Responsibility for cyber matters in Office of Secretary of Defense

(a) Establishment of Under Secretary of Defense for Cyber, Information, and Networks (1) Office of secretary of defense Section 131(b) of title 10, United States Code is amended— (A) in paragraph (3), by adding at the end the following new subparagraph: (G) The Under Secretary of Defense for Cyber, Information, and Networks.; (B) by striking paragraph (5); and (C) by redesignating paragraphs (6) through (9) as paragraphs (5) through (8), respectively. (2) Under secretary Chapter 4 of title 10, United States Code, is amended by inserting after section 133b the following: 133c. Under Secretary of Defense for Cyber, Information, and Networks (a) Under secretary of defense There is an Under Secretary of Defense for Cyber, Information, and Networks, appointed from civilian life by the President, by and with the advice and consent of the Senate. The Under Secretary shall be appointed from among persons who have an extensive background in management, cyber operations, information technology, or related fields, and have experience with managing complex programs or organizations. A person may not be appointed as Under Secretary within seven years after relief from active duty as a commissioned officer of a regular component of an armed force. (b) Duties and powers Subject to the authority, direction, and control of the Secretary of Defense, the Under Secretary shall perform such duties and exercise such powers as the Secretary may prescribe, including— (1) serving as the Principal Cyber Advisor to the Secretary of Defense, with the authorities and responsibilities specified in section 146 of this title; (2) serving as the Chief Information Officer of the Department of Defense, with the authorities and responsibilities specified in section 142 of this title; (3) establishing Department of Defense-wide policy, strategy, and investment priorities for the adoption and integration of artificial intelligence and data strategy and management capabilities, including the development and implementation of a comprehensive data strategy to enable decision advantage across the Department; (4) establishing and enforcing Department-wide cybersecurity policy, standards, and programs, and the coordination of cybersecurity standards and policies with other Federal agencies, coalition partners, and industry; (5) providing strategic direction and policy for the information technology enterprise of the Department, including network modernization, cloud adoption, collaboration capabilities, and the development, fielding, and scaling of digital services and software capabilities across the Department; and (6) establishing policy and strategy for the recruitment, development, and retention of the cyber and information technology workforce of the Department, including the Cyber Excepted Service and related workforce development programs. (c) Precedence in department of defense (1) Precedence in matters of responsibility With regard to all matters for which the Under Secretary has responsibility by the direction of the Secretary of Defense or by law, the Under Secretary takes precedence in the Department of Defense after the Secretary and the Deputy Secretary of Defense. (2) Precedence in other matters With regard to all matters other than the matters for which the Under Secretary has responsibility by the direction of the Secretary or by law, the Under Secretary takes precedence in the Department of Defense after the Secretary, the Deputy Secretary, and the Secretaries of the military departments. (d) Organization of office of under secretary The Office of the Under Secretary of Defense for Cyber, Information, and Networks shall consist of the following: (1) An Assistant Secretary of Defense for Networks, Infrastructure, and Enterprise Software. (2) An Assistant Secretary of Defense for Cyber Policy. (3) An Assistant Secretary of Defense for Resources and Forces. (4) The Chief Digital and Artificial Intelligence Officer of the Department of Defense, who shall serve as the Chief Artificial Intelligence Officer and the Chief Data Officer of the Department of Defense, and who shall report directly to the Under Secretary. (5) The Chief Information Security Officer of the Department of Defense, who shall report directly to the Under Secretary.. (3) Deputy under secretary Section 137a of title 10, United States Code, is amended— (A) in subsection (a)(1), by striking six and inserting seven; and (B) in subsection (c), by adding at the end the following new paragraph: (7) One of the Deputy Under Secretaries is the Deputy Under Secretary of Defense for Cyber, Information, and Networks.. (4) Assistant secretary Section 138 of title 10, United States Code, is amended— (A) in subsection (a)(1), by striking 20 and inserting 21; and (B) by amending subsection (b)(9) to read as follows: (9) One of the Assistant Secretaries is the Assistant Secretary of Defense for Cyber Policy. The Assistant Secretary shall report directly to the Under Secretary of Defense for Cyber, Information, and Networks.. (b) Principal cyber advisor (1) In general Chapter 4 of title 10, United States Code, is amended by inserting after section 145 the following new section: 146. Principal Cyber Advisor and Deputy Principal Cyber Advisor (a) Principal cyber advisor (1) Establishment There is a Principal Cyber Advisor of the Department of Defense. (2) Responsibilities The Principal Cyber Advisor shall do the following: (A) Subject to the authority, direction, and control of the Secretary of Defense, exercise authority, direction, and control over all cyber-peculiar administrative matters relating to the organization, training, and equipping of cyber forces across the military departments and the United States Cyber Command. (B) Act as the principal civilian advisor to the Secretary on all cyber matters, including military cyber forces and activities. (C) After the Secretary and the Deputy Secretary, serve as the principal cyber official