STRATEGY FOR ACQUISITION AND OVERSIGHT OF DEPARTMENT OF DEFENSE CYBER WARFARE CAPABILITIES.

SEC. 933. STRATEGY FOR ACQUISITION AND OVERSIGHT OF DEPARTMENT OF DEFENSE CYBER WARFARE CAPABILITIES.(a) Strategy Required.—The Secretary of Defense, in consultation with the Secretaries of the military departments, shall develop a strategy to provide for the rapid acquisition of tools, applications, and other capabilities for cyber warfare for the United States Cyber Command and the cyber operations components of the military departments.(b) Basic Elements.—The strategy required by subsection (a) shall include the following:(1) An orderly process for determining and approving operational requirements.(2) A well-defined, repeatable, transparent, and disciplined process for developing capabilities to meet such requirements, in accordance with the information technology acquisition process developed pursuant to section 804 of the National Defense Authorization Act for Fiscal Year 2010 (Public Law 111–84; 10 U.S.C. 2225 note).(3) The allocation of facilities and other resources to thoroughly test such capabilities in development, before deployment, and before use in order to validate performance and take into account collateral damage and other so-called second-order effects.(c) Additional Elements.—The strategy required by subsection (a) shall also provide for the following:(1) Safeguards to prevent—(A) the circumvention of operational requirements and acquisition processes through informal relationships among the United States Cyber Command, the Armed Forces, the National Security Agency, and the Defense Information Systems Agency; and(B) the abuse of quick-reaction processes otherwise available for the rapid fielding of capabilities.(2) The establishment of reporting and oversight processes for requirements generation and approval for cyber warfare capabilities, the assignment of responsibility for providing capabilities to meet such requirements, and the execution of development and deployment of such capabilities, under the authority of the Chairman of the Joint Requirements Oversight Council, the Under Secretary of Defense for Policy, and other officials in the Office of the Secretary of Defense, as designated in the strategy.(3) The establishment and maintenance of test and evaluation facilities and resources for cyber infrastructure to support research and development, operational test and evaluation, operational planning and effects testing, and training by replicating or emulating networks and infrastructure maintained and operated by the military and political organizations of potential United States adversaries, by domestic and foreign 124 STAT. 4338 telecommunications service providers, and by the Department of Defense.(4) An organization or organizations within the Department of Defense to be responsible for the operation and maintenance of cyber infrastructure for research, development, test, and evaluation purposes.(5) Appropriate disclosure regarding United States cyber warfare capabilities to the independent test and evaluation community, and the involvement of that community in the development and maintenance of such capabilities, regardless of classification.(6) The role of the private sector and appropriate Department of Defense organizations in developing capabilities to operate in cyberspace, and a clear process for determining whether to allocate responsibility for responding to Department of Defense cyber warfare requirements through Federal Government personnel, contracts with private sector entities, or a combination of both.(7) The roles of each military department, and of the combat support Defense Agencies, in the development of cyber warfare capabilities in support of offensive, defensive, and intelligence operational requirements.(8) Mechanisms to promote information sharing, cooperative agreements, and collaboration with international, interagency, academic, and industrial partners in the development of cyber warfare capabilities.(9) The manner in which the Department of Defense will promote interoperability, share innovation, and avoid unproductive duplication in cyber warfare capabilities through specialization among the components of the Department responsible for developing cyber capabilities.(d) Report on Strategy.—(1) Report required.—Not later than 180 days after the date of the enactment of this Act, the Secretary of Defense shall submit to the appropriate committees of Congress a report on the strategy required by subsection (a). The report shall include a comprehensive description of the strategy and plans (including a schedule) for the implementation of the strategy.(2) Appropriate committees of congress defined.—In this subsection, the term “appropriate committees of Congress” means—(A) the Committee on Armed Services, the Committee on Appropriations, and the Select Committee on Intelligence of the Senate; and(B) the Committee on Armed Services, the Committee on Appropriations, and the Permanent Select Committee on Intelligence of the House of Representatives.