of the House of 
Representatives, one of whom shall be a member 
of the House of Representatives and one of whom 
shall not be. 
(B)(i) The members of the Commission who are 
not members of Congress and who are appointed 
under clauses (iv) through (vii) of subparagraph (A)
747 
† HR 5515 EAS 
shall be individuals who are nationally recognized for 
expertise, knowledge, or experience in— 
(I) cyber strategy or national-level strategies 
to combat long-term adversaries; 
(II) cyber technology and innovation; 
(III) use of intelligence information by na-
tional policymakers and military leaders; or 
(IV) the implementation, funding, or over-
sight of the national security policies of the 
United States. 
(ii) An official who appoints members of the 
Commission may not appoint an individual as a 
member of the Commission if, in the judgment of the 
official, such individual possesses any personal or fi-
nancial interest in the discharge of any of the duties 
of the Commission. 
(iii) All members of the Commission described in 
clause (i) shall possess an appropriate security clear-
ance in accordance with applicable provisions of law 
concerning the handling of classified information. 
(2) CO-CHAIRS.—(A) The Commission shall have 
two co-chairs, selected from among the members of the 
Commission.
748 
† HR 5515 EAS 
(B) One co-chair of the Commission shall be a 
member of the Democratic Party, and one co-chair 
shall be a member of the Republican Party. 
(C) The individuals who serve as the co-chairs of 
the Commission shall be jointly agreed upon by the 
President, the majority leader of the Senate, the mi-
nority leader of the Senate, the Speaker of the House 
of Representatives, and the minority leader of the 
House of Representatives. 
(c) APPOINTMENT; INITIAL MEETING.— 
(1) APPOINTMENT.—Members of the Commission 
shall be appointed not later than 45 days after the 
date of the enactment of this Act. 
(2) INITIAL
MEETING.—The Commission shall 
hold its initial meeting on or before the date that is 
60 days after the date of the enactment of this Act. 
(d) MEETINGS; QUORUM; VACANCIES.— 
(1) IN GENERAL.—After its initial meeting, the 
Commission shall meet upon the call of the co-chairs 
of the Commission. 
(2) QUORUM.—Seven members of the Commis-
sion shall constitute a quorum for purposes of con-
ducting business, except that two members of the 
Commission shall constitute a quorum for purposes of 
receiving testimony.
749 
† HR 5515 EAS 
(3) VACANCIES.—Any vacancy in the Commis-
sion shall not affect its powers, but shall be filled in 
the same manner in which the original appointment 
was made. 
(4) QUORUM WITH VACANCIES.—If vacancies in 
the Commission occur on any day after 45 days after 
the date of the enactment of this Act, a quorum shall 
consist of a majority of the members of the Commis-
sion as of such day. 
(e) ACTIONS OF COMMISSION.— 
(1) IN GENERAL.—The Commission shall act by 
resolution agreed to by a majority of the members of 
the Commission voting and present. 
(2) PANELS.—The Commission may establish 
panels composed of less than the full membership of 
the Commission for purposes of carrying out the du-
ties of the Commission under this title. The actions of 
any such panel shall be subject to the review and con-
trol of the Commission. Any findings and determina-
tions made by such a panel shall not be considered 
the findings and determinations of the Commission 
unless approved by the Commission. 
(3) DELEGATION.—Any member, agent, or staff 
of the Commission may, if authorized by the co-chairs
750 
† HR 5515 EAS 
of the Commission, take any action which the Com-
mission is authorized to take pursuant to this title. 
(f) DUTIES.—The duties of the Commission are as fol-
lows: 
(1) To weigh the costs and benefits of various 
strategic options to reach the goal of protecting the 
advantages described in subsection (a)(1), including 
the political system of the United States, the national 
security industrial sector of the United States, and 
the innovation base of the United States. The options 
to be assessed should include deterrence, norms-based 
regimes, and cyber persistence. 
(2) To review adversarial strategies and inten-
tions, current programs for the protection of advan-
tages described in subsection (a)(1), and the capabili-
ties of the Federal Government to understand if and 
how adversaries are currently being deterred or 
thwarted in their aims and ambitions. 
(3) To evaluate the current allocation of re-
sources for understanding adversarial strategies and 
intentions and protecting the advantages described in 
subsection (a)(1). 
