H. R. 2810—456 
U.S.C. 1541 note), or any requirement under the National Security 
Act of 1947 (50 U.S.C. 3001 et seq.).’’. 
(b) CLERICAL AMENDMENT.—The table of sections at the begin-
ning of such chapter is amended by adding at the end the following 
new items: 
‘‘130j. Notification requirements for sensitive military cyber operations 
‘‘130k. Notification requirements for cyber weapons’’. 
SEC. 1632. MODIFICATION TO QUARTERLY CYBER OPERATIONS 
BRIEFINGS. 
(a) IN GENERAL.—Section 484 of title 10, United States Code, 
is amended— 
(1) by striking ‘‘The Secretary of Defense shall provide 
to the Committees on Armed Services of the House of Rep-
resentatives and the Senate’’ and inserting the following: 
‘‘(a) BRIEFINGS REQUIRED.—The Secretary of Defense shall pro-
vide to the congressional defense committees’’; and 
(2) by adding at the end the following: 
‘‘(b) ELEMENTS.—Each briefing under subsection (a) shall 
include, with respect to the military operations in cyberspace 
described in such subsection, the following: 
‘‘(1) An update, set forth separately for each geographic 
and functional command, that describes the operations carried 
out by the command and any hostile cyber activity directed 
at the command. 
‘‘(2) An overview of authorities and legal issues applicable 
to the operations, including any relevant legal limitations. 
‘‘(3) An outline of any interagency activities and initiatives 
relating to the operations. 
‘‘(4) Any other matters the Secretary determines to be 
appropriate.’’. 
(b) EFFECTIVE DATE.—The amendments made by subsection 
(a) shall take effect on the date of the enactment of this Act, 
and shall apply with respect to briefings required be provided 
under section 484 of title 10, United States Code, on or after 
that date. 
SEC. 1633. POLICY OF THE UNITED STATES ON CYBERSPACE, CYBERSE-
CURITY, AND CYBER WARFARE. 
(a) IN GENERAL.—The President shall— 
(1) develop a national policy for the United States relating 
to cyberspace, cybersecurity, and cyber warfare; and 
(2) submit to the appropriate congressional committees a 
report on the policy. 
(b) ELEMENTS.—The national policy required under subsection 
(a) shall include the following elements: 
(1) Delineation of the instruments of national power avail-
able to deter or respond to cyber attacks or other malicious 
cyber activities by a foreign power or actor that targets United 
States interests. 
(2) Available or planned response options to address the 
full range of potential cyber attacks on United States interests 
that could be conducted by potential adversaries of the United 
States. 
(3) Available or planned denial options that prioritize the 
defensibility and resiliency against cyber attacks and malicious
H. R. 2810—457 
cyber activities that are carried out against infrastructure crit-
ical to the political integrity, economic security, and national 
security of the United States. 
(4) Available or planned cyber capabilities that may be 
used to impose costs on any foreign power targeting the United 
States or United States persons with a cyber attack or malicious 
cyber activity. 
(5) Development of multi-prong response options, such as— 
(A) boosting the cyber resilience of critical United 
States strike systems (including cyber, nuclear, and non- 
nuclear systems) in order to ensure the United States 
can credibly threaten to impose unacceptable costs in 
response to even the most sophisticated large-scale cyber 
attack; 
(B) developing offensive cyber capabilities and specific 
plans and strategies to put at risk targets most valued 
by adversaries of the United States and their key decision 
makers; and 
(C) enhancing attribution capabilities and developing 
intelligence and offensive cyber capabilities to detect, dis-
rupt, and potentially expose malicious cyber activities. 
(c) LIMITATION ON AVAILABILITY OF FUNDS.— 
(1) IN
GENERAL.—Of the funds authorized to be appro-
priated by this Act or otherwise made available for fiscal year 
2018 for procurement, research, development, test and evalua-
tion, and operations and maintenance, for the covered activities 
of the Defense Information Systems Agency, not more than 
60 percent may be obligated or expended until the date on 
which the President submits to the appropriate congressional 
committees the report under subsection (a)(2). 
