10 U.S.C. § 499a — Collection, storage, and sharing of data

Page 505 TITLE 10—ARMED FORCES § 499a ‘‘(A) IN GENERAL.—The cross functional team shall be composed of senior officers selected from among each of the military departments, the De- fense Information Systems Agency, the National Security Agency, the United States Cyber Com- mand, the United States Strategic Command, and any other organization or element of the Depart- ment of Defense determined appropriate by the Sec- retary. ‘‘(B) LEADERSHIP.—The Secretary shall designate a senior officer from those selected under subpara- graph (A) to serve as the leader of the cross-func- tional team. ‘‘(C) STAFF.—The Secretary shall ensure the heads of the organizations and elements specified in subparagraph (A) detail staff to support the cross- functional team in carrying out the duties under paragraph (3). ‘‘(3) DUTIES.—The duties of the cross-functional team shall be to enhance the cyber defense of the systems and networks that support the nuclear command, control, and communications mission. ‘‘(b) REQUIRED CONSTRUCT, PLAN OF ACTION, AND MILE- STONES.—Not later than one year after the date of the enactment of this Act, the leader of the cross-func- tional team designated pursuant to subsection (a)(2)(B) shall develop a threat-driven cyber defense construct, and associated plans and milestones, to enhance the se- curity of the systems and networks that support the nuclear command, control, and communications mis- sion. Such construct shall be based on— ‘‘(1) the application of the principles of the ap- proach to cybersecurity commonly referred to as ‘zero trust architecture’; ‘‘(2) an analysis of appropriately comprehensive endpoint and network telemetry data; and ‘‘(3) control capabilities enabling rapid investiga- tion and remediation of indicators of compromise and threats to mission execution. ‘‘(c) ANNUAL BRIEFINGS.—During the 60-day period be- ginning on the date that is 30 days before the date on which the President submits to Congress the budget of the President pursuant to section 1105(a) of title 31, United States Code, for each of fiscal years 2025 through 2028, the Secretary shall provide to the appro- priate congressional committees a briefing on the im- plementation of this section. ‘‘(d) TERMINATION.— ‘‘(1) IN GENERAL.—Except as provided in paragraph (2), the cross-functional team under this section shall terminate on October 31, 2028. ‘‘(2) EXTENSION AUTHORITY.—The Secretary of De- fense may extend the date of termination under para- graph (1) as the Secretary determines appropriate. ‘‘(e) APPROPRIATE CONGRESSIONAL COMMITTEES DE- FINED.—In this section, the term ‘appropriate congres- sional committees’ means— ‘‘(1) the congressional defense committees [Com- mittees on Armed Services and Appropriations of the Senate and the House of Representatives]; and ‘‘(2) the Permanent Select Committee on Intel- ligence of the House of Representatives.’’ ENSURING CYBER RESILIENCY OF NUCLEAR COMMAND AND CONTROL SYSTEM Pub. L. 116–283, div. A, title XVII, § 1747, Jan. 1, 2021, 134 Stat. 4140, provided that: ‘‘(a) PLAN FOR IMPLEMENTATION OF FINDINGS AND REC- OMMENDATIONS FROM FIRST ANNUAL ASSESSMENT OF CYBER RESILIENCY OF NUCLEAR COMMAND AND CONTROL SYSTEM.—Not later than October 1, 2021, the Secretary of Defense shall submit to the congressional defense committees [Committees on Armed Services and Ap- propriations of the Senate and the House of Represent- atives] a comprehensive plan, including a schedule and resourcing plan, for the implementation of the findings and recommendations included in the first report sub- mitted under section 499(c)(3) of title 10, United States Code. ‘‘(b) CONCEPT OF OPERATIONS AND OVERSIGHT MECHA- NISM FOR CYBER DEFENSE OF NUCLEAR COMMAND AND CONTROL SYSTEM.—Not later than October 1, 2021, the Secretary shall develop and establish— ‘‘(1) a concept of operations for defending the nu- clear command and control system against cyber at- tacks, including specification of the— ‘‘(A) roles and responsibilities of relevant entities within the Office of the Secretary, the military services, combatant commands, the Defense Agen- cies, and the Department of Defense Field Activi- ties; and ‘‘(B) cybersecurity capabilities to be acquired and employed and operational tactics, techniques, and procedures, including cyber protection team and sensor deployment strategies, to be used to mon- itor, defend, and mitigate vulnerabilities in nuclear command and control systems; and ‘‘(2) an oversight mechanism or governance model for overseeing the implementation of the concept of operations developed and established under para- graph (1), related development, systems engineering, and acquisition activities and programs, and the plan required by subsection (a), including specification of the— ‘‘(A) roles and responsibilities of relevant entities within the Office of the Secretary, the military services, combatant commands, the Defense Agen- cies, and the Department of Defense Field Activi- ties in overseeing the defense of the nuclear com- mand and control system against cyber attacks; ‘‘(B) responsibilities and authorities of the Stra- tegic Cybersecurity Program in overseeing and, as appropriate, executing— ‘‘(i) vulnerability assessments; and ‘‘(ii) development, systems engineering, and ac- quisition activities; and ‘‘(C) processes for coordination of activities, poli- cies, and programs relating to the cybersecurity and defense of the nuclear command and control system.’’ § 499a. Collection, storage, and sharing of data relating to nuclear security enterprise and nuclear forces (a) IN GENERAL.—The Secretary of Defense, acting through the Director of Cost Assessment and Program Evaluation, and the Administrator for Nuclear Security, acting through the Direc- tor for Cost Estimating and Program Evalua- tion, shall collect and store cost, programmatic, and technical data relating to programs and projects of the nuclear security enterprise and nuclear forces. (b) SHARING OF DATA.—If the Director of Cost Assessment and Program Evaluation or the Di- rector for Cost Estimating and Program Evalua- tion requests data relating to programs or projects from any element of the Department of Defense or from any element of the nuclear se- curity enterprise of the National Nuclear Secu- rity Administration, that element shall provide that data in a timely manner. (c) STORAGE OF DATA.