Study and report on National Guard capabilities in cyber incident response

(a) Study required The Secretary of Defense, in consultation with the Chief of the National Guard Bureau, the Secretary of Homeland Security, and the heads of other relevant federal agencies, shall conduct a comprehensive study to evaluate the capabilities and authorities of the National Guard in responding to cyber incidents affecting national security. (b) Elements of study The study required under subsection (a) shall include the following: (1) An assessment of the current roles and responsibilities of the National Guard in cyber incident response, including— (A) engagements under Federal authority, such as those pursuant to title 10, United States Code; and (B) deployments under State authority, initiated by Governors pursuant to title 32, United States Code, or State law. (2) An analysis of existing legal authorities governing the National Guard’s participation in cyber incident response, including any limitations or gaps in such authorities. (3) An evaluation of resource allocation for National Guard cyber response capabilities, including personnel, equipment, and funding. (4) An assessment of training programs and needs for National Guard personnel to effectively respond to cyber incidents, including joint training with Federal agencies and private sector entities. (5) A review of coordination mechanisms between the National Guard, Federal agencies (including the Department of Defense, the Department of Homeland Security, and the Cybersecurity and Infrastructure Security Agency), State governments, and private sector partners involved in cyber incident response. (6) Identification of challenges or barriers to enhancing the National Guard’s role in cyber incident response and recommendations to address such challenges. (c) Report to Congress (1) In general Not later than 180 days after the date of the enactment of this Act, the Secretary of Defense shall submit to the congressional defense committees the study required under subsection (a). (2) Form The report shall be submitted in unclassified form but may include a classified annex if necessary.