within the senior management of the Department of Defense. (D) Execute overall integration of the activities of cyberspace operations forces, including associated policy and operational considerations, resources, personnel, technology development and transition, and acquisition. (E) Develop, assess, and oversee the implementation of the cyber strategy of the Department and execution of the cyber posture review of the Department on behalf of the Secretary. (F) Coordinate activities pursuant to subparagraphs (A) and (B) of paragraph (3) with the Principal Information Operations Advisor and other officials as determined by the Secretary, to ensure the integration of activities in support of cyber, information technology, information, and electromagnetic spectrum operations. (G) Undertake such other matters relating to the cyberspace operations forces of the Department as the Secretary shall specify for the purposes of this subsection. (3) Cross-functional team Consistent with section 911 of the National Defense Authorization Act for Fiscal Year 2017 (Public Law 114–328; 10 U.S.C. 111 note), the Principal Cyber Advisor shall— (A) integrate the cyber expertise and perspectives of appropriate organizations within the Office of the Secretary of Defense, the Joint Staff, the military departments, the Defense Agencies, the Department of Defense Field Activities, and the combatant commands, by establishing and maintaining a full-time cross-functional team of subject-matter experts from those organizations; and (B) select team members, and designate a team leader, from among those personnel nominated by the heads of such organizations. (4) Budget review (A) Transmittal of proposed budgets The Secretary of Defense, acting through the Under Secretary of Defense (Comptroller), shall require the Secretaries of the military departments and the heads of the Defense Agencies with responsibilities associated with any activity specified in paragraph (2) to transmit the proposed budget for such activities for a fiscal year and for the period covered by the future-years defense program submitted to Congress under section 221 of this title for that fiscal year to the Principal Cyber Advisor for review under subparagraph (B) before submitting the proposed budget to the Under Secretary of Defense (Comptroller). (B) Review of proposed budgets The Principal Cyber Advisor shall review each proposed budget transmitted under subparagraph (A) and, not later than January 31 of the year preceding the fiscal year for which the budget is proposed, shall submit to the Secretary of Defense a report containing the comments of the Principal Cyber Advisor with respect to all such proposed budgets, together with the certification of the Principal Cyber Advisor regarding whether each proposed budget is adequate. (C) Report required Not later than March 31 of each year, the Secretary of Defense shall submit to Congress a report specifying each proposed budget that the Principal Cyber Advisor did not certify to be adequate. The report of the Secretary shall include the following matters: (i) A discussion of the actions that the Secretary proposes to take, together with any recommended legislation that the Secretary considers appropriate, to address the inadequacy of the proposed budgets specified in the report. (ii) Any additional comments that the Secretary considers appropriate regarding the inadequacy of the proposed budgets. (b) Senior military advisor for cyber policy and deputy principal cyber advisor (1) Advisor (A) In general The Secretary of Defense shall, acting through the Joint Staff, designate an officer within the Office of the Under Secretary of Defense for Policy to serve within that Office as the Senior Military Advisor for Cyber Policy, and concurrently, as the Deputy Principal Cyber Advisor of the Department of Defense. (B) Officers eligible for designation The officer designated pursuant to this paragraph shall be designated from among commissioned regular officers of the armed forces in a general or flag officer grade who are qualified for designation. (C) Grade The officer designated pursuant to this paragraph shall have the grade of major general or rear admiral (upper half) while serving in that position, without vacating the officer’s permanent grade. (2) Scope of positions (A) In general The officer designated pursuant to paragraph (1) is each of the following: (i) The Senior Military Advisor for Cyber Policy to the Principal Cyber Advisor. (ii) The Deputy Principal Cyber Advisor to the Secretary of Defense. (B) Direction and control and reporting In carrying out duties under this section, the officer designated pursuant to paragraph (1) shall be subject to the authority, direction, and control of, and shall report directly to, the Principal Cyber Advisor. (3) Duties (A) Duties as senior military advisor for cyber policy The duties of the officer designated pursuant to paragraph (1) as Senior Military Advisor for Cyber Policy are as follows: (i) To serve as the principal military advisor on military cyber forces and military cyber activities to the Principal Cyber Advisor. (ii) To assess and advise the Principal Cyber Advisor on aspects of policy relating to activities of cyberspace operations forces, resources, personnel, cyber force readiness, cyber workforce development, and defense of Department of Defense networks. (iii) To advocate, in consultation with the Joint Staff, and senior officers of the armed forces and the combatant commands, for consideration of military issues within the Office of the Principal Cyber Advisor, including coordination and synchronization of activities of cyberspace operations forces. (B) Duties as deputy principal cyber advisor The duties of the officer designated pursuant to paragraph (1) as Deputy Principal Cyber Advisor are as follows: (i) To synchronize, coordinate, and oversee implementation of the cyber strategy of the Department of Defense and other relevant policy and planning. (ii) To advise the