H. R. 1735—391 
‘‘(iii) in disregard of a known or obvious risk that is so 
great as to make it highly probable that the harm will outweigh 
the benefit.’’. 
(b) ADDITION OF LIABILITY PROTECTIONS FOR REPORTING ON 
CYBER INCIDENTS.—Section 391 of title 10, United States Code, 
is amended— 
(1) by redesignating subsection (d) as subsection (e); and 
(2) by inserting after subsection (c) the following new sub-
section (d): 
‘‘(d) PROTECTION FROM LIABILITY OF OPERATIONALLY CRITICAL 
CONTRACTORS.—(1) No cause of action shall lie or be maintained 
in any court against any operationally critical contractor, and such 
action shall be promptly dismissed, for compliance with this section 
that is conducted in accordance with procedures established pursu-
ant to subsection (b). 
‘‘(2)(A) Nothing in this section shall be construed— 
‘‘(i) to require dismissal of a cause of action against an 
operationally critical contractor that has engaged in willful 
misconduct in the course of complying with the procedures 
established pursuant to subsection (b); or 
‘‘(ii) to undermine or limit the availability of otherwise 
applicable common law or statutory defenses. 
‘‘(B) In any action claiming that paragraph (1) does not apply 
due to willful misconduct described in subparagraph (A), the plain-
tiff shall have the burden of proving by clear and convincing evi-
dence the willful misconduct by each operationally critical contractor 
subject to such claim and that such willful misconduct proximately 
caused injury to the plaintiff. 
‘‘(C) In this subsection, the term ‘willful misconduct’ means 
an act or omission that is taken— 
‘‘(i) intentionally to achieve a wrongful purpose; 
‘‘(ii) knowingly without legal or factual justification; and 
‘‘(iii) in disregard of a known or obvious risk that is so 
great as to make it highly probable that the harm will outweigh 
the benefit.’’. 
(c) CONFORMING AND TECHNICAL AMENDMENTS.— 
(1) Section 391 of title 10, United States Code, is amended 
in subsection (a) by striking ‘‘and with section 941 of the 
National Defense Authorization Act for Fiscal Year 2013 (10 
U.S.C. 2224 note)’’ and inserting ‘‘and section 393 of this title’’. 
(2) The table of sections at the beginning of chapter 19 
of such title is amended— 
(A) by amending the item relating to section 391 to 
read as follows: 
‘‘391. Reporting on cyber incidents with respect to networks and information sys-
tems of operationally critical contractors and certain other contractors.’’; 
and 
(B) by adding at the end the following new item: 
‘‘393. Reporting on penetrations of networks and information systems of certain con-
tractors.’’. 
SEC. 1642. AUTHORIZATION OF MILITARY CYBER OPERATIONS. 
(a) IN GENERAL.—Chapter 3 of title 10, United States Code, 
is amended by adding at the end the following new section:
H. R. 1735—392 
‘‘§ 130g. Authorities concerning military cyber operations 
‘‘The Secretary of Defense shall develop, prepare, and coordi-
nate; make ready all armed forces for purposes of; and, when 
appropriately authorized to do so, conduct, a military cyber oper-
ation in response to malicious cyber activity carried out against 
the United States or a United States person by a foreign power 
(as such terms are defined in section 101 of the Foreign Intelligence 
Surveillance Act of 1978 (50 U.S.C. 1801)).’’. 
(b) CLERICAL AMENDMENT.—The table of sections at the begin-
ning of chapter 3 of such title is amended by adding at the end 
the following new item: 
‘‘130g. Authorities concerning military cyber operations.’’. 
SEC. 1643. LIMITATION ON AVAILABILITY OF FUNDS PENDING THE 
SUBMISSION OF INTEGRATED POLICY TO DETER ADVER-
SARIES IN CYBERSPACE. 
