Last week the Conference Committee charged with resolving
the differences between the House and Senate on HR 1735, the National Defense
Authorization (NDA) Act for Fiscal Year 2016, completed their work on the bill
and published their Conference
Report. Most of the cybersecurity related provisions of the bill in both
the House and Senate versions remain in the bill.
Included Provisions
of Interest
The list below includes all of the major cybersecurity
provisions. Most of these are strictly military related and will have little or
no specific impact on control system security issues in the private sector. I
have briefly discussed most of these in earlier posts (here
and here).
Sec. 885. Amendments concerning
detection and avoidance of counterfeit electronic parts.
Sec. 888. Standards for procurement
of secure information technology and cyber security systems.
Sec. 1603. Council on Oversight of
the Department of Defense Positioning, Navigation, and Timing Enterprise.
Sec. 1641. Codification and
addition of liability protections relating to reporting on cyber incidents or
penetrations of networks and information systems of certain contractors.
Sec. 1642. Authorization of
military cyber operations.
Sec. 1643. Limitation on
availability of funds pending the submission of integrated policy to deter
adversaries in cyberspace.
Sec. 1645. Designation of military
department entity responsible for acquisition of critical cyber capabilities.
Sec. 1646. Assessment of
capabilities of United States Cyber Command to defend the United States from
cyber attacks.
Sec. 1647. Evaluation of cyber
vulnerabilities of major weapon systems of the Department of Defense.
Sec. 1648. Comprehensive plan and
biennial exercises on responding to cyber attacks.
Sec. 1649. Sense of Congress on
reviewing and considering findings and recommendations of Council of Governors
on cyber capabilities of the Armed Forces.
There are three other provisions that may be of specific
interest to readers of this blog:
Sec. 1065. Report on the status of
detection, identification, and disablement capabilities related to remotely
piloted aircraft.
Sec. 1089. Reestablishment of
Commission to Assess the Threat to the United States from Electromagnetic Pulse
Attack.
Sec. 1603. Council on Oversight of
the Department of Defense Positioning, Navigation, and Timing Enterprise.
Provisions Removed
There were a large number of provisions from either the
House or Senate versions of the bill that did not make it into the final
version of the bill approved by the Conference Committee. Those that may be of
specific interest to readers of this blog include:
• Availability of cyber security
and IT certifications for Department of Defense personnel critical to network
defense;
• Priority processing of
applications for Transportation Worker Identification Credentials for members
undergoing discharge or release from the Armed Forces;
• Sense of Congress regarding cyber
resiliency of National Guard networks and communications systems; and
• Comprehensive plan of Department of Defense to
support civil authorities in response to cyber attacks by foreign powers.
The first three of these provisions were originally found in
the House version of the bill; the final one was in the Senate version. For the
second and third provisions in the above list the Conferees generally agreed
with the purpose of the provision, but decided that it did not really belong in
the NDA. For the TWIC provision they urged DOD and DHS “to consult to eliminate
processing delays and waive fees for transitioning servicemembers and for
honorably discharged veterans” (pg 672). For the cyber resiliency provision the
report encourages “the National Guard to constantly explore ways to improve and
expand its communications and networking capabilities to provide for enhanced
performance and resilience in the face of cyber attacks or disruptions, as well
as other instances of degradation” (pg 764).
For the provision addressing cyber certifications for DOD
cyber personnel, the conferees suggested that there are probably few if any private
sector certifications that are directly applicable to missions performed by DOD
cyber personnel. Because of a lack of certainty about that assumption, however,
the report encourages “the Secretary of Defense to examine the needs of the
Department and determine the extent and role industry cyber security and IT
certifications should play in workforce management” (pg 670).
For the final provision listed above the conferees noted
that §1648 that was
included in the reported version of the bill already includes “a comprehensive
plan on Department of Defense support to civil authorities is required as part
of a provision requiring the Secretary of Defense to conduct national-level
cyber exercises” (pg 838) so that this provision was redundant.
Moving Forward
Last Thursday the House accepted the Conference report by a
nearly party-line vote of
270-156. The President has threatened
to veto the bill over a disagreement in how the bill gets around the
current funding caps. The Senate did, however, vote to close debate on the bill
yesterday by a vote
of 73-26. That would tend to indicate that there were sufficient votes in
both the House and Senate to override a presidential veto. The final vote in
the Senate is due today.
Posts
