Sec. 1736. DEFENSE INDUSTRIAL BASE CYBERSECURITY SENSOR ARCHITECTURE PLAN

364 words·~2 min read·/statute-compilations/comps-16736/sec-1736

A research copy — for the controlling text, always check the official state or federal source. Not legal advice.

## SEC. 1736 DEFENSE INDUSTRIAL BASE CYBERSECURITY SENSOR ARCHITECTURE PLAN ###

(a)Defense Industrial Base Cybersecurity Sensor Architecture Program Assessment Not later than 180 days after the date of the enactment of this Act, the Principal Cyber Advisor of the Department of Defense, in consultation with the Chief Information Officer of the Department, the Under Secretary of Defense for Acquisition and Sustainment, the Under Secretary of Defense for Intelligence and Security, and the Commander of United States Cyber Command, shall complete an assessment of the feasibility, suitability, and resourcing required to establish a Defense Industrial Base Cybersecurity Sensor Architecture Program, responsible for deploying commercial-off-the-shelf solutions to remotely monitor the public-facing internet attack surface of the defense industrial base. ###

(b)Elements The assessment required under subsection

(a)shall include the following: ####

(1)Definition of an architecture, concept of operations, and governance structure that— #####

(A)will allow for the instrumentation and collection of cybersecurity data on the public-facing internet attack surfaces of defense industrial base contractors in a manner that is compatible with the Department’s existing or future capabilities for analysis, and instrumentation and collection, as appropriate, of cybersecurity data within the Department of Defense Information Network; #####

(B)includes the expected scale, schedule, and guiding principles of deployment; #####

(C)is consistent with the defense industrial base cybersecurity policies and programs of the Under Secretary of Defense for Acquisition and Sustainment and the Chief Information Officer; and #####

(D)includes an acquisition strategy for sensor capabilities that optimizes required capability, scalability, cost, and intelligence and cybersecurity requirements. ####

(2)Roles and responsibilities of the persons referred to in subsection

(a)in implementing and executing the plan. ###

(c)Consultation In conducting the assessment required under subsection (a), the Principal Cyber Advisor shall consult with and solicit recommendations from representative industry stakeholders across the defense industrial base regarding the elements described in subsection

(b)and potential stakeholder costs of compliance. ###

(d)Briefing Upon completion of the assessment required under subsection (a), the Principal Cyber Advisor shall provide a briefing to the Committee on Armed Services of the Senate and the Committee on Armed Services of the House of Representatives on the assessment.