(2) COVERED ACTIVITIES DESCRIBED.—The covered activities 
referred to in paragraph (1) are the activities of the Defense 
Information Systems Agency in support of— 
(A) the White House Communication Agency; and 
(B) the White House Situation Support Staff. 
(d) DEFINITIONS.—In this section: 
(1) The term ‘‘foreign power’’ has the meaning given that 
term in section 101 of the Foreign Intelligence Surveillance 
Act of 1978 (50 U.S.C. 1801). 
(2) The term ‘‘appropriate congressional committees’’ 
means— 
(A) the congressional defense committees; 
(B) the Committee on Foreign Affairs, the Committee 
on Homeland Security, and the Committee on the Judiciary 
of the House of Representatives; and 
(C) the Committee on Foreign Relations, the Com-
mittee on Homeland Security and Governmental Affairs, 
and the Committee on the Judiciary of the Senate. 
SEC. 1634. PROHIBITION ON USE OF PRODUCTS AND SERVICES DEVEL-
OPED OR PROVIDED BY KASPERSKY LAB. 
(a) PROHIBITION.—No department, agency, organization, or 
other element of the Federal Government may use, whether directly 
or through work with or on behalf of another department, agency, 
organization, or element of the Federal Government, any hardware, 
software, or services developed or provided, in whole or in part, 
by—
H. R. 2810—458 
(1) Kaspersky Lab (or any successor entity); 
(2) any entity that controls, is controlled by, or is under 
common control with Kaspersky Lab; or 
(3) any entity of which Kaspersky Lab has majority owner-
ship. 
(b) EFFECTIVE DATE.—The prohibition in subsection (a) shall 
take effect on October 1, 2018. 
(c) REVIEW AND REPORT.— 
(1) REVIEW.—The Secretary of Defense, in consultation with 
the Secretary of Energy, the Secretary of Homeland Security, 
the Attorney General, the Administrator of the General Services 
Administration, and the Director of National Intelligence, shall 
conduct a review of the procedures for removing suspect prod-
ucts or services from the information technology networks of 
the Federal Government. 
(2) REPORT.— 
(A) IN GENERAL.—Not later than 180 days after the 
date of the enactment of this Act, Secretary of Defense 
shall submit to the appropriate congressional committees 
a report on the review conducted under paragraph (1). 
(B) ELEMENTS.—The report under subparagraph (A) 
shall include the following: 
(i) A description of the Federal Government-wide 
authorities that may be used to prohibit, exclude, or 
prevent the use of suspect products or services on 
the information technology networks of the Federal 
Government, including— 
(I) the discretionary authorities of agencies 
to prohibit, exclude, or prevent the use of such 
products or services; 
(II) the authorities of a suspension and debar-
ment official to prohibit, exclude, or prevent the 
use of such products or services; 
(III) authorities relating to supply chain risk 
management; 
(IV) authorities that provide for the continuous 
monitoring of information technology networks to 
identify suspect products or services; and 
(V) the authorities provided under the Federal 
Information Security Management Act of 2002. 
(ii) Assessment of any gaps in the authorities 
described in clause (i), including any gaps in the 
enforcement of decisions made under such authorities. 
(iii) An explanation of the capabilities and meth-
odologies used to periodically assess and monitor the 
information technology networks of the Federal 
Government for prohibited products or services. 
(iv) An assessment of the ability of the Federal 
Government to periodically conduct training and exer-
cises in the use of the authorities described in clause 
(i)— 
(I) to identify recommendations for stream-
lining process; and 
(II) to identify recommendations for education 
and training curricula, to be integrated into 
existing training or certification courses.
H. R. 2810—459 
(v) A description of information sharing mecha-
nisms that may be used to share information about 
suspect products or services, including mechanisms for 
the sharing of such information among the Federal 
Government, industry, the public, and international 
partners. 
(vi) Identification of existing tools for business 
intelligence, application management, and commerce 
due-diligence that are either in use by elements of 
the Federal Government, or that are available commer-
cially. 
