50 U.S.C. § 2412 — Cybersecurity Risk Inventory, Assessment, and Mitigation Working Group

(a) Establishment. The Administration has a working group called the “Cybersecurity Risk Inventory, Assessment, and Mitigation Working Group,” or “working group.” (b) Membership. The group must include (1) the Deputy Administrator for Defense Programs; (2) the Associate Administrator for Information Management and Chief Information Officer; and (3) other Administration personnel the Chairperson decides should be included. (c) Chairperson. The Deputy Administrator for Defense Programs is the Chairperson. The Administrator may instead designate another group member if the Administrator decides that is appropriate. (d) Comprehensive strategy. The group must prepare a strategy to inventory the Administration’s systems that may be at risk in operational technology and nuclear-weapons information-technology environments, assess those systems based on their effect on missions, and carry out actions to reduce the risks. The strategy must include key parts of effective cybersecurity-risk management strategies identified by the Government Accountability Office, including (1) goals, objectives, activities, and performance measures; (2) organizational roles, responsibilities, and coordination; (3) resources needed through 2034; and (4) detailed milestones and schedules for completing tasks. (e) Submission to Congress. (1) Interim briefing. Within 120 days after December 22, 2023, the group must brief the congressional defense committees^* on its plan for developing the strategy. (2) Completed strategy. By April 1, 2025, the group must give the congressional defense committees a copy of the completed strategy. (f) Termination. The group must end on a date the Administrator sets, but not before the date five years after December 22, 2023.