II 116th CONGRESS 2d Session S. 3929 IN THE SENATE OF THE UNITED STATES June 10, 2020 Mr. Peters introduced the following bill; which was read twice and referred to the Committee on Armed Services A BILL To authorize pilot programs on the remote provision by the National Guard to State governments and National Guards in other States of cybersecurity technical assistance in training, preparation, and response to cyber incidents, and for other purposes.

1. Pilot programs on remote provision by National Guard to State governments and National Guards in other States of cybersecurity technical assistance in training, preparation, and response to cyber incidents (a) Pilot programs authorized (1) In general The Secretary of the Army and the Secretary of the Air Force may each conduct a pilot program to assess the feasibility and advisability of the development of a capability within the National Guard through which a National Guard of a State remotely provides State governments and the National Guard of other States (whether or not in the same Armed Force as the providing National Guard) with cybersecurity technical assistance in training, preparation, and response to cyber incidents. (2) Construction in discharge If such Secretary elects to conduct such a pilot program, such Secretary shall be known as an administering Secretary for purposes of this section, and any reference in this section to the pilot program shall be treated as a reference to the pilot program conducted by such Secretary. (3) Coordination and consultation Except as otherwise provided in this section, if such Secretary elects to conduct such a pilot program, such Secretary shall conduct all components of the assessment in subsection (b) and all components of the pilot program and reports in subsection (i) jointly with the Secretary of Homeland Security and in consultation with the Chief of the National Guard Bureau and entities representing State governments (such as Governors and chief information officers). (b) Assessment prior to commencement For purposes of evaluating existing platforms, technologies, and capabilities under subsection (c), and for establishing eligibility and participation requirements under subsection (d), for purposes of the pilot program, an administering Secretary shall, prior to commencing the pilot program— (1) conduct an assessment of— (A) existing cyber capabilities available to States; (B) existing cyber response capacities of the Army National Guard or Air National Guard, as applicable, in each State; (C) any existing platform, technology, or capability of a National Guard that provides the capability described in subsection (a); and (D) any other available existing platform, technology, or capabilities that may provide the capability described in subsection (a); and (2) determine whether a platform, technology, or capability described in paragraph (1)(C) or (1)(D) is suitable for expansion for purposes of the pilot program. (c) Elements A pilot program under subsection (a) shall include the following: (1) A technical capability that enables the National Guard of a State to remotely provide cybersecurity technical assistance to State governments and the National Guard of other States, without the need to deploy outside its home State. The design and any development of such capability shall— (A) occur in consultation with the Secretary of Homeland Security; and (B) enable, upon deployment and operation of the capability, interoperability with other Federal and non-Federal cyber response entities, including the Department of Homeland Security. (2) Policies, processes, procedures, and authorities for use of such a capability, including with respect to the following: (A) The roles, responsibilities, and authorities of both requesting and deploying State governments, National Guards, and the Department of Homeland Security with respect to such remote technical assistance, taking into account the matters specified in subsection (f). (B) Program management and governance structures for deployment and maintenance of the capability. (C) Security when performing remote support, including such in matters such as authentication and remote sensing. (D) The efficient and effective use by Federal and non-Federal entities of the interoperability functionality of the capability, as required by paragraph (1)(B). (3) The conduct, in consultation also with the Director of the Federal Bureau of Investigation, other Federal agencies, and appropriate non-Federal entities (in addition to the entities referred to in subsection (a)(3)), of at least one exercise to demonstrate the capability, which exercise shall include the following: (A) Participation of not fewer than two State governments and their National Guards. (B) Circumstances designed to test and validate the policies, processes, procedures, and authorities developed pursuant to paragraph (2) and the interoperability functionality of the capability, as required pursuant to paragraph (1)(B). (d) Use of existing technology An administering Secretary may use an existing platform, technology, or capability to provide the capability described in subsection (a) under the pilot program. (e) Eligibility and participation requirements An administering Secretary shall establish requirements with respect to eligibility and participation of State governments and their National Guards in the pilot program. (f) Construction with certain current authorities (1) Command authorities Nothing in a pilot program under subsection (a) may be construed as affecting or altering the command authorities otherwise applicable to any unit of the National Guard unit participating in the pilot program. (2) Emergency Management Assistance