(vii) Recommendations for improving the authori-
ties, processes, resourcing, and capabilities of the Fed-
eral Government for the purpose of improving the 
procedures for identifying and removing prohibited 
products or services from the information technology 
networks of the Federal Government. 
(viii) Any other matters the Secretary determines 
to be appropriate. 
(C) FORM.—The report under subparagraph (A) shall 
be submitted in unclassified form, but may include a classi-
fied annex. 
(3) APPROPRIATE CONGRESSIONAL COMMITTEES DEFINED.— 
In this section, the term ‘‘appropriate congressional committees’’ 
means the following: 
(A) The Committee on Armed Services, the Committee 
on Energy and Commerce, the Committee on Homeland 
Security, the Committee on the Judiciary, the Committee 
on Oversight and Government Reform, and the Permanent 
Select Committee on Intelligence of the House of Represent-
atives. 
(B) The Committee on Armed Services, the Committee 
on Energy and Natural Resources, the Committee on Home-
land Security and Governmental Affairs, the Committee 
on the Judiciary, and the Select Committee on Intelligence 
of the Senate. 
SEC. 1635. MODIFICATION OF AUTHORITIES RELATING TO ESTABLISH-
MENT OF UNIFIED COMBATANT COMMAND FOR CYBER 
OPERATIONS. 
Section 167b of title 10, United States Code, is amended— 
(1) by striking subsection (d); and 
(2) by redesignating subsections (e) and (f) as subsections 
(d) and (e), respectively. 
SEC. 
1636. 
MODIFICATION 
OF 
DEFINITION 
OF 
ACQUISITION 
WORKFORCE TO INCLUDE PERSONNEL CONTRIBUTING 
TO CYBERSECURITY SYSTEMS. 
Section 1705(h)(2)(A) of title 10, United States Code, is 
amended— 
(1) by inserting ‘‘(i)’’ after ‘‘(A)’’; 
(2) by striking ‘‘; and’’ and inserting ‘‘; or’’; and 
(3) by adding at the end the following new clause: 
‘‘(ii) contribute significantly to the acquisition or 
development of systems relating to cybersecurity; and’’.
H. R. 2810—460 
SEC. 1637. INTEGRATION OF STRATEGIC INFORMATION OPERATIONS 
AND CYBER-ENABLED INFORMATION OPERATIONS. 
(a) PROCESSES AND PROCEDURES FOR INTEGRATION.— 
(1) IN GENERAL.—The Secretary of Defense shall— 
(A) establish processes and procedures to integrate 
strategic 
information 
operations 
and 
cyber-enabled 
information operations across the elements of the Depart-
ment of Defense responsible for such operations, including 
the elements of the Department responsible for military 
deception, public affairs, electronic warfare, and cyber oper-
ations; and 
(B) ensure that such processes and procedures provide 
for integrated Defense-wide strategy, planning, and budg-
eting with respect to the conduct of such operations by 
the Department, including activities conducted to counter 
and deter such operations by malign actors. 
(2) DESIGNATED
SENIOR
OFFICIAL.—The Secretary of 
Defense shall designate a senior official of the Department 
of Defense (in this section referred to as the ‘‘designated senior 
official’’) who shall implement and oversee the processes and 
procedures established under paragraph (1). The designated 
senior official shall be selected by the Secretary from among 
individuals serving in the Department of Defense at or below 
the level of an Under Secretary of Defense. 
(3) RESPONSIBILITIES.—The designated senior official shall 
have, with respect to the implementation and oversight of the 
processes and procedures established under paragraph (1), the 
following responsibilities: 
(A) Oversight of strategic policy and guidance. 
(B) Overall resource management for the integration 
of information operations and cyber-enabled information 
operations of the Department. 
(C) Coordination with the head of the Global Engage-
ment Center to support the purpose of the Center (as 
described section 1287(a)(2) of the National Defense 
Authorization Act for Fiscal Year 2017 (Public Law 114– 
328; 22 U.S.C. 2656 note)) and liaison with the Center 
and other relevant Federal Government entities to support 
such purpose. 
