50 U.S.C. § 3099 — Vulnerability assessments of major sys-

Page 676 TITLE 50—WAR AND NATIONAL DEFENSE § 3099 funds are requested for the upcoming fiscal year. (5) The numerical and percentage increase or decrease of the number referred to in para- graph (4) as compared to the number of full- time equivalent positions of the current fiscal year. (6) The numerical and percentage increase or decrease of the number referred to in para- graph (4) as compared to the number of full- time equivalent positions during the prior 5 fiscal years. (7) The best estimate of the number and costs of core contract personnel to be funded by the element for the upcoming fiscal year. (8) The numerical and percentage increase or decrease of such costs of core contract per- sonnel as compared to the best estimate of the costs of core contract personnel of the current fiscal year. (9) The numerical and percentage increase or decrease of such number and such costs of core contract personnel as compared to the number and cost of core contract personnel during the prior 5 fiscal years. (10) A justification for the requested per- sonnel and core contract personnel levels. (11) The best estimate of the number of in- telligence collectors and analysts employed by each element of the intelligence community. (12) The best estimate of the number of in- telligence collectors and analysts contracted by each element of the intelligence commu- nity and a description of the functions per- formed by such contractors. (13) A statement by the Director of National Intelligence that, based on current and pro- jected funding, the element concerned will have sufficient— (A) internal infrastructure to support the requested personnel and core contract per- sonnel levels; (B) training resources to support the re- quested personnel levels; and (C) funding to support the administrative and operational activities of the requested personnel levels. (July 26, 1947, ch. 343, title V, § 506B, as added Pub. L. 111–259, title III, § 305(a), Oct. 7, 2010, 124 Stat. 2659; amended Pub. L. 113–293, title III, § 327, Dec. 19, 2014, 128 Stat. 4006.) Editorial Notes CODIFICATION Section was formerly classified to section 415a–4 of this title prior to editorial reclassification and renum- bering as this section. AMENDMENTS 2014—Subsec. (c)(11). Pub. L. 113–293, § 327(1), struck out ‘‘or contracted’’ after ‘‘employed’’. Subsec. (c)(12), (13). Pub. L. 113–293, § 327(2), (3), added par. (12) and redesignated former par. (12) as (13). Statutory Notes and Related Subsidiaries PERSONNEL INFORMATION NOTIFICATION POLICY BY THE DIRECTOR OF NATIONAL INTELLIGENCE Pub. L. 114–113, div. M, title III, § 308, Dec. 18, 2015, 129 Stat. 2917, provided that: ‘‘(a) DIRECTIVE REQUIRED.—The Director of National Intelligence shall issue a directive containing a written policy for the timely notification to the congressional intelligence committees of the identities of individuals occupying senior level positions within the intelligence community. ‘‘(b) SENIOR LEVEL POSITION.—In identifying positions that are senior level positions in the intelligence com- munity for purposes of the directive required under subsection (a), the Director of National Intelligence shall consider whether a position— ‘‘(1) constitutes the head of an entity or a signifi- cant component within an agency; ‘‘(2) is involved in the management or oversight of matters of significant import to the leadership of an entity of the intelligence community; ‘‘(3) provides significant responsibility on behalf of the intelligence community; ‘‘(4) requires the management of a significant num- ber of personnel or funds; ‘‘(5) requires responsibility management or over- sight of sensitive intelligence activities; and ‘‘(6) is held by an individual designated as a senior intelligence management official as such term is de- fined in section 368(a)(6) of the Intelligence Author- ization Act for Fiscal Year 2010 (Public Law 111–259; 50 U.S.C. 404i–1 [now 50 U.S.C. 3051] note). ‘‘(c) NOTIFICATION.—The Director shall ensure that each notification under the directive issued under sub- section (a) includes each of the following: ‘‘(1) The name of the individual occupying the posi- tion. ‘‘(2) Any previous senior level position held by the individual, if applicable, or the position held by the individual immediately prior to the appointment. ‘‘(3) The position to be occupied by the individual. ‘‘(4) Any other information the Director determines appropriate. ‘‘(d) RELATIONSHIP TO OTHER LAWS.—The directive issued under subsection (a) and any amendment to such directive shall be consistent with the provisions of the National Security Act of 1947 (50 U.S.C. 401 [now 50 U.S.C. 3001] et seq.). ‘‘(e) SUBMISSION.—Not later than 90 days after the date of the enactment of this Act [Dec. 18, 2015], the Di- rector shall submit to the congressional intelligence committees the directive issued under subsection (a).’’ [For definitions of ‘‘congressional intelligence com- mittees’’ and ‘‘intelligence community’’ as used in sec- tion 308 of div. M of Pub. L. 114–113, set out above, see section 2 of div. M of Pub. L. 114–113, set out as a note under section 3003 of this title.] IMPLEMENTATION Pub. L. 111–259, title III, § 305(b), Oct. 7, 2010, 124 Stat. 2661, provided that: ‘‘The first assessment required to be submitted under section 506B(b) of the National Se- curity Act of 1947 [50 U.S.C. 3098(b)], as added by sub- section (a), shall be submitted to the congressional in- telligence committees at the time that the President submits to Congress the budget for fiscal year 2012 pur- suant to section 1105 of title 31, United States Code.’’ [For definition of ‘‘congressional intelligence com- mittees’’ as used in section 305(b) of Pub. L. 111–259, set out above, see section 2 of Pub. L. 111–259, set out as a note under section 3003 of this title.] § 3099. Vulnerability assessments of major sys- tems (a) Initial vulnerability assessments (1)(A) Except as provided in subparagraph (B), the Director of National Intelligence shall con- duct and submit to the congressional intel- ligence committees an initial vulnerability as- sessment for each major system and its signifi- cant items of supply— (i) except as provided in clause (ii), prior to the completion of Milestone B or an equiva- lent acquisition decision for the major system; or Page 677 TITLE 50—WAR AND NATIONAL DEFENSE § 3100 1 See References in Text note below. (ii) prior to the date that is 1 year after Oc- tober 7, 2010, in the case of a major system for which Milestone B or an equivalent acquisi- tion decision— (I) was completed prior to such date; or (II) is completed on a date during the 180- day period following such date. (B) The Director may submit to the congres- sional intelligence committees an initial vulner- ability assessment required by clause (ii) of sub- paragraph (A) not later than 180 days after the date such assessment is required to be sub- mitted under such clause if the Director notifies the congressional intelligence committees of the extension of the submission date under this sub- paragraph and provides a justification for such extension. (C) The initial vulnerability assessment of a major system and its significant items of supply shall include use of an analysis-based approach to— (i) identify vulnerabilities; (ii) define exploitation potential; (iii) examine the system’s potential effec- tiveness; (iv) determine overall vulnerability; and (v) make recommendations for risk reduc- tion. (2) If an initial vulnerability assessment for a major system is not submitted to the congres- sional intelligence committees as required by paragraph (1), funds appropriated for the acqui- sition of the major system may not be obligated for a major contract related to the major sys- tem. Such prohibition on the obligation of funds for the acquisition of the major system shall cease to apply on the date on which the congres- sional intelligence committees receive the ini- tial vulnerability assessment. (b) Subsequent vulnerability assessments (1) The Director of National Intelligence shall, periodically throughout the procurement of a major system or if the Director determines that a change in circumstances warrants the issuance of a subsequent vulnerability assess- ment, conduct a subsequent vulnerability as- sessment of each major system and its signifi- cant items of supply within the National Intel- ligence Program. (2) Upon the request of a congressional intel- ligence committee, the Director of National In- telligence may, if appropriate, recertify the pre- vious vulnerability assessment or may conduct a subsequent vulnerability assessment of a par- ticular major system and its significant items of supply within the National Intelligence Pro- gram. (3) Any subsequent vulnerability assessment of a major system and its significant items of supply shall include use of an analysis-based ap- proach and, if applicable, a testing-based ap- proach, to monitor the exploitation potential of such system and reexamine the factors described in clauses (i) through (v) of subsection (a)(1)(C). (c) Major system management The Director of National Intelligence shall give due consideration to the vulnerability as- sessments prepared for a given major system when developing and determining the National Intelligence Program budget. (d) Congressional oversight (1) The Director of National Intelligence shall provide to the congressional intelligence com- mittees a copy of each vulnerability assessment conducted under subsection (a) or (b) not later than 10 days after the date of the completion of such assessment. (2) The Director of National Intelligence shall provide the congressional intelligence commit- tees with a proposed schedule for subsequent periodic vulnerability assessments of a major system under subsection (b)(1) when providing such committees with the initial vulnerability assessment under subsection (a) of such system as required by paragraph (1). (e) Definitions In this section: (1) The term ‘‘item of supply’’ has the mean- ing given that term in section 4(10) 1 of the Of- fice of Federal Procurement Policy Act (41 U.S.C. 403(10)). (2) The term ‘‘major contract’’ means each of the 6 largest prime, associate, or Govern- ment-furnished equipment contracts under a major system that is in excess of $40,000,000 and that is not a firm, fixed price contract. (3) The term ‘‘major system’’ has the mean- ing given that term in section 3097(e) of this title. (4) The term ‘‘Milestone B’’ means a decision to enter into major system development and demonstration pursuant to guidance pre- scribed by the Director of National Intel- ligence. (5) The term ‘‘vulnerability assessment’’ means the process of identifying and quanti- fying vulnerabilities in a major system and its significant items of supply. (July 26, 1947, ch. 343, title V, § 506C, as added Pub. L. 111–259, title III, § 321(a)(1), Oct. 7, 2010, 124 Stat. 2667.) Editorial Notes REFERENCES IN TEXT Section 4(10) of the Office of Federal Procurement Policy Act, referred to in subsec. (e)(1), which was clas- sified to section 403(10) of former Title 41, Public Con- tracts, was repealed and reenacted as sections 108 and 115 of Title 41, Public Contracts, by Pub. L. 111–350, §§ 3, 7(b), Jan. 4, 2011, 124 Stat. 3677, 3855. CODIFICATION Section was formerly classified to section 415a–5 of this title prior to editorial reclassification and renum- bering as this section. § 3100. Intelligence community business system transformation (a) Limitation on obligation of funds (1) Subject to paragraph (3), no funds appro- priated to any element of the intelligence com- munity may be obligated for an intelligence community business system transformation that will have a total cost in excess of $3,000,000 unless— (A) the Director of the Office of Business Transformation of the Office of the Director of