10 U.S.C. § 499 — Annual assessment of cyber resiliency of nuclear command and control system

(a) In General. Not less than once a year, the Commander of U.S. Strategic Command and the Commander of U.S. Cyber Command (called "the Commanders") must together assess how resilient the nuclear command and control system is against cyber attacks. (b) Elements. When they do this assessment, the Commanders must: (1) Check whether the nuclear command and control system is strong and resilient enough to keep working through a cyber attack from Russia, China, or any other country or group the Commanders name as a potential threat. (2) Come up with recommendations to fix any concerns the assessment raises. (c) Reports Required. (1) For each assessment, the Commanders must jointly send a report to the Chairman of the Joint Chiefs of Staff. The Chairman passes it to the Council on Oversight of the National Leadership Command, Control, and Communications System. The report must include: (A) The recommendations from subsection (b)(2). (B) How confident each Commander is that the nuclear deterrent can survive a top-tier cyber threat. (C) A detailed description of how the assessment was done and the technical reasoning behind its conclusions. (D) Any other comments the Commanders want to add. (2) The Council must send each report, plus its own comments, to the Secretary of Defense. (3) Within 90 days of getting a report, the Secretary of Defense must send it to the congressional defense committees, along with the Council's comments and the Secretary's own comments. (d) Quarterly Briefings. (1) At least once every quarter, the Deputy Secretary of Defense and the Vice Chairman of the Joint Chiefs of Staff must jointly brief the House and Senate Armed Services Committees. This briefing must cover: (A) Any intrusion or anomaly in the nuclear command, control, and communications system found during the previous quarter, including: (i) An assessment of any known, suspected, or possible impact on military mission effectiveness as of the briefing date; and (ii) Information about cyber intrusions into contractor networks that are known or suspected to have leaked design information about the nuclear command, control, and communications system; or (B) If no such intrusion or anomaly happened that quarter, a notice saying so. (2) This subsection defines two terms: (A) "Anomaly" means a malicious, suspicious, or abnormal cyber incident that could threaten U.S. national security or interests, or that is likely to cause real harm to U.S. national security. (B) "Intrusion" means an unauthorized, malicious cyber incident that breaks into a nuclear command, control, and communications system — either by breaking its security or by forcing it into an unsafe state. (e) Termination. All the requirements in this section end on December 31, 2032.