(D) Development of a strategic framework for the con-
duct of information operations by the Department of 
Defense, including cyber-enabled information operations, 
coordinated across all relevant elements of the Department 
of Defense, including both near-term and long-term guid-
ance for the conduct of such coordinated operations. 
(E) Development and dissemination of a common oper-
ating paradigm across the elements of the Department 
of Defense specified in paragraph (1) to counter the influ-
ence, deception, and propaganda activities of key malign 
actors, including in cyberspace. 
(F) Development of guidance for, and promotion of, 
the capability of the Department of Defense to liaison with 
the private sector, including social media, on matters 
relating to the influence activities of malign actors. 
(b) REQUIREMENTS AND PLANS FOR INFORMATION OPERATIONS.— 
(1) 
COMBATANT
COMMAND
PLANNING
AND
REGIONAL 
STRATEGY.—(A) The Secretary shall require each commander
H. R. 2810—461 
of a combatant command to develop, in coordination with the 
relevant regional Assistant Secretary of State or Assistant Sec-
retaries of State and with the assistance of the Coordinator 
of the Global Engagement Center and the designated senior 
official, a regional information strategy and interagency 
coordination plan for carrying out the strategy, where 
applicable. 
(B) The Secretary shall require each commander of 
a combatant command to develop such requirements and 
specific plans as may be necessary for the conduct of 
information operations in support of the strategy required 
under subparagraph (A), including plans for deterring 
information operations, including deterrence in the cyber 
domain, by malign actors against the United States, allies 
of the United States, and interests of the United States. 
(2) IMPLEMENTATION PLAN FOR DOD STRATEGY FOR OPER-
ATIONS IN THE INFORMATION ENVIRONMENT.— 
(A) IN GENERAL.—Not later than 180 days after the 
date of the enactment of this Act, the designated senior 
official shall— 
(i) review the strategy of the Department of 
Defense titled ‘‘Department of Defense Strategy for 
Operations in the Information Environment’’ and dated 
June 2016; and 
(ii) submit to the congressional defense committees 
a plan for implementation of such strategy. 
(B) ELEMENTS.—The plan required under subpara-
graph (A) shall include, at a minimum, the following: 
(i) An accounting of the efforts undertaken in sup-
port of the strategy described in subparagraph (A)(i) 
in the period since it was issued in June 2016. 
(ii) A description of any updates or changes to 
such strategy that have been made since it was first 
issued, as well as any expected updates or changes 
resulting from the designation of the designated senior 
official. 
(iii) A description of the role of the Department 
of Defense as part of a broader whole-of-Government 
strategy for strategic communications, including a 
description of any assumptions about the roles and 
contributions of other departments and agencies of the 
Federal Government with respect to such a strategy. 
(iv) Defined actions, performance metrics, and pro-
jected timelines for achieving each of the 15 tasks 
specified in the strategy described in subparagraph 
(A)(i). 
(v) An analysis of any personnel, resourcing, capa-
bility, authority, or other gaps that will need to be 
addressed to ensure effective implementation of the 
strategy described in subparagraph (A)(i) across all 
relevant elements of the Department of Defense. 
(vi) An investment framework and projected 
timeline for addressing any gaps identified under 
clause (v). 
(vii) Such other matters as the Secretary of 
Defense considers relevant.
H. R. 2810—462 
(C) PERIODIC
STATUS
REPORTS.—Not less frequently 
than once every 90 days during the three-year period begin-
ning on the date on which the implementation plan is 
submitted under subparagraph (A)(ii), the designated 
senior official shall submit to the congressional defense 
committees a report describing the status of the efforts 
of the Department of Defense in accomplishing the tasks 
specified under clauses (iv) and (vi) of subparagraph (B). 
(c) TRAINING AND EDUCATION.—Consistent with the elements 
of the implementation plan under paragraph (2), the designated 
senior official shall recommend the establishment of programs to 
provide training and education to such members of the Armed 
Forces and civilian employees of the Department of Defense as 
the Secretary considers appropriate to ensure that such members 
and employees understand the role of information in warfare, the 
central goal of all military operations to affect the perceptions, 
views, and decision making of adversaries, and the effective 
management and conduct of operations in the information environ-
ment. 
