Assessment of feasibility and advisability of establishing an operational technology cybersecurity training center of excellence

(a) Assessment required (1) In general Not later than December 1, 2026, the Secretary of Defense shall, acting through the Chief Information Officer of the Department of Defense and in coordination with the Commander of United States Cyber Command and such representatives from the military departments as the Secretary considers appropriate, complete an assessment of the feasibility and advisability of establishing a center of excellence for operational technology cybersecurity training (in this section referred to as the Center) that would institutionalize training for the Department of Defense on security and protection of operational technology and industrial control systems. (2) Functions to be assessed In carrying out the assessment required by subsection (a), the Secretary shall assess the need for a Center— (A) to provide comprehensive training and other educational programs relating to operational technology and industrial control systems cybersecurity; (B) to develop and regularly update the curriculum for such training and programs; (C) to identify, develop, and integrate materiel and organizational requirements for Department of Defense operational technology and industrial control systems cybersecurity; (D) to develop and manage the integration of operational technology and industrial control systems cybersecurity solutions with military service doctrine, organization, training, materiel, leadership and education, personnel, and facilities; and (E) to leverage and benefit from readily available capacity of a military installation with— (i) existing infrastructure and multiservice training facilities (ii) a cadre or workforce of engineering and infrastructure expertise designed for functions relating to the Armed Forces; and (iii) current centers of excellence with specific consideration of existing facilities that support physical and logical cyber training ranges. (b) Report required (1) In general Not later than December 1, 2026, the Secretary shall submit to the congressional defense committees a report on the findings of the Secretary with respect to the assessment completed pursuant to subsection (a). (2) Recommendation and matters to be addressed The report submitted pursuant to paragraph (1) shall include a recommendation on whether the establishment of a Center is feasible and advisable and shall address the following: (A) An identification of curricula relating to training and education of operational technology and industrial control systems, including such training that might be provided by private sector entities. (B) Identification of anticipated throughput demands for such training for military and civilian personnel based on workforce estimates from the operational cyber community. (C) Assessment of the resources needed to establish and maintain a Center and a cost-benefit analysis to determine if the anticipated training throughput in subparagraph (B) warrants such expenditure. (D) An evaluation of potential locations that maximizes readily available capacity of a military installation and synergies with— (i) existing infrastructure and multiservice training facilities; (ii) a cadre or workforce of engineering and infrastructure expertise designed for functions related to the Armed Forces of the United States; and (iii) current centers of excellence with specific consideration of existing facilities that support physical and logical cyber training ranges. (E) If the Secretary determines that establishing a Center is feasible and advisable— (i) a proposed phased implementation approach, including initial operating capability milestones and full operational capability targets; (ii) an assessment of how a Center could integrate training and education programs with existing Department of Defense cybersecurity certification requirements and career progression models; (iii) proposed metrics and evaluation criteria that could be used to assess a Center’s effectiveness in improving operational technology and industrial control systems security outcomes across the Department of Defense, if established; (iv) estimated funding, personnel, and resource requirements for establishment and maintenance of a Center; and (v) analysis of potential challenges and limitations to establish a Center and recommendations to mitigate these challenges and limitations. (F) Proposed metrics and evaluation criteria that could be used to assess the Center’s effectiveness in improving operational technology and industrial control systems security outcomes across the Department. (c) Definitions In this section: (1) Industrial control system The term industrial control system has the meaning given such term in section 2220C of the Homeland Security Act of 2002 (6 U.S.C. 665i(f)). (2) Operational technology The term operational technology has the meaning given such term in section 3 of the Internet of Things Cybersecurity Improvement Act of 2020 (15 U.S.C. 278g–3a).

(a) Assessment required (1) In general Not later than December 1, 2026, the Secretary of Defense shall, acting through the Chief Information Officer of the Department of Defense and in coordination with the Commander of United States Cyber Command and such representatives from the military departments as the Secretary considers appropriate, complete an assessment of the feasibility and advisability of establishing a center of excellence for operational technology cybersecurity training (in this section referred to as the Center) that would institutionalize training for the Department of Defense on security and protection of operational technology and industrial control systems. (2) Functions to be assessed In carrying out the assessment required by subsection (a), the Secretary shall assess the need for a Center— (A) to provide comprehensive training and other educational programs relating to operational technology and industrial control systems cybersecurity; (B) to develop and regularly update the curriculum for such training and programs; (C) to identify, develop, and integrate materiel and organizational requirements for Department of Defense operational technology and industrial control systems cybersecurity; (D) to develop and manage the integration of operational technology and industrial control systems cybersecurity solutions with military service doctrine, organization, training, materiel, leadership and education, personnel, and facilities; and (E) to leverage and benefit from readily available capacity of a military installation with— (i) existing infrastructure and multiservice training facilities (ii) a cadre or workforce of engineering and infrastructure expertise designed for functions relating to the Armed Forces; and (iii) current centers of excellence with specific consideration of existing facilities that support physical and logical cyber training ranges. (b) Report required (1) In general Not later than December 1, 2026, the Secretary shall submit to the congressional defense committees a report on the findings of the Secretary with respect to the assessment completed pursuant to subsection (a). (2) Recommendation and matters to be addressed The report submitted pursuant to paragraph (1) shall include a recommendation on whether the establishment of a Center is feasible and advisable and shall address the following: (A) An identification of curricula relating to training and education of operational technology and industrial control systems, including such training that might be provided by private sector entities. (B) Identification of anticipated throughput demands for such training for military and civilian personnel based on workforce estimates from the operational cyber community. (C) Assessment of the resources needed to establish and maintain a Center and a cost-benefit analysis to determine if the anticipated training throughput in subparagraph (B) warrants such expenditure. (D) An evaluation of potential locations that maximizes readily available capacity of a military installation and synergies with— (i) existing infrastructure and multiservice training facilities; (ii) a cadre or workforce of engineering and infrastructure expertise designed for functions related to the Armed Forces of the United States; and (iii) current centers of excellence with specific consideration of existing facilities that support physical and logical cyber training ranges. (E) If the Secretary determines that establishing a Center is feasible and advisable— (i) a proposed phased implementation approach, including initial operating capability milestones and full operational capability targets; (ii) an assessment of how a Center could integrate training and education programs with existing Department of Defense cybersecurity certification requirements and career progression models; (iii) proposed metrics and evaluation criteria that could be used to assess a Center’s effectiveness in improving operational technology and industrial control systems security outcomes across the Department of Defense, if established; (iv) estimated funding, personnel, and resource requirements for establishment and maintenance of a Center; and (v) analysis of potential challenges and limitations to establish a Center and recommendations to mitigate these challenges and limitations. (F) Proposed metrics and evaluation criteria that could be used to assess the Center’s effectiveness in improving operational technology and industrial control systems security outcomes across the Department. (c) Definitions In this section: (1) Industrial control system The term industrial control system has the meaning given such term in section 2220C of the Homeland Security Act of 2002 (6 U.S.C. 665i(f)). (2) Operational technology The term operational technology has the meaning given such term in section 3 of the Internet of Things Cybersecurity Improvement Act of 2020 (15 U.S.C. 278g–3a).