Sec. 1704. Next generation cyber red teams
565 words·~3 min read·
/bill/118/s/2226/pap/section-1704·A research copy — for the controlling text, always check the official state or federal source. Not legal advice.
Not later than 180 days after the date of the enactment of this Act, the Under Secretary of Defense for Policy shall direct the appropriate Assistant Secretary of Defense in the Office of the Under Secretary of Defense for Policy, in consultation with the Principal Cyber Advisors of the military departments, to oversee the development and submission of a plan described in subsection
(b)to the Director of Operational Test and Evaluation (OT&E) and the Director of the National Security Agency
(NSA)for assessment under subsection (c). The plan described in this subsection is a plan— to modernize cyber red teams ( CRTs ) with a focus on utilizing cyber threat intelligence and threat modeling to ensure the ability to emulate advanced nation-state threats, automation, artificial intelligence or machine learning capabilities, and data collection and correlation; to establish joint service standards and metrics to ensure cyber red teams are adequately trained, staffed, and equipped to emulate advanced nation-state threats; and to expand partnerships between the Department of Defense, particularly existing cyber red teams, and academia to expand the cyber talent workforce. The Director of Operational Test and Evaluation shall, in coordination with the Director of the National Security Agency, review the plan submitted pursuant to subsection
(a)and in doing so shall conduct an assessment of the plan with consideration of the following: Opportunities for cyber red team operations to expand across the competition continuum, including during the cooperation and competition phases, strongly emphasizing pre-conflict preparation of the battlespace to better match adversary positioning and cyber activities, including operational security assessments to strengthen the ability of the Department to gain and maintain a tactical advantage. The extent to which critical and emerging technologies and concepts such as artificial intelligence and machine learning enabled analysis and process automation can reduce the amount of person hours operators spend on maintenance and reporting to maximize research and training time. Identification of training requirements, and changes to training, sustainment practices, or concepts of operation or employment that may be needed to ensure the effectiveness, suitability, and sustainability of the next generation of cyber red teams. The extent to which additional resources or partnerships may be needed to remediate personnel shortfalls in cyber red teams, including funding for internship programs, hiring, and contracting. Not later than one year after the date of enactment of this Act, the Secretary of Defense shall issue such policies and guidance and prescribe such regulations as the Secretary determines necessary to carry out the plan required by subsection (a). Not later than January 31, 2025, and not less frequently than annually thereafter until January 31, 2031, the Director of Operational Test and Evaluation shall include in the annual report required by section 139(h) of title 10, United States Code, the following: The findings of the Director with respect to the assessment carried out pursuant to subsection (c). The results of test and evaluation events, including any resource and capability shortfalls limiting the ability of cyber red teams to meet operational requirements. The extent to which operations of cyber red teams have expanded across the competition continuum, including during cooperation and competition phases, to match adversary positioning and cyber activities. A summary of identified categories of common gaps and shortfalls across military department and Defense Agency cyber red teams. Any identified lessons learned that would affect training or operational employment decisions relating to cyber red teams.