SEC. 1638. EXERCISE ON ASSESSING CYBERSECURITY SUPPORT TO 
ELECTION SYSTEMS OF STATES. 
(a) INCLUSION OF CYBER VULNERABILITIES IN ELECTION SYS-
TEMS IN CYBER GUARD EXERCISES.—Subject to subsection (b), the 
Secretary of Defense, in consultation with the Secretary of Home-
land Security, may carry out exercises relating to the cybersecurity 
of election systems of States as part of the exercise commonly 
known as the ‘‘Cyber Guard Exercise’’. 
(b) AGREEMENT REQUIRED.—The Secretary of Defense may 
carry out an exercise relating to the cybersecurity of a State’s 
election system under subsection (a) only if the State enters into 
a written agreement with the Secretary under which the State— 
(1) agrees to participate in such exercise; and 
(2) agrees to allow vulnerability testing of the components 
of the State’s election system. 
(c) REPORT.—Not later than 90 days after the completion of 
any Cyber Guard Exercise, the Secretary of Defense shall submit 
to the congressional defense committees a report on the ability 
of the National Guard to assist States, if called upon, in defending 
election systems from cyberattacks. Such report shall include a 
description of the capabilities, readiness levels, and best practices 
of the National Guard with respect to the prevention of cyber 
attacks on State election systems. 
SEC. 1639. MEASUREMENT OF COMPLIANCE WITH CYBERSECURITY 
REQUIREMENTS FOR INDUSTRIAL CONTROL SYSTEMS. 
(a) IN GENERAL.—Not later than January 1, 2018, the Secretary 
of Defense shall make such changes to the cybersecurity scorecard 
as are necessary to ensure that the Secretary measures the progress 
of each element of the Department of Defense in securing the 
industrial control systems of the Department against cyber threats, 
including such industrial control systems as supervisory control 
and data acquisition systems, distributed control systems, program-
mable logic controllers, and platform information technology. 
(b) CYBERSECURITY SCORECARD DEFINED.—In this section, the 
term ‘‘cybersecurity scorecard’’ means the Department of Defense 
Cybersecurity Scorecard used by the Department to measure compli-
ance with cybersecurity requirements as described in the plan of
H. R. 2810—463 
the Department titled ‘‘Department of Defense Cybersecurity Dis-
cipline Implementation Plan’’. 
SEC. 1640. STRATEGIC CYBERSECURITY PROGRAM. 
(a) IN GENERAL.—Not later than 180 days after the date of 
the enactment of this Act, the Secretary of Defense, in consultation 
with the Director of the National Security Agency, shall submit 
to the congressional defense committees a plan for the establish-
ment of a program to be known as the ‘‘Strategic Cybersecurity 
Program’’ or ‘‘SCP’’ (in this section referred to as the ‘‘Program’’). 
(b) ELEMENTS.—The Program shall be comprised of personnel 
assigned to the Program by the Secretary of Defense from among 
personnel, including regular and reserve members of the Armed 
Forces, civilian employees of the Department, and personnel of 
the research laboratories of the Department of Defense and the 
Department of Energy, who have particular expertise in the areas 
of responsibility described in subsection (c). Any personnel assigned 
to the Program from among personnel of the Department of Energy 
shall be so assigned with the concurrence of the Secretary of Energy. 
(c) RESPONSIBILITIES.— 
(1) IN GENERAL.—Personnel assigned to the Program shall 
assist the Department of Defense in improving the cybersecu-
rity of the following systems of the Federal Government: 
(A) Offensive cyber systems. 
(B) Long-range strike systems. 
(C) Nuclear deterrent systems. 
(D) National security systems. 
(E) Critical infrastructure of the Department of 
Defense (as that term is defined in section 1650(f)(1) of 
the National Defense Authorization Act for Fiscal Year 
2017 (Public Law 114–328; 10 U.S.C. 2224 note)). 