Compact Nothing in a pilot program may be construed as affecting or altering any current agreement under the Emergency Management Assistance Compact, or any other State agreements, or as determinative of the future content of any such agreement. (g) Evaluation metrics An administering Secretary shall establish metrics to evaluate the effectiveness of the pilot program. (h) Term A pilot program under subsection (a) shall terminate on the date that is three years after the date of the commencement of the pilot program. (i) Reports (1) Initial report Not later than 180 days after the date of the commencement of the pilot program, the administering Secretary, in coordination solely with the Secretary of Homeland Security, shall submit to the appropriate committees of Congress a report setting forth a description of the pilot program and such other matters in connection with the pilot program as the administering Secretary considers appropriate. (2) Final report Not later than 180 days after the termination of the pilot program, the administering Secretary, in coordination solely with the Secretary of Homeland Security, shall submit to the appropriate committees of Congress a report on the pilot program. The report shall include the following: (A) A description of the pilot program, including any partnerships entered into by the administering Secretary under the pilot program. (B) A summary of the assessment performed prior to the commencement of the pilot program in accordance with subsection (b). (C) A summary of the evaluation metrics established in accordance with subsection (g). (D) An assessment of the effectiveness of the pilot program, and of the capability described in subsection (a) under the pilot program. (E) An assessment of any obstacles, either in statute or policies of the Department of Defense or the Department of Homeland Security, that impacted the effectiveness of the capability described in subsection (a) under the pilot program. (F) A description of costs associated with the implementation and conduct of the pilot program. (G) A recommendation as to the termination or extension of the pilot program, or the making of the pilot program permanent with an expansion nationwide. (H) An estimate of the costs of making the pilot program permanent and expanding it nationwide in accordance with the recommendation in subparagraph (G). (I) Appropriate proposals for updates to national cyber response plans. (J) Such recommendations for legislative or administrative action as the administering Secretary considers appropriate in light of the pilot program. (3) Joint exercise after action report Not later than 90 days after completion of the exercise described in subsection (c)(3), the administering Secretary, in coordination solely with the Secretary of Homeland Security and in consultation solely with the Chief of the National Guard Bureau, shall submit to the appropriate committees of Congress a joint Department of Defense and Department of Homeland Security after-action report on the exercise. The report shall include the following: (A) A description of the exercise scenario and participating entities. (B) A discussion of the effectiveness of the exercise in evaluating the capability described in subsection (a), including the policies, processes, procedures, and authorities developed pursuant to subsection (c)(2) and the interoperability functionality of the capability, as required pursuant to subsection (c)(1)(B). (C) A discussion of the effectiveness of the exercise in evaluating coordination between the National Guards and the Department of Homeland Security during incident response. (D) A discussion of strengths and weaknesses of interdepartment communication, coordination, and joint support to the State government or National Guard unit requesting assistance during the exercise. (E) Such recommendations for legislative or administrative action as the administering Secretary or the Secretary of Homeland Security considers appropriate in light of the exercise. (4) Appropriate committees of Congress defined In this subsection, the term appropriate committees of Congress means— (A) the Committee on Armed Services and the Committee on Homeland Security and Governmental Affairs of the Senate; and (B) the Committee on Armed Services and the Committee on Homeland Security of the House of Representatives. (j) State defined In this section, the term State means each of the several States, the District of Columbia, the Commonwealth of Puerto Rico, American Samoa, Guam, the United States Virgin Islands, and the Commonwealth of the Northern Mariana Islands. (k) Funding (1) Authorization of appropriations There is hereby authorized to be appropriated for fiscal year 2021 for the Department of Defense for operation and maintenance, Defense-wide activities, $6,000,000, with the amount to be available for administrative and service-wide activities for the Office of the Secretary of Defense for the pilot programs authorized by subsection (a). (2) Construction with other funding The amount authorized to be appropriated and available pursuant to paragraph (1) is in additional to any other amounts authorized to be appropriated for fiscal year 2021 for the Department of Defense. (l) Transfer of funds authorized The Secretary of Defense may transfer amounts available pursuant to subsection (k)(1) to the Department of Homeland Security for credit to appropriations available for the Cybersecurity and Infrastructure Security Agency of the Department of Homeland Security. Amounts so transferred shall be merged with and available for the same time period as the appropriation to which transferred, and shall be available to carry out this section.