Cyber operational readiness assessments of the Department of Defense information network

(a) Reports required Not later than March 1, 2027, and not less frequently than once each year thereafter until December 31, 2030, the Secretary of Defense shall, acting through the Commander of United States Cyber Command and the Commander of the Department of Defense Cyber Defense Command, submit to the congressional defense committees an annual report on the implementation of the Cyber Operational Readiness Assessment (CORA) program of the Department of Defense Information Network and the findings from such program. (b) Contents Each report required under subsection (a) shall include, for the period covered by the report, the following: (1) An overview of the implementation status of the Cyber Operational Readiness Assessment program, including scope, methodology, team certification status, and assessment cadence across the military departments and the defense agencies and Department of Defense field activities. (2) Aggregate and component-level findings on remediation efforts during the Cyber Operational Readiness Assessment, and component level trend analysis of such efforts. (3) Aggregate findings on risks, recurring deficiencies, and trends affecting mission assurance. (4) A progress report on the planned updates to the Inspection Analysis Tool of the Department of Defense Information Network to include root cause analysis and records of actions taken or planned to address material risks identified through the program, including timelines, responsible organizations, and any resource constraints. (5) An initial plan, and subsequent progress reports, for incorporating operational technology environments into assessments carried out under the program to ensure a comprehensive operational readiness evaluation of mission-critical systems, weapon platforms, industrial control systems, and supporting infrastructure. (6) An assessment of how assessments under the program will incorporate and operationalize the pilot Critical Infrastructure Discovery and Evaluation (CIDE) activities conducted by the Department of Defense Cyber Defense Command on operational technology networks, including alignment of scope, methodology, data collection, reporting, and resourcing to ensure unity of effort and avoid duplication. (7) A description of any policy, authority, or resourcing gaps that inhibit full execution of the program as an operational readiness assessment.