Prohibition on the elimination of certain cyber assessment capabilities for test and evaluation

(a) Prohibition The Secretary of Defense shall not take any action to divest, consolidate, or curtail any current cyber assessment capabilities or National Security Agency (NSA)-certified red teams supporting operational test and evaluation (OT&E) for Department of Defense programs until the Secretary provides the certification described under subsection (b). (b) Certification The certification referred to in subsection (a) is a certification to the congressional defense committees that includes the following: (1) The analytic basis for making the decision to take an action described in subsection (a), including any cost, workload, and workforce requirements, as well as any analysis related to operational impact on users of cyber assessment capabilities provided by the Director of Operational Test and Evaluation (DOT&E). (2) Independent review by the Director of Cost Assessment and Program Evaluation of all such analyses provided under paragraph (1). (3) Certification by the Director of the Test Resource Management Center that such analyses and such decisions meet the requirements of the Department of Defense, as required by section 4173(c)(1)(B) of title 10, United States Code. (4) A comprehensive transition plan for critical cyber test and evaluation capabilities currently managed by the Director of Operational Test and Evaluation, including identification of receiving organizations within the services or Office of the Secretary of Defense, timeline for transfer, and measures to ensure continuity of operations. (5) A detailed assessment of funding requirements for maintaining and enhancing cyber test and evaluation capabilities during and after the transition, including how these funding elements will be incorporated into annual budget request documents. (6) A review of staffing, tools, and specialized resources needed to support cyber operational test and evaluation across major weapons and information technology programs within the receiving organizations. (7) A summary of efforts to integrate intelligence-informed threat data into operational cyber testing, including any remaining legal or technical barriers and proposed solutions. (8) A plan to improve coordination and information-sharing between cyber test and evaluation stakeholders, United States Cyber Command, and the intelligence community following the organizational transition. (9) Proposed metrics for evaluating mission effects in cyber-contested environments, consistent with guidance in the Cyber OT&E Guidebook, and how these will be maintained across organizational boundaries. (10) An assessment of the effectiveness and future needs of cyber assessment programs, including resource gaps and how these will be addressed by the receiving organizations.