Updated cyber readiness reporting methodology

(a) Update required Not later than January 1, 2028, the Commander of United States Cyber Command shall, in coordination with the Assistant Secretary of Defense for Cyber Policy and the Principal Cyber Advisors of the military departments, develop and implement an updated methodology for reporting cyber force readiness. (b) Elements In developing the updated methodology required by subsection (a), the Commander shall include considerations of the following: (1) Measurement of mastery level for cyber forces, as defined under the Department of Defense Revised Cyber Force Generation Model. (2) Extension of readiness reporting to all levels of the cyber operations forces, including cybersecurity service providers, service-specific cyber elements, and reserve component forces. (3) Standardization of unit organizational elements that input readiness data into the Joint Cyber Command and Control Readiness system. (4) Interoperability with the Defense Readiness Reporting System, or any successor system. (5) Ensure readiness reporting metrics account for— (A) shortfalls in available forces, as well as in on-hand forces that are not fully trained; and (B) forces at various stages in the training pipeline. (6) Identification of bottlenecks in the readiness system, including training backlogs, trainer shortages, and shortages in personnel available to certify teams. (7) Assessment and evaluation of the capabilities of the cyber warfighting architecture, including the systems, tools, and infrastructure required to conduct cyber operations, using defined evaluation metrics for each component, including— (A) operational availability and mission suitability of systems; (B) capacity to support assigned cyber missions and force requirements; and (C) integration and interoperability of systems across the cyber warfighting architecture. (8) Periodic spot-check auditing by the Inspector General of the Department of Defense to ensure the accuracy of cyber readiness reporting. (c) Briefing required Not later than January 29, 2027, the Commander of United States Cyber Command shall provide to the congressional defense committees a briefing on the development and implementation of the updated methodology pursuant to subsection (a), including timelines for full implementation and any legal or policy constraints impacting such timelines.