Scaling cyberspace access generation and maintenance capabilities

(a) In general In order to carry out the pilot program in subsection (c), the Secretary of Defense may enter into a contract with a private sector entity to conduct a cyber operation for the sole purpose of access generation and maintenance using contractor owned, contractor operated means, under the operational authority of the Commander of United States Cyber Command. (b) Limitations Activities carried out under subsection (a) shall— (1) only be conducted under direct Federal Government oversight of a civilian employee of the Federal Government or a member of the Armed Forces, with cleared civilian employees of the Department of Defense or cleared members of the Armed Forces present at all times; and (2) when feasible, conducted in facilities of the Federal Government. (c) Pilot program (1) In general Not later than March 1, 2027, the Secretary may establish a pilot program under the operational authority of the Commander of United States Cyber Command, to assess the feasibility and advisability of conducting cyber operations limited to access generation and maintenance through contractor owned, contractor operated means, subject to the limitations in subsection (b). (2) Termination The pilot program authorized by paragraph (1) and the authority provided under subsection (a) shall terminate on or before December 31, 2030. (d) Congressional notification (1) Contract notification Not later than 10 days after entering into any contractual arrangement under subsection (a), the Secretary shall notify the congressional defense committees of the following: (A) The date the contractual arrangement was signed. (B) Identification of the private sector party to the contractual arrangement. (C) A description of the scope and terms of the contractual arrangement. (2) Operations notification Not later than 48 hours after the commencement and subsequent conclusion of any cyber operation conducted under subsection (a), the Secretary of Defense shall notify the congressional defense committees of the following: (A) The target and nature of the access developed or maintained. (B) The identity of the cleared civilian employee of the Department or member of the Armed Forces who conducted oversight of the operation. (C) The contractor who conducted the operation. (D) The duration and current status of the operation. (e) Briefings and reports (1) Quarterly briefings The Secretary shall include a discussion of activities carried out under this section in the quarterly cyber operations briefings provided to the congressional defense committees pursuant to section 484 of title 10, United States Code. (2) Final report Not later than 90 days after the termination of the pilot program required by subsection (c), the Secretary shall submit to the congressional defense committees a report on the following: (A) An assessment of the feasibility and advisability of entering into contracts under subsection (a) on a continuing basis. (B) What constraints were applied in contracts executed under the pilot program. (C) What capabilities were acquired through contractor owned, contractor operated means. (D) An assessment of how the pilot program impacted the development of the internal access and management capabilities and talent development of the Armed Forces. (E) Recommendations for legislative or administrative action to support or modify operations carried out under subsection (a).