Secretary of Defense on cyber programs, projects, and activities of the Department, including with respect to policy, training, resources, personnel, manpower, and acquisitions and technology. (iii) To oversee implementation of Department policy and operational directives on cyber programs, projects, and activities, including with respect to resources, personnel, manpower, and acquisitions and technology. (iv) To assist in the overall supervision of military cyber activities relating to offensive missions. (v) To assist in the overall supervision of Department defensive cyber operations, including activities of component-level cybersecurity service providers and the integration of such activities with activities of the Cyber Mission Force. (vi) To advise senior leadership of the Department on, and advocate for, investment in capabilities to execute Department missions in and through cyberspace. (vii) To identify shortfalls in capabilities to conduct Department missions in and through cyberspace, and make recommendations on addressing such shortfalls in the Program Budget Review process. (viii) To coordinate and consult with stakeholders in the cyberspace domain across the Department in order to identify other issues on cyberspace for the attention of senior leadership of the Department. (ix) On behalf of the Principal Cyber Advisor, to lead the cross-functional team established pursuant to subsection (a)(3) in order to synchronize and coordinate activities of cyberspace operations forces of the Department. (c) Cyberspace operations forces defined In this section, the term cyberspace operations forces means the military, civilian, and contractor personnel of the Department of Defense in any component of the Department of Defense organized, trained, and equipped to plan, conduct, or enable offensive cyberspace operations, defensive cyberspace operations, and Department of Defense information network operations, as designated by the Secretary of Defense.. (2) Conforming repeals Section 392a of title 10, United States Code, is amended— (A) by striking the section heading and inserting the following: 392a. Cyber governance structures on military cyber force matters; (B) by striking subsections (a) and (b); (C) by redesignating subsection (c) as subsection (a); (D) in paragraph (2) of subsection (a), as redesignated— (i) in subparagraph (A), by striking military cyberspace operations forces and inserting cyberspace operations forces; and (ii) in subparagraph (B), by striking military cyberspace operations and inserting activities of cyberspace operations forces; and (E) by adding at the end the following new subsection: (b) Cyberspace operations forces defined In this section, the term cyberspace operations forces has the meaning given that term in section 146 of this title.. (3) Transfer of functions, personnel, assets, and obligations All functions, personnel, assets, and obligations of the Department of Defense Chief Information Officer and the Principal Cyber Advisor of the Department of Defense are transferred to the Under Secretary of Defense for Cyber, Information, and Networks. (4) Conforming amendments (A) Special operations command Section 167b(d)(2)(A) of title 10, United States Code, is amended by striking section 392a(a) and inserting section 146(a). (B) Funding assessments for zero trust strategy, principles, and a model architecture Section 1528(e)(2) of the National Defense Authorization Act for Fiscal Year 2022 (Public Law 117–81; 10 U.S.C. 2224 note) is amended by striking section 392a(c)(4) and inserting section 392a(a)(4). (c) Merger of Assistant Secretary of Defense for Critical Technologies and Assistant Secretary of Defense for Mission Capabilities (1) Consolidation required The Secretary of Defense shall consolidate the positions of Assistant Secretary of Defense for Critical Technologies and the Assistant Secretary of Defense for Mission Capabilities into a single position, to be known as the Assistant Secretary of Defense for Critical Technologies and Mission Capabilities. (2) Transfer of functions All functions, personnel, assets, and obligations of the Assistant Secretary of Defense for Critical Technologies and the Assistant Secretary of Defense for Mission Capabilities are transferred to the Assistant Secretary of Defense for Critical Technologies and Mission Capabilities established pursuant to paragraph (1). (3) References Any reference in any law, regulation, guidance, instruction, or other document of the Federal Government to the Assistant Secretary of Defense for Critical Technologies or the Assistant Secretary of Defense for Mission Capabilities shall be deemed to refer to the Assistant Secretary of Defense for Critical Technologies and Mission Capabilities. (d) Executive Schedule Level III Section 5314 of title 5, United States Code, is amended by inserting after Under Secretary of Defense for Intelligence and Security. the following: Under Secretary of Defense for Cyber, Information, and Networks.. (e) Executive Schedule Level IV Section 5315 of title 5, United States Code is amended by inserting after Deputy Under Secretary of Defense for Intelligence and Security. the following: Deputy Under Secretary of Defense for Cyber, Information, and Networks.. (f) Effective date Subsections (a) through (e), and the amendments made by those subsections, shall take effect on January 20, 2029. (g) Report required Not later than January 31, 2028, the Secretary of Defense shall submit to the congressional defense committees a report on how the Department of Defense intends to execute the amendments made by subsections (a) through (e) that includes— (1) a proposed organizational chart that includes the Deputy Assistant Secretaries of Defense, the Defense Agencies, the Department of Defense Field Activities, and other offices under the new organizational structure; and (2) any recommendations the Secretary considers appropriate to improve the organizational structure of the Office of the Secretary of Defense.