—(1) Data collected by the Director of Cost Assessment and Program Evaluation and the Director for Cost Estimating and Program Evaluation under this section shall be— (A) stored in the data storage system of the Defense Cost and Resource Center, or suc- cessor center, or in a data storage system of the National Nuclear Security Administration that is comparable to the data storage system of the Defense Cost and Resource Center; and (B) made accessible to other Federal agen- cies as such Directors consider appropriate. (2) The Secretary and the Administrator shall ensure that the Director of Cost Assessment and Page 506 TITLE 10—ARMED FORCES § 499b Program Evaluation and the Director for Cost Estimating and Program Evaluation have suffi- cient information system support, as deter- mined by such Directors, to facilitate the timely hosting, handling, and sharing of data relating to programs and projects of the nuclear security enterprise under this section at the appropriate level of classification. (3) The Deputy Administrator for Naval Reac- tors of the National Nuclear Security Adminis- tration may coordinate with the Director of Cost Assessment and Program Evaluation and the Director for Cost Estimating and Program Evaluation to ensure that, at the discretion of the Deputy Administrator, data relating to pro- grams and projects of the Office of Naval Reac- tors are correctly represented in the data stor- age system pursuant to paragraph (1)(A). (d) CONTRACT REQUIREMENTS.—The Secretary and the Administrator shall ensure that any rel- evant contract relating to a program or project of the nuclear security enterprise and nuclear forces that is entered into after December 11, 2017, appropriately includes— (1) requirements and standards for data col- lection; and (2) requirements for reporting on cost, pro- grammatic, and technical data using proce- dures, standards, and formats approved by the Director of Cost Assessment and Program Evaluation and the Director for Cost Esti- mating and Program Evaluation. (e) NUCLEAR SECURITY ENTERPRISE DEFINED.— In this section, the term ‘‘nuclear security en- terprise’’ has the meaning given that term in section 4002 of the Atomic Energy Defense Act (50 U.S.C. 2501). (Added Pub. L. 115–91, div. A, title XVI, § 1652(a), Dec. 12, 2017, 131 Stat. 1757; amended Pub. L. 115–232, div. A, title X, § 1081(a)(7), Aug. 13, 2018, 132 Stat. 1983.) Editorial Notes AMENDMENTS 2018—Subsec. (d). Pub. L. 115–232 substituted ‘‘after December 11, 2017,’’ for ‘‘on or after the date of the en- actment of this section’’ in introductory provisions. § 499b. Participation in United States Strategic Command strategic deterrence exercises (a) PARTICIPATION.—In the case of annual stra- tegic deterrence exercises held by the United States Strategic Command during fiscal years 2022 through 2032— (1) the Assistant to the President for Na- tional Security Affairs is encouraged to par- ticipate in each such exercise that occurs dur- ing an even-numbered year; (2) the Deputy Assistant to the President for National Security Affairs is encouraged to participate in each such exercise that occurs during an odd-numbered year; (3) the Under Secretary of Defense for Policy shall participate, in whole or in part, in each such exercise; (4) the Vice Chairman of the Joint Chiefs of Staff shall participate, in whole or in part, in each such exercise; (5) appropriate senior staff of the Executive Office of the President or appropriate organi- zations supporting the White House relating to continuity of government activities are en- couraged to participate in each such exercise; (6) appropriate general or flag officers of the military departments, and appropriate em- ployees of Federal agencies in Senior Execu- tive Service positions (as defined in section 3132 of title 5), shall participate, in whole or in part, in each such exercise, to provide relevant expertise to the Assistant to the President for National Security Affairs and the Deputy As- sistant to the President for National Security Affairs; and (7) in the case of such an exercise for which a unified combatant command has a geo- graphic area of responsibility relevant to the scenario planned to be used for the exercise, not fewer than two of the following individ- uals from that command shall participate, in whole or in part, in the exercise: (A) The Commander. (B) The Deputy Commander. (C) The Director of the Joint Staff for Op- erations. (D) The Director of the Joint Staff for Strategic Plans and Policy. (b) BRIEFING.—Not fewer than once every four years (or more frequently if appropriate) during the period specified in subsection (a), the Presi- dent shall be provided a briefing on the annual strategic deterrence exercise held by the United States Strategic Command during the year in which the briefing is provided, including the principal findings resulting from the exercise. (c) REPORTS.—(1) Not later than 30 days after the completion of an annual strategic deter- rence exercise described in subsection (a), the Commander of the United States Strategic Com- mand shall submit to the Chairman of the Joint Chiefs of Staff and the Secretary of Defense a re- port on the exercise, which, at a minimum, shall include the following: (A) A description of the purpose and scope of the exercise. (B) An identification of the principal per- sonnel participating in the exercise. (C) A statement of the principal findings re- sulting from the exercise that specifically re- late to the nuclear command, control, and communications or senior leader decision- making process and a description of any defi- ciencies in that process identified a result of the exercise. (D) Whether the President was briefed on the exercise and the principal findings resulting from the exercise. (2) Not later than 60 days after the completion of an annual strategic deterrence exercise de- scribed in subsection (a), the Secretary shall submit to the congressional defense commit- tees— (A) an unedited copy of the report of the Commander submitted under paragraph (1); and (B) any additional recommendations or other matters the Secretary considers appro- priate. (Added Pub. L. 117–81, div. A, title XVI, § 1631, Dec. 27, 2021, 135 Stat. 2089.)