Strategy for deterrence against cyberattacks against defense critical infrastructure of the United States

(a) In general The Secretary of Defense shall, in coordination with the Assistant Secretary of Defense for Cyber Policy, the Chairman of the Joint Chiefs of Staff, the Commander of United States Cyber Command, and the Deputy Assistant Secretary of Defense for Defense Continuity and Mission Assurance, develop a strategy and a list of various courses of action across the spectrum of military capabilities to create a credible deterrence against cyberspace attacks and posturing for future such attacks against United States defense critical infrastructure. (b) Strategy (1) In general The Secretary shall ensure that the strategy required by subsection (a)— (A) includes an evaluation of how to deter actions of adversaries in cyberspace across the full spectrum of offensive planning and action; and (B) outlines a range of options available for the Department to demonstrate a credible deterrence through cost imposing courses of action. (2) Elements The strategy required by subsection (a) shall incorporate the following elements: (A) A comprehensive assessment of adversary cyber capabilities and intent regarding defense critical infrastructure attacks. (B) Identification of what specific adversary cyber capabilities and actor’s actions under this strategy seeks to deter. (C) Methodology and classification of types of targets to hold at risk and what actions would be necessary to impose costs at different levels of escalation. (D) An assessment of the capabilities and any related requirement gaps to create the needed effects against these categories of targets and their relative impact to deterrence and escalation. (E) An evaluation of the role of offensive cyber operations in combination with, as well as independent of, other means of military capabilities in creating an effective deterrent, and an assessment of the current capability and gaps in capability needed to successfully conduct these offensive cyber operations. (F) An assessment of policy and authorities in effect with respect to holding adversary targets at risk and recommendations for modifications to enable effective deterrence and managed escalation. (G) Evaluation of reveal and conceal criteria and methodology to demonstrate the United States capability of imposing costs while preserving operational security. (H) Framework for integration of interagency partners, as well as allies and partners, industry, and academia, to enhance deterrence. (3) Deadline The Secretary shall complete the development of the strategy required by subsection (a) on or before December 1, 2026. (c) Courses of action (1) In general The list of various courses of action required under subsection (a) shall include a list of military alternatives, guided by the strategy developed under such subsection, using the full range of military capabilities, including offensive cyber operations that actively impose or threaten to impose costs on an adversary to create a credible deterrence. The courses of action shall be organized for competition, crisis, and conflict. (2) Deadline Not later than June 1, 2026, the Secretary shall complete the development of the list of various courses of action required by subsection (a). (d) Briefings and submittal to congress (1) Interim briefing Not later than March 1, 2026, the Secretary shall provide to the congressional defense committees an interim briefing on the strategy required under subsection (a). (2) Final briefing and submittal Not later than June 1, 2026, the Secretary shall— (A) provide to the congressional defense committees a briefing on the strategy developed under subsection (a) and the list of various courses of action developed under such subsection; and (B) submit to the congressional defense committees a report on such strategy and such list of various courses of action. (e) Definitions In this section: (1) The term defense critical infrastructure has the meaning given that term critical infrastructure of the Department of Defense in section 1650(e) of the National Defense Authorization Act for Fiscal Year 2017 (Public Law 114–328; 10 U.S.C. 2224 note). (2) The term imposing costs means actions taken against adversaries that result in economic, diplomatic, informational, or military consequences significant enough to change the adversary’s behavior or calculations regarding cyberspace operations against the United States.