6 U.S.C. § 665h — National Cyber Exercise Program

(a) Establishment of program. (1) The Agency^* must establish the National Cyber Exercise Program, called the “Exercise Program” in this section, to evaluate the National Cyber Incident^* Response Plan and other related plans and strategies. (2) The Exercise Program must: (A) be based on current risk assessments, including credible threats, vulnerabilities, and consequences; (B) as far as practicable, simulate a government or critical-infrastructure network being partly or completely disabled by a cyber incident; (C) systematically evaluate cyber readiness and improve operational understanding of the cyber-incident response system and relevant information-sharing agreements; and (D) promptly produce after-action reports and plans that can quickly apply lessons learned to future operations. It must also (i) include model exercises that government and private entities can readily adapt; and (ii) help those entities design, carry out, and evaluate exercises that meet the requirements above, fit applicable national, State, local, or Tribal plans or strategies, and systematically evaluate readiness. (3) In carrying out the program, the Director^* may consult appropriate representatives of Sector Risk Management Agencies, the Office of the National Cyber Director, cybersecurity research stakeholders, and Sector Coordinating Councils.

(b) Definitions. (1) “State” means any U.S. State, the District of Columbia, Puerto Rico, the Northern Mariana Islands, the U.S. Virgin Islands, Guam, American Samoa, or another U.S. territory or possession. (2) “Private entity” has the meaning given in 6 U.S.C. § 1501; this section does not define it.

(c) Rule of construction. This section does not change the Federal Emergency Management^* Agency Administrator’s authorities or responsibilities under 6 U.S.C. § 748.