S.Amdt. 2439

SA 2439. Mr. KING (for himself and Mr. Sasse) submitted an amendment
intended to be proposed by him to the bill S. 4049, to authorize
appropriations for fiscal year 2021 for military activities of the
Department of Defense, for military construction, and for defense
activities of the Department of Energy, to prescribe military personnel
strengths for such fiscal year, and for other purposes; which was
ordered to lie on the table; as follows:

At the appropriate place, insert the following:

SEC. ___. BIENNIAL NATIONAL CYBER TABLETOP EXERCISE.

(a) Requirement.--On a date during calendar year 2023, and
biennially thereafter until January 1, 2030, the Secretary,
in consultation with the President, the Director of National
Intelligence, the Attorney General, and the Secretary of
Defense, shall conduct a tabletop exercise to test the
resilience, response, and recovery of the United States in
the case of a significant cyber incident impacting critical
infrastructure.
(b) Planning and Preparation.--The tabletop exercise
required under subsection (a) shall be prepared by--
(1) appropriate personnel from--
(A) the Department of Homeland Security;
(B) the Department of Defense; and
(C) the Department of Justice; and
(2) appropriate elements of the intelligence community,
identified by the Director of National Intelligence.
(c) Participants.--
(1) Federal government participants.--The following
personnel shall participate in the tabletop exercise required
under subsection (a):
(A) Personnel from the Department of Homeland Security.
(B) Appropriate personnel from the Department of Defense,
as identified by the Secretary of Defense.
(C) Appropriate personnel from elements of the intelligence
community, as identified by the Director of National
Intelligence.
(D) Appropriate personnel from the Department of Defense,
as identified by the Attorney General.
(E) Appropriate representatives from sector-specific
agencies, as determined by the Secretary.
(2) State and local governments.--The Secretary shall
invite representatives from State, local, and Tribal
governments to participate in the tabletop exercise required
under subsection (a) if the Secretary determines the
participation of those representatives to be appropriate.
(3) Private sector.--Depending on the nature of a tabletop
exercise being conducted under subsection (a), the Secretary,
in consultation with the senior representative of the sector-
specific agencies participating in the tabletop exercise
under paragraph (1)(E), shall invite the following
individuals to participate:
(A) Representatives from appropriate private sector
entities.
(B) Other individuals that the Secretary determines will
best assist the United States in preparing for, and defending
against, a cyber attack.
(4) International partners.--Depending on the nature of the
tabletop exercise being conducted under subsection (a), the
Secretary may invite allies and partners of the United States
to participate in the tabletop exercise.
(d) Observers.--The Secretary may invite representatives
from the executive and legislative branches of the Federal
Government to observe the tabletop exercise required under
subsection (a).
(e) Elements.--The tabletop exercise required under
subsection (a) shall include the following elements:
(1) Exercising the orchestration of cybersecurity response
and the provision of cyber support to Federal, State, local,
and Tribal governments and private sector entities, including
the exercise of the command, control, and deconfliction of--
(A) operational responses through interagency coordination
processes and response groups; and
(B) each Federal agency participating in the tabletop
exercise under subsection (c)(1).
(2) Testing of the information sharing needs and
capabilities of tabletop exercise participants.
(3) Testing of the relevant policy, guidance, and doctrine,
including the National

[[Page S4273]]

Cyber Incident Response Plan of the Cybersecurity and
Infrastructure Security Agency of the Department of Homeland
Security.
(4) Testing of the integration and interoperability between
the Federal agencies participating in the tabletop exercise
under subsection (c)(1).
(5) Exercising the integration and interoperability of the
cybersecurity operation centers of the Federal Government, as
appropriate, in coordination with appropriate cabinet level
officials.
(f) Briefing.--
(1) In general.--Not later than 180 days after the date on
which each tabletop exercise required under subsection (a) is
conducted, the Secretary shall provide to the appropriate
congressional committees a briefing on the tabletop exercise.
(2) Contents.--The briefing required under paragraph (1)
shall include--
(A) an assessment of the decision and response gaps
observed in the tabletop exercise described in paragraph (1);
(B) proposed recommendations to improve the resilience,
response, and recovery of the United States in the case of a
significant cyber attack against critical infrastructure; and
(C) appropriate plans to address the recommendations
proposed under subparagraph (B).
(g) Repeal.--Subsection (b) of section 1648 of the National
Defense Authorization Act for Fiscal Year 2016 (Public Law
114-92; 129 Stat. 1119) is repealed.
(h) Definitions.--In this section:
(1) Appropriate congressional committees.--The term
``appropriate congressional committees'' means--
(A) the Committee on Armed Services of the Senate;
(B) the Committee on Armed Services of the House of
Representatives;
(C) the Committee on Homeland Security and Governmental
Affairs of the Senate;
(D) the Committee on Homeland Security of the House of
Representatives;
(E) the Select Committee on Intelligence of the Senate;
(F) the Permanent Select Committee on Intelligence of the
House of Representatives;
(G) the Committee on the Judiciary of the Senate;
(H) the Committee on the Judiciary of the House of
Representatives;
(I) the Committee on Commerce, Science, and Transportation
of the Senate;
(J) the Committee on Science, Space, and Technology of the
House of Representatives;
(K) the Committee on Foreign Relations of the Senate; and
(L) the Committee on Foreign Affairs of the House of
Representatives.
(2) Element of the intelligence community.--The term
``element of the intelligence community'' means an element
specified or designated under section 3 of the National
Security Act of 1947 (50 U.S.C. 3003).
(3) Private entity.--The term ``private entity'' has the
meaning given the term in section 102 of the Cybersecurity
Information Sharing Act of 2015 (6 U.S.C. 1501).
(4) Secretary.--The term ``Secretary'' means the Secretary
of Homeland Security.
(5) Sector-specific agency.--The term ``sector-specific
agency'' has the meaning given the term ``Sector-Specific
Agency'' in section 2201 of the Homeland Security Act of 2002
(6 U.S.C. 651).
(6) State.--The term ``State'' means any State of the
United States, the District of Columbia, the Commonwealth of
Puerto Rico, the Northern Mariana Islands, the United States
Virgin Islands, Guam, American Samoa, and any other territory
or possession of the United States.
______