(2) REVIEWS OF SYSTEMS AND INFRASTRUCTURE.—In car-
rying out the activities described in paragraph (1), the personnel 
assigned to the Program shall conduct appropriate reviews 
of existing systems and infrastructure and acquisition plans 
for proposed systems and infrastructure. The review of an 
acquisition plan for any proposed system or infrastructure shall 
be carried out before Milestone B approval for such system 
or infrastructure. 
(3) RESULTS OF REVIEWS.—The results of each review car-
ried out under paragraph (2), including any remedial action 
recommended pursuant to such review, shall be made available 
to any agencies or organizations of the Department involved 
in the development, procurement, operation, or maintenance 
of the system or infrastructure concerned. 
(d) INTEGRATION WITH OTHER EFFORTS.—The plan required 
under subsection (a) shall build upon, and shall not duplicate, 
other efforts of the Department of Defense relating to cybersecurity, 
including— 
(1) the evaluation of cyber vulnerabilities of major weapon 
systems of the Department of Defense required under section 
1647 of the National Defense Authorization Act for Fiscal Year 
2016 (114–92; 129 Stat. 1118); 
(2) the evaluation of cyber vulnerabilities of Department 
of Defense critical infrastructure required under section 1650 
of the National Defense Authorization Act for Fiscal Year 2017 
(Public Law 114–328; 10 U.S.C. 2224 note); and
H. R. 2810—464 
(3) the activities of the cyber protection teams of the 
Department of Defense. 
(e) REPORT.—Not later than one year after the date on which 
the plan is submitted to the congressional defense committees under 
subsection (a), the Secretary of Defense shall submit to the congres-
sional defense committees a report on any activities carried out 
pursuant to such plan. The report shall include the following: 
(1) A description of any activities of the Program carried 
out pursuant to the plan during the time period covered by 
the report. 
(2) A description of particular challenges encountered in 
the course of the activities of the Program, if any, and of 
actions taken to address such challenges. 
(3) A description of any plans for additional activities under 
the Program. 
SEC. 1641. PLAN TO INCREASE CYBER AND INFORMATION OPER-
ATIONS, DETERRENCE, AND DEFENSE. 
(a) PLAN.—The Secretary of Defense shall develop a plan to— 
(1) increase inclusion of regional cyber planning within 
larger joint planning exercises of the United States in the 
Indo-Asia-Pacific region; 
(2) enhance joint, regional, and combined information oper-
ations and strategic communication strategies to counter Chi-
nese and North Korean information warfare, malign influence, 
and propaganda activities; and 
(3) identify potential areas of cybersecurity collaboration 
and partnership capabilities with Asian allies and partners 
of the United States. 
(b) BRIEFING.—Not later than 180 days after the date of the 
enactment of this Act, the Secretary of Defense shall provide to 
the congressional defense committees a briefing on the plan required 
under subsection (a). 
SEC. 1642. EVALUATION OF AGILE OR ITERATIVE DEVELOPMENT OF 
CYBER TOOLS AND APPLICATIONS. 
(a) EVALUATION REQUIRED.—The Commander of the United 
States Cyber Command (in this section referred to as the ‘‘Com-
mander’’) shall conduct an evaluation of alternative methods for 
developing, acquiring, and maintaining software-based cyber tools 
and applications for the United States Cyber Command, the Army 
Cyber Command, the Fleet Cyber Command, the Air Force Cyber 
Command, and the Marine Corps Cyberspace Command. 
(b) GOAL.—The goal of the evaluation required by subsection 
(a) shall be to identify a set of practices that will— 
(1) increase the speed of development of cyber capabilities 
of the Armed Forces; 
(2) provide more effective tools and capabilities for devel-
oping, acquiring, and maintaining software-based cyber tools 
and applications for the Armed Forces; and 
(3) create a repeatable, disciplined process for developing, 
acquiring, and maintaining software-based cyber tools and 
applications for the Armed Forces through which progress and 
success or failure can be continuously measured. 
(c) CONSIDERATION OF AGILE OR ITERATIVE DEVELOPMENT, AND 
OTHER BEST PRACTICES.— 
(1) IN GENERAL.—The evaluation required by subsection 
(a) shall include, with respect to the development, acquisition,