Until the President submits to the congressional defense 
committees the report required by section 941 of the National 
Defense Authorization Act for Fiscal Year 2014 (Public Law 113– 
66; 127 Stat. 837), $10,000,000 of the unobligated balance of the 
amounts appropriated or otherwise made available to the Depart-
ment of Defense to provide support services to the Executive Office 
of the President may not be obligated or expended. 
SEC. 1644. AUTHORIZATION FOR PROCUREMENT OF RELOCATABLE 
SENSITIVE COMPARTMENTED INFORMATION FACILITY. 
Of the unobligated amounts appropriated or otherwise made 
available in fiscal years 2014 and 2015 for procurement for the 
Army, not more than $10,600,000 may be used for the procurement 
of a relocatable Sensitive Compartmented Information Facility for 
the Cyber Center of Excellence at Fort Gordon, Georgia, as 
described in the reprogramming action prior approval request sub-
mitted by the Under Secretary of Defense (Comptroller) to Congress 
on February 6, 2015. 
SEC. 1645. DESIGNATION OF MILITARY DEPARTMENT ENTITY RESPON-
SIBLE FOR ACQUISITION OF CRITICAL CYBER CAPABILI-
TIES. 
(a) DESIGNATION.— 
(1) IN GENERAL.—Not later than 90 days after the date 
of the enactment of this Act, the Secretary of Defense shall 
designate an entity within a military department to be respon-
sible for the acquisition of each critical cyber capability 
described in paragraph (2). 
(2) CRITICAL CYBER CAPABILITIES DESCRIBED.—The critical 
cyber capabilities described in this paragraph are the cyber 
capabilities that the Secretary considers critical to the mission 
of the Department of Defense, including the following: 
(A) The Unified Platform described in the Department 
of Defense document titled ‘‘The Department of Defense 
Cyber Strategy’’ dated April 15, 2015. 
(B) A persistent cyber training environment. 
(C) A cyber situational awareness and battle manage-
ment system. 
(b) REPORT.— 
(1) IN GENERAL.—Not later than 90 days after the date 
of the enactment of this Act, the Secretary shall submit to
H. R. 1735—393 
the congressional defense committees a report containing the 
information described in paragraph (2). 
(2) CONTENTS.—The report under paragraph (1) shall 
include the following with respect to the critical cyber capabili-
ties described in subsection (a)(2): 
(A) Identification of each critical cyber capability and 
the entity of a military department responsible for the 
acquisition of the capability. 
(B) Estimates of the funding requirements and acquisi-
tion timelines for each critical cyber capability. 
(C) An explanation of whether critical cyber capabilities 
could be acquired more quickly with changes to acquisition 
authorities. 
(D) Such recommendations as the Secretary may have 
for legislation or administrative action to improve the 
acquisition of, or to acquire more quickly, the critical cyber 
capabilities for which designations are made under sub-
section (a). 
SEC. 1646. ASSESSMENT OF CAPABILITIES OF UNITED STATES CYBER 
COMMAND TO DEFEND THE UNITED STATES FROM CYBER 
ATTACKS. 
(a) WAR GAMES.—The Chairman of the Joint Chiefs of Staff, 
in consultation with the Principal Cyber Advisor, shall conduct 
a series of war games through the warfighting analysis division 
of the Force Structure, Resources, and Assessment Directorate to 
assess the strategy, assumptions, and capabilities of the United 
States Cyber Command to prevent large-scale cyber attacks, by 
foreign powers with cyber attack capabilities comparable to the 
capabilities that China, Iran, North Korea, and Russia are expected 
to achieve in the years 2020 and 2025, from reaching United States 
targets. 
(b) FINDINGS.—Not later than one year after the date of the 
enactment of this Act, the Chairman of the Joint Chiefs of Staff 
shall convey to the congressional defense committees the findings 
of the Chairman with respect to the war games conducted under 
subsection (a). 
(c) FOREIGN POWER DEFINED.—In this section, the term ‘‘foreign 
power’’ has the meaning given the term in section 101 of the 
Foreign Intelligence Surveillance Act of 1978 (50 U.S.C. 1801). 
