Project Spectrum

Chapter 19 of title 10, United States Code, is amended by inserting before section 399 the following new section: 398b. Project Spectrum (a) Project Spectrum; purpose There is within the Office of Small Business Programs of the Department of Defense a program, to be known as Project Spectrum, the purpose of which is to provide to covered entities, through an online platform, digital resources and services that increase awareness about cybersecurity risks and help such covered entities to comply with the cybersecurity requirements of the defense acquisition system. (b) Eligibility The Director of the Office of Small Business Programs may establish eligibility requirements for the receipt by a covered entity of a particular resource or service made available through Project Spectrum. (c) Application To receive through Project Spectrum a resource or service for which the Director has established an eligibility requirement under subsection (b), a covered entity shall submit to the Director an application at such time, in such form, and containing such information as the Director determines appropriate. (d) Functions In carrying out Project Spectrum, the Director shall maintain an online platform through which the Director shall make available to each covered entity that the Director determines to be eligible under subsection (b) with respect to a given resource or service, the following: (1) Educational materials regarding cybersecurity, including cybersecurity training courses and workforce development training. (2) Guidance regarding best practices for cybersecurity matters, including guidance for developing internal cybersecurity policies and suggestions for procedures for reviewing any violation of such policies. (3) Assessments of the cybersecurity practices and cybersecurity systems used by a covered entity. (4) A review and feasibility assessment of products, software, and data security tools available in the commercial marketplace. (5) Cybersecurity services, including dashboard monitoring services, continuous threat monitoring services, software patching services, and patch testing services. (6) Cybersecurity readiness checks. (7) A platform for secure data collaboration between two or more employees of a covered entity and between multiple covered entities. (8) Any additional resources or services, as determined by the Director. (e) Definitions In this section: (1) The term covered entity means a supplier of the Department of Defense that is a small or medium business and registers to access the online platform of Project Spectrum. (2) The term defense acquisition system has the meaning given to such term in section 3001 of this title..