S.Amdt. 449

SA 449. Mr. MORAN (for himself, Mr. Tester, and Mr. Warner) submitted
an amendment intended to be proposed by him to the bill S. 1790, to
authorize appropriations for fiscal year 2020 for military activities
of the Department of Defense, for military construction, and for
defense activities of the Department of Energy, to prescribe military
personnel strengths for such fiscal year, and for other purposes; which
was ordered to lie on the table; as follows:

At the end of subtitle C of title XVI, add the following:

SEC. ___. JOINT ASSESSMENT OF DEPARTMENT OF DEFENSE CYBER RED
TEAM CAPABILITIES, CAPACITY, DEMAND, AND
REQUIREMENTS.

(a) Joint Assessment Required.--Not later than 180 days
after the date of the enactment of this Act, the Secretary of
Defense shall, in coordination with the Chief Information
Officer of the Department of Defense, Principal Cyber
Advisor, and the Director of Operational Test and
Evaluation--
(1) conduct a joint assessment of Department cyber red team
capabilities, capacity,

[[Page S3502]]

demand, and future requirements that affect the Department's
ability to develop, test, and maintain secure systems in a
cyber environment; and
(2) brief the congressional defense committees on the
results of the joint assessment.
(b) Elements.--The joint assessment required by subsection
(a)(1) shall--
(1) specify demand for cyber red team support for
acquisition and operations;
(2) specify shortfalls in meeting demand and future
requirements, disaggregated by the Department of Defense and
by each of the military departments;
(3) examine funding and retention initiatives to increase
cyber red team capacity to meet demand and future
requirements identified to support the testing, training, and
development communities;
(4) examine the feasibility and benefit of developing and
procuring a common Red Team Integrated Capabilities Stack
that better utilizes increased capacity of cyber ranges and
better models the capabilities and tactics, techniques, and
procedures of adversaries;
(5) examine the establishment of oversight and assessment
metrics for Department cyber red teams;
(6) assess the implementation of common development for
tools, techniques, and training;
(7) assess potential industry and academic partnerships and
services;
(8) assess the mechanisms and procedures in place to
deconflict red-team activities and defensive cyber operations
on active networks;
(9) assess the use of Department cyber personnel in
training as red team support;
(10) assess the use of industry and academic partners and
contractors as red team support and the cost- and resource-
effectiveness of such support; and
(11) assess the need for permanent, high-end dedicated red-
teaming activities to model sophisticated adversaries'
attacking critical Department systems and infrastructure.
______