[Congressional Record Volume 163, Number 147 (Tuesday, September 12, 2017)]
[Senate]
[Page S5234]
From the Congressional Record Online through the Government Publishing Office [www.gpo.gov]

  SA 989. Mr. ROUNDS submitted an amendment intended to be proposed by 
him to the bill H.R. 2810, to authorize appropriations for fiscal year 
2018 for military activities of the Department of Defense, for military 
construction, and for defense activities of the Department of Energy, 
to prescribe military personnel strengths for such fiscal year, and for 
other purposes; which was ordered to lie on the table; as follows:

       At the end of subtitle C of title XVI, add the following:

     SEC. 1630C. CYBERSECURITY OF INDUSTRIAL CONTROL SYSTEMS.

       (a) Designation of Integrating Official.--
       (1) In general.--The Secretary of Defense shall designate 
     one official to be responsible for all matters relating to 
     integrating cybersecurity and industrial control systems 
     within the Department of Defense. Such official shall be 
     responsible for all such matters at all levels of command, 
     from the Department to the facility using industrial control 
     systems.
       (2) Responsibilities.--The responsibilities of the official 
     designated under subsection (a) shall include the following:
       (A) Developing, implementing, and be accountable for plans, 
     programs, and policies to improve the cybersecurity of 
     industrial control systems. Such plans, programs, and 
     policies shall be applicable at all levels of command and 
     apply to both the Department and the facility using the 
     industrial control system.
       (B) Developing Department-wide certification standards for 
     integration of industrial control systems and taking into 
     consideration frameworks set forth by the National Institute 
     of Standards and Technology for the cybersecurity of such 
     systems.
       (b) Pilot Programs.--
       (1) In general.--The Secretary of Defense shall consider 
     carrying out one or more pilot programs to assess the 
     feasibility and advisability of implementing various 
     solutions for protecting industrial control systems against 
     cyber attacks and discerning the specific criteria that a 
     solution should demonstrate in order to be certified for 
     military use.
       (2) Priority.--In carrying out a pilot program under 
     paragraph (1), the Secretary shall give priority to the 
     determination of certification criteria for military energy 
     industrial control systems.
                                 ______