Department of Defense Principal Cyber Advisors Act of 2019

II 116TH CONGRESS 1ST SESSION S. 1798 To improve cyber governance structures in the Department of Defense and to require designation of principal advisors on military cyber force mat- ters, and for other purposes. IN THE SENATE OF THE UNITED STATES JUNE 12, 2019 Mr. ROUNDS (for himself and Ms. DUCKWORTH) introduced the following bill; which was read twice and referred to the Committee on Armed Services A BILL To improve cyber governance structures in the Department of Defense and to require designation of principal advi- sors on military cyber force matters, and for other pur- poses. Be it enacted by the Senate and House of Representa- 1 tives of the United States of America in Congress assembled, 2 SECTION 1. SHORT TITLE. 3 This Act may be cited as the ‘‘Department of Defense 4 Principal Cyber Advisors Act of 2019’’. 5 VerDate Sep 11 2014 00:49 Jun 14, 2019 Jkt 089200 PO 00000 Frm 00001 Fmt 6652 Sfmt 6201 E:\BILLS\S1798.IS S1798 pamtmann on DSKBFK8HB2PROD with BILLS 2 •S 1798 IS SEC. 2. CYBER GOVERNANCE STRUCTURES AND PRINCIPAL 1 ADVISORS ON MILITARY CYBER FORCE MAT- 2 TERS. 3 (a) DESIGNATION.— 4 (1) IN GENERAL.—Not later than one year 5 after the date of the enactment of this Act, each 6 Secretary of a military department shall designate a 7 Principal Cyber Advisor to act as the principal advi- 8 sor to the Secretary of the military department on 9 the cyber forces, cyber programs, and cybersecurity 10 matters of the military department, including mat- 11 ters relating to weapons systems, enabling infra- 12 structure, and the defense industrial base. 13 (2) NATURE OF POSITION.—Each Principal 14 Cyber Advisor position under paragraph (1) shall be 15 a senior civilian leadership position. 16 (b) RESPONSIBILITIES PRINCIPAL CYBER ADVI- 17 SORS.—Each Principal Cyber Advisor of a military depart- 18 ment shall be responsible for advising the Secretary of the 19 military department and coordinating and overseeing the 20 implementation of policy, strategies, sustainment, and 21 plans on the following: 22 (1) The resourcing and training of the military 23 cyber forces of the military department and ensuring 24 that such resourcing and training meets the needs of 25 United States Cyber Command. 26 VerDate Sep 11 2014 00:49 Jun 14, 2019 Jkt 089200 PO 00000 Frm 00002 Fmt 6652 Sfmt 6201 E:\BILLS\S1798.IS S1798 pamtmann on DSKBFK8HB2PROD with BILLS 3 •S 1798 IS (2) Acquisition of offensive and defensive cyber 1 capabilities for the military cyber forces of the mili- 2 tary department. 3 (3) Cybersecurity management and operations 4 of the military department. 5 (4) Acquisition of cybersecurity tools and capa- 6 bilities for the cybersecurity service providers of the 7 military department. 8 (5) Improving and enforcing a culture of cyber- 9 security warfighting and responsibility throughout 10 the military department. 11 (c) ADMINISTRATIVE MATTERS.— 12 (1) DESIGNATION OF INDIVIDUALS.—In desig- 13 nating a Principal Cyber Adviser under subsection 14 (a), the Secretary of a military department may des- 15 ignate an individual in an existing position in the 16 military department. 17 (2) COORDINATION.—The Principal Cyber Ad- 18 visor of a military department shall work in close co- 19 ordination with the Principal Cyber Advisor of the 20 Department of Defense, the Chief Information Offi- 21 cer of the Department, relevant military service chief 22 information officers, and other relevant military 23 service officers to ensure service compliance with the 24 Department of Defense Cyber Strategy. 25 VerDate Sep 11 2014 00:49 Jun 14, 2019 Jkt 089200 PO 00000 Frm 00003 Fmt 6652 Sfmt 6201 E:\BILLS\S1798.IS S1798 pamtmann on DSKBFK8HB2PROD with BILLS 4 •S 1798 IS (d) RESPONSIBILITY TO THE SENIOR ACQUISITION 1 EXECUTIVES.—In addition to the responsibilities set forth 2 in subsection (b), the Principal Cyber Advisor of a military 3 department shall be responsible for advising the senior ac- 4 quisition executive of the military department and, as de- 5 termined by the Secretary of the military department, for 6 advising and coordinating and overseeing the implementa- 7 tion of policy, strategies, sustainment, and plans for— 8 (1) cybersecurity of the industrial base; and 9 (2) cybersecurity of Department of Defense in- 10 formation systems and information technology serv- 11 ices, including how cybersecurity threat information 12 is incorporated and the development of cyber prac- 13 tices, cyber testing, and mitigation of cybersecurity 14 risks. 15 (e) REVIEW OF CURRENT RESPONSIBILITIES.— 16 (1) IN GENERAL.—Not later than January 1, 17 2021, each Secretary of a military department shall 18 review the military department’s current governance 19 model for cybersecurity with respect to current au- 20 thorities and responsibilities. 21 (2) ELEMENTS.—Each review under paragraph 22 (1) shall include the following: 23 (A) An assessment of whether additional 24 changes beyond the designation of a Principal 25 VerDate Sep 11 2014 00:49 Jun 14, 2019 Jkt 089200 PO 00000 Frm 00004 Fmt 6652 Sfmt 6201 E:\BILLS\S1798.IS S1798 pamtmann on DSKBFK8HB2PROD with BILLS 5 •S 1798 IS Cyber Advisor pursuant to subsection (a) are 1 required. 2 (B) Consideration of whether the current 3 governance structure and assignment of au- 4 thorities— 5 (i) enable effective top-down govern- 6 ance; 7 (ii) enable effective Chief Information 8 Officer and Chief Information Security Of- 9 ficer action; 10 (iii) are adequately consolidated so 11 that the authority and responsibility for 12 cybersecurity risk management is clear and 13 at an appropriate level of seniority; 14 (iv) provides authority to a single in- 15 dividual to certify compliance of Depart- 16 ment information systems and information 17 technology services with all current cyber- 18 security standards; and 19 (v) support efficient coordination 20 across the military departments and serv- 21 ices, the Office of the Secretary of De- 22 fense, the Defense Information Systems 23 Agency, and United States Cyber Com- 24 mand. 25 VerDate Sep 11 2014 00:49 Jun 14, 2019 Jkt 089200 PO 00000 Frm 00005 Fmt 6652 Sfmt 6201 E:\BILLS\S1798.IS S1798 pamtmann on DSKBFK8HB2PROD with BILLS 6 •S 1798 IS (f) BRIEFING.—Not later than February 1, 2021, 1 each Secretary of a military department shall brief the 2 congressional defense committees on the findings of the 3 Secretary with respect to the review conducted by the Sec- 4 retary under subsection (e). 5 (g) DEFINITION OF CONGRESSIONAL DEFENSE COM- 6 MITTEES.—In this section, the term ‘‘congressional de- 7 fense committees’’ has the meaning given such term in 8 section 101(a) of title 10, United States Code. 9 Æ VerDate Sep 11 2014 00:49 Jun 14, 2019 Jkt 089200 PO 00000 Frm 00006 Fmt 6652 Sfmt 6301 E:\BILLS\S1798.IS S1798 pamtmann on DSKBFK8HB2PROD with BILLS