(4) In weighing the options for protecting advan-
tages as described in subsection (a)(1), to consider 
possible structures and authorities that need to be es-
751 
† HR 5515 EAS 
tablished, revised, or augmented within the Federal 
Government. 
(g) POWERS OF COMMISSION.— 
(1) IN GENERAL.—(A) The Commission or, on 
the authorization of the Commission, any sub-
committee or member thereof, may, for the purpose of 
carrying out the provisions of this section— 
(i) hold such hearings and sit and act at 
such times and places, take such testimony, re-
ceive such evidence, and administer such oaths; 
and 
(ii) require, by subpoena or otherwise, the 
attendance and testimony of such witnesses and 
the production of such books, records, correspond-
ence, memoranda, papers, and documents, as the 
Commission or such designated subcommittee or 
designated member considers necessary. 
(B) Subpoenas may be issued under subpara-
graph (A)(ii) under the signature of the co-chairs of 
the Commission, and may be served by any person 
designated by such co-chairs. 
(C) The provisions of sections 102 through 104 
of the Revised Statutes of the United States (2 U.S.C. 
192–194) shall apply in the case of any failure of a
752 
† HR 5515 EAS 
witness to comply with any subpoena or to testify 
when summoned under authority of this section. 
(2) CONTRACTING.—The Commission may, to 
such extent and in such amounts as are provided in 
advance in appropriation Acts, enter into contracts to 
enable the Commission to discharge its duties under 
this title. 
(3) INFORMATION FROM FEDERAL AGENCIES.— 
(A) The Commission may secure directly from any 
executive department, agency, bureau, board, commis-
sion, office, independent establishment, or instrumen-
tality of the Government information, suggestions, es-
timates, and statistics for the purposes of this title. 
(B) Each such department, agency, bureau, 
board, commission, office, establishment, or instru-
mentality shall, to the extent authorized by law, fur-
nish such information, suggestions, estimates, and 
statistics directly to the Commission, upon request of 
the co-chairs of the Commission. 
(C) The Commission shall handle and protect all 
classified information provided to it under this sec-
tion in accordance with applicable statutes and regu-
lations. 
(4) ASSISTANCE FROM FEDERAL AGENCIES.—(A) 
The Secretary of Defense shall provide to the Commis-
753 
† HR 5515 EAS 
sion, on a nonreimbursable basis, such administrative 
services, funds, staff, facilities, and other support 
services as are necessary for the performance of the 
Commission’s duties under this title. 
(B) The Director of National Intelligence may 
provide the Commission, on a nonreimbursable basis, 
with such administrative services, staff, and other 
support services as the Commission may request. 
(C) In addition to the assistance set forth in 
paragraphs (1) and (2), other departments and agen-
cies of the United States may provide the Commission 
such services, funds, facilities, staff, and other support 
as such departments and agencies consider advisable 
and as may be authorized by law. 
(D) The Commission shall receive the full and 
timely cooperation of any official, department, or 
agency of the United States Government whose assist-
ance is necessary for the fulfillment of the duties of 
the Commission under this title, including the provi-
sion of full and current briefings and analyses. 
(5) PROHIBITION
ON
WITHHOLDING
INFORMA-
TION.—No department or agency of the Government 
may withhold information from the Commission on 
the grounds that providing the information to the 
Commission would constitute the unauthorized disclo-
754 
† HR 5515 EAS 
sure of classified information or information relating 
to intelligence sources or methods. 
(6) POSTAL SERVICES.—The Commission may 
use the United States postal services in the same 
manner and under the same conditions as the depart-
ments and agencies of the United States. 
(7) GIFTS.—The Commission may accept, use, 
and dispose of gifts or donations of services or prop-
erty in carrying out its duties under this title. 
(h) STAFF OF COMMISSION.— 
(1) IN GENERAL.—(A) The co-chairs of the Com-
mission, in accordance with rules agreed upon by the 
Commission, shall appoint and fix the compensation 
of a staff director and such other personnel as may 
be necessary to enable the Commission to carry out its 
duties, without regard to the provisions of title 5, 
United States Code, governing appointments in the 
competitive service, and without regard to the provi-
sions of chapter 51 and subchapter III of chapter 53 
of such title relating to classification and General 
Schedule pay rates, except that no rate of pay fixed 
under this subsection may exceed the equivalent of 
that payable to a person occupying a position at level 
V of the Executive Schedule under section 5316 of 
such title.