Sec. 1622. Cyber posture review

312 words·~1 min read·/bill/115/hr/2810/eas/section-1622

A research copy — for the controlling text, always check the official state or federal source. Not legal advice.

In order to clarify United States cyber deterrence policy and strategy for the near term, the Secretary of Defense shall conduct a comprehensive review of the cyber posture of the United States for the next 5 to 10 years. The Secretary shall conduct the review in consultation with the Director of National Intelligence, the Attorney General, the Secretary of the Department of Homeland Security, and the Secretary of State. The cyber posture review shall include the following elements:

The role of cyber forces in United States military strategy, planning, and programming. A declaratory policy relating to United States responses to cyber attack and use of offensive cyber capabilities, guidance for the employment of offensive cyber capabilities, a public affairs plan, and an engagement plan for adversaries and allies. Proposed norms for the conduct of offensive cyber operations in crisis and conflict. Guidance for the development of cyber deterrence campaign plans focused on key leadership of Russia, China, Iran, North Korea, and any other country the Secretary determines appropriate.

Examination through analysis and gaming of escalation dynamics in various scenarios, as well as the spiral escalatory effects of countries developing increasingly potent offensive cyber capabilities, and what steps should be undertaken to bolster stability in cyberspace and more broadly stability between major powers. A certification of whether sufficient personnel are trained and equipped to meet validated cyber requirements. Such other matters as the Secretary considers appropriate.

Not later than March 1, 2018, the Secretary of Defense shall submit to Congress, in unclassified and classified forms as necessary, a report on the results of the cyber posture review conducted under this section. It is the sense of Congress that the United States should respond to all cyber attacks and to all significant cyber intrusions by imposing costs on those responsible that exceed any benefit that the attacker or intruder may have hoped to gain.