SEC. 1647. EVALUATION OF CYBER VULNERABILITIES OF MAJOR 
WEAPON SYSTEMS OF THE DEPARTMENT OF DEFENSE. 
(a) EVALUATION REQUIRED.— 
(1) IN GENERAL.—The Secretary of Defense shall, in accord-
ance with the plan under subsection (b), complete an evaluation 
of the cyber vulnerabilities of each major weapon system of 
the Department of Defense by not later than December 31, 
2019. 
(2) EXCEPTION.—The Secretary may waive the requirement 
of paragraph (1) with respect to a weapon system or complete 
the evaluation of a weapon system required by such paragraph 
after the date specified in such paragraph if the Secretary 
certifies to the congressional defense committees before that 
date that all known cyber vulnerabilities in the weapon system 
have minimal consequences for the capability of the weapon 
system to meet operational requirements or otherwise satisfy 
mission requirements.
H. R. 1735—394 
(b) PLAN FOR EVALUATION.— 
(1) IN GENERAL.—Not later than 180 days after the date 
of the enactment of this Act, the Secretary shall submit to 
the congressional defense committees the plan of the Secretary 
for the evaluations of major weapon systems under subsection 
(a), including an identification of each of the weapon systems 
to be evaluated and an estimate of the funding required to 
conduct the evaluations. 
(2) PRIORITY IN EVALUATIONS.—The plan under paragraph 
(1) shall accord a priority among evaluations based on the 
criticality of major weapon systems, as determined by the 
Chairman of the Joint Chiefs of Staff based on an assessment 
of employment of forces and threats. 
(3) INTEGRATION WITH OTHER EFFORTS.—The plan under 
paragraph (1) shall build upon existing efforts regarding the 
identification and mitigation of cyber vulnerabilities of major 
weapon systems, and shall not duplicate similar ongoing efforts 
such as Task Force Cyber Awakening of the Navy or Task 
Force Cyber Secure of the Air Force. 
(c) STATUS
ON PROGRESS.—The Secretary shall inform the 
congressional defense committees of the activities undertaken in 
the evaluation of major weapon systems under this section as 
part of the quarterly cyber operations briefings under section 484 
of title 10, United States Code. 
(d) RISK MITIGATION STRATEGIES.—As part of the evaluation 
of cyber vulnerabilities of major weapon systems of the Department 
under this section, the Secretary shall develop strategies for miti-
gating the risks of cyber vulnerabilities identified in the course 
of such evaluations. 
(e) AUTHORIZATION OF APPROPRIATIONS.—Of the funds author-
ized to be appropriated by this Act or otherwise made available 
for fiscal year 2016 for research, development, test, and evaluation, 
Defense-wide, not more than $200,000,000 shall be available to 
the Secretary to conduct the evaluations under subsection (a)(1). 
SEC. 1648. COMPREHENSIVE PLAN AND BIENNIAL EXERCISES ON 
RESPONDING TO CYBER ATTACKS. 
(a) COMPREHENSIVE PLAN OF DEPARTMENT OF DEFENSE TO SUP-
PORT CIVIL AUTHORITIES IN RESPONSE TO CYBER ATTACKS BY FOR-
EIGN POWERS.— 
(1) PLAN REQUIRED.— 
(A) IN GENERAL.—Not later than 180 days after the 
date of the enactment of this Act, the Secretary of Defense 
shall develop a comprehensive plan for the United States 
Cyber Command to support civil authorities in responding 
to cyber attacks by foreign powers (as defined in section 
101 of the Foreign Intelligence Surveillance Act of 1978 
(50 U.S.C. 1801)) against the United States or a United 
States person. 
(B) ELEMENTS.—The plan required by subparagraph 
(A) shall include the following: 
(i) A plan for internal Department of Defense 
collective training activities that are integrated with 
exercises conducted with other agencies and State and 
local governments.