Modifications to and codification of the Department of Defense insider threat program

(a) Codification of existing program (1) Transfer to title 10 Chapter 131 of title 10, United States Code, is amended by inserting after section 2224a a new section 2225 consisting of— (A) a heading as follows: 2225. Insider threat detection; and (B) a text consisting of the text of subsections (a) and (b) of section 922 of the National Defense Authorization Act for Fiscal Year 2012 (Public Law 112‑81; 10 U.S.C. 2224 note). (2) Repeal of existing provision Section 922 of the National Defense Authorization Act for Fiscal Year 2012 (Public Law 112–81; 10 U.S.C. 2224 note) is repealed. (b) Modifications Section 2225 of title 10, United States Code, as added by subsection (a) of this section, is amended— (1) in subsection (b)— (A) in the heading, by striking Elements and inserting Required Elements; and (B) in paragraph (1)— (i) by striking subparagraphs (C), (D), (E), and (F); (ii) by redesignating subparagraphs (A) and (B) as subparagraphs (B) and (C), respectively; (iii) by inserting before subparagraph (B) (as so redesignated) the following new subparagraph: (A) user activity monitoring in accordance with the Committee on National Security Systems Directive 504, issued February 4, 2014, or any successor directive;. (iv) in subparagraph (C), as redesignated by clause (ii) of this subparagraph, by striking the semicolon and inserting; and; and (v) by redesignating subparagraph (G) as subparagraph (D); and (2) by adding at the end of the following new subsections: (c) Additional elements The Secretary may include additional elements in the program established under subsection (a), including— (1) solutions and capabilities to prevent the unauthorized export of information from a network or to render such information unusable in the event of the unauthorized export of such information; (2) using a roles-based access certification system; (3) cross-domain solutions adhering to the Raise the Bar strategy of the Cross Domain Strategy and Management Office of the National Security Agency or any successor strategy; (4) analytic solutions to detect anomalous user activity and triage user activity monitoring alerts to elevate the highest risk events for immediate review; (5) case management solutions to minimize disclosure risk, orchestrate effective response, and ensure appropriate governance; and (6) full-motion video screen recording and deep context. (d) Applicability The program established under subsection (a) shall apply to networks and enclaves used by— (1) civilian personnel of the Department of Defense; (2) privileged users; (3) members of the armed forces; and (4) contractors to the Department of Defense that have access to classified, controlled unclassified, or personally identifiable information in furtherance of work on behalf of the Department.. (c) Operating capability The Secretary of Defense shall ensure the program established under 2225 of title 10, United States Code, as added and amended by subsections (a) and (b) of this section— (1) achieves initial operating capability not later than October 1, 2027; and (2) achieves full operating capability not later than October 1, 2028. (d) Reports (1) Plan for implementation Before the Secretary implements section 2225 of title 10, United States Code, as added and amended by subsections (a) and (b) of this section, the Secretary shall submit to the congressional defense committees— (A) a written notification that describes the personnel of the Department affected by the implementation; (B) a plan to implement such section; (C) an identification of the resources required to implement such section; (D) an identification of any legal or technical concerns that may need to be addressed prior to implementation; and (E) and any other issues related to such implementation that the Secretary considers appropriate. (2) Initial operating capability Not later than December 1, 2027, the Secretary shall submit to the congressional defense committees a report on the implementation of section 2225 of title 10, United States Code, including the resources required and planned expenditures to achieve full operating capability not later than October 1, 2028.

(a) Codification of existing program (1) Transfer to title 10 Chapter 131 of title 10, United States Code, is amended by inserting after section 2224a a new section 2225 consisting of— (A) a heading as follows: 2225. Insider threat detection; and (B) a text consisting of the text of subsections (a) and (b) of section 922 of the National Defense Authorization Act for Fiscal Year 2012 (Public Law 112‑81; 10 U.S.C. 2224 note). (2) Repeal of existing provision Section 922 of the National Defense Authorization Act for Fiscal Year 2012 (Public Law 112–81; 10 U.S.C. 2224 note) is repealed. (b) Modifications Section 2225 of title 10, United States Code, as added by subsection (a) of this section, is amended— (1) in subsection (b)— (A) in the heading, by striking Elements and inserting Required Elements; and (B) in paragraph (1)— (i) by striking subparagraphs (C), (D), (E), and (F); (ii) by redesignating subparagraphs (A) and (B) as subparagraphs (B) and (C), respectively; (iii) by inserting before subparagraph (B) (as so redesignated) the following new subparagraph: (A) user activity monitoring in accordance with the Committee on National Security Systems Directive 504, issued February 4, 2014, or any successor directive;. (iv) in subparagraph (C), as redesignated by clause (ii) of this subparagraph, by striking the semicolon and inserting; and; and (v) by redesignating subparagraph (G) as subparagraph (D); and (2) by adding at the end of the following new subsections: (c) Additional elements The Secretary may include additional elements in the program established under subsection (a), including— (1) solutions and capabilities to prevent the unauthorized export of information from a network or to render such information unusable in the event of the unauthorized export of such information; (2) using a roles-based access certification system; (3) cross-domain solutions adhering to the Raise the Bar strategy of the Cross Domain Strategy and Management Office of the National Security Agency or any successor strategy; (4) analytic solutions to detect anomalous user activity and triage user activity monitoring alerts to elevate the highest risk events for immediate review; (5) case management solutions to minimize disclosure risk, orchestrate effective response, and ensure appropriate governance; and (6) full-motion video screen recording and deep context. (d) Applicability The program established under subsection (a) shall apply to networks and enclaves used by— (1) civilian personnel of the Department of Defense; (2) privileged users; (3) members of the armed forces; and (4) contractors to the Department of Defense that have access to classified, controlled unclassified, or personally identifiable information in furtherance of work on behalf of the Department.. (c) Operating capability The Secretary of Defense shall ensure the program established under 2225 of title 10, United States Code, as added and amended by subsections (a) and (b) of this section— (1) achieves initial operating capability not later than October 1, 2027; and (2) achieves full operating capability not later than October 1, 2028. (d) Reports (1) Plan for implementation Before the Secretary implements section 2225 of title 10, United States Code, as added and amended by subsections (a) and (b) of this section, the Secretary shall submit to the congressional defense committees— (A) a written notification that describes the personnel of the Department affected by the implementation; (B) a plan to implement such section; (C) an identification of the resources required to implement such section; (D) an identification of any legal or technical concerns that may need to be addressed prior to implementation; and (E) and any other issues related to such implementation that the Secretary considers appropriate. (2) Initial operating capability Not later than December 1, 2027, the Secretary shall submit to the congressional defense committees a report on the implementation of section 2225 of title 10, United States Code, including the resources required and planned expenditures to achieve full operating capability not later than October 1, 2028.