,,ii  #aafth ,,congress  #ast ,session  
,s4 #agih  ,,in ,,the ,,senate ,,of     
,,the ,,united ,,states  ,june #ab1     
#bjai,mr4 ,rounds 7for himself and ,ms4 
,duckworth7 introduced the following    
bill2 which was read twice and referred 
to the ,committee on ,armed ,services   
,a ,,bill  ,to improve cyber governance 
structures in the ,department of        
,defense and to require designation of  
principal advisors on military cyber    
force matters1 and for other purposes4  
#a4 ,short title ,this ,act may be cited
 as the ,department of ,defense         
,principal ,cyber ,advisors ,act of     
#bjai4  #b4 ,cyber governance structures
 and principal advisors on military     
cyber force matters  7a7 ,designation   
7#a7 ,in general ,not later than one    
year after the date of the enactment of 
this ,act1 each ,secretary of a military
 department shall designate a ,principal
 ,cyber ,advisor to act as the principal
 advisor to the ,secretary of the       
military department on the cyber forces1

 cyber programs1 and cybersecurity      
matters of the military department1     
including matters relating to weapons   
systems1 enabling infrastructure1 and   
the defense industrial base4  7#b7      
,nature of position ,each ,principal    
,cyber ,advisor position under paragraph
 7#a7 shall be a senior civilian        
leadership position4  7b7               
,responsibilities ,principal ,cyber     
,advisors ,each ,principal ,cyber       
,advisor of a military department shall 
be responsible for advising the         
,secretary of the military department   
and coordinating and overseeing the     
implementation of policy1 strategies1   
sustainment1 and plans on the following3
  7#a7 ,the resourcing and training of  
the military cyber forces of the        
military department and ensuring that   
such resourcing and training meets the  
needs of ,united ,states ,cyber         
,command4  7#b7 ,acquisition of         
offensive and defensive cyber           
capabilities for the military cyber     

forces of the military department4  7#c7
 ,cybersecurity management and          
operations of the military department4  
7#d7 ,acquisition of cybersecurity tools
 and capabilities for the cybersecurity 
service providers of the military       
department4  7#e7 ,improving and        
enforcing a culture of cybersecurity    
warfighting and responsibility          
throughout the military department4  7c7
 ,administrative matters  7#a7          
,designation of individuals ,in         
designating a ,principal ,cyber ,adviser
 under subsection 7a71 the ,secretary of
 a military department may designate an 
individual in an existing position in   
the military department4  7#b7          
,coordination ,the ,principal ,cyber    
,advisor of a military department shall 
work in close coordination with the     
,principal ,cyber ,advisor of the       
,department of ,defense1 the ,chief     
,information ,officer of the            
,department1 relevant military service  
chief information officers1 and other   

relevant military service officers to   
ensure service compliance with the      
,department of ,defense ,cyber          
,strategy4  7d7 ,responsibility to the  
senior acquisition executives ,in       
addition to the responsibilities set    
forth in subsection 7b71 the ,principal 
,cyber ,advisor of a military department
 shall be responsible for advising the  
senior acquisition executive of the     
military department and1 as determined  
by the ,secretary of the military       
department1 for advising and            
coordinating and overseeing the         
implementation of policy1 strategies1   
sustainment1 and plans for--  7#a7      
cybersecurity of the industrial base2   
and  7#b7 cybersecurity of ,department  
of ,defense information systems and     
information technology services1        
including how cybersecurity threat      
information is incorporated and the     
development of cyber practices1 cyber   
testing1 and mitigation of cybersecurity
 risks4  7e7 ,review of current         

responsibilities  7#a7 ,in general ,not 
later than ,january #a1 #bjba1 each     
,secretary of a military department     
shall review the military department's  
current governance model for            
cybersecurity with respect to current   
authorities and responsibilities4  7#b7 
,elements ,each review under paragraph  
7#a7 shall include the following3 7,a7  
,an assessment of whether additional    
changes beyond the designation of a     
,principal ,cyber ,advisor pursuant to  
subsection 7a7 are required4  7,b7      
,consideration of whether the current   
governance structure and assignment of  
authorities--  7i7 enable effective     
top-down governance2  7ii7 enable       
effective ,chief ,information ,officer  
and ,chief ,information ,security       
,officer action2  7iii7 are adequately  
consolidated so that the authority and  
responsibility for cybersecurity risk   
management is clear and at an           
appropriate level of seniority2  7iv7   
provides authority to a single          

individual to certify compliance of     
,department information systems and     
information technology services with all
 current cybersecurity standards2 and   
7v7 support efficient coordination      
across the military departments and     
services1 the ,office of the ,secretary 
of ,defense1 the ,defense ,information  
,systems ,agency1 and ,united ,states   
,cyber ,command4  7f7 ,briefing ,not    
later than ,february #a1 #bjba1 each    
,secretary of a military department     
shall brief the congressional defense   
committees on the findings of the       
,secretary with respect to the review   
conducted by the ,secretary under       
subsection 7e74  7g7 ,definition of     
congressional defense committees ,in    
this section1 the term congressional    
defense committees has the meaning given
 such term in section #aja7;a7 of title 
#aj1 ,united ,states ,code4