[Congressional Record Volume 165, Number 99 (Thursday, June 13, 2019)]
[Senate]
[Pages S3501-S3502]
From the Congressional Record Online through the Government Publishing Office [www.gpo.gov]

  SA 449. Mr. MORAN (for himself, Mr. Tester, and Mr. Warner) submitted 
an amendment intended to be proposed by him to the bill S. 1790, to 
authorize appropriations for fiscal year 2020 for military activities 
of the Department of Defense, for military construction, and for 
defense activities of the Department of Energy, to prescribe military 
personnel strengths for such fiscal year, and for other purposes; which 
was ordered to lie on the table; as follows:

       At the end of subtitle C of title XVI, add the following:

     SEC. ___. JOINT ASSESSMENT OF DEPARTMENT OF DEFENSE CYBER RED 
                   TEAM CAPABILITIES, CAPACITY, DEMAND, AND 
                   REQUIREMENTS.

       (a) Joint Assessment Required.--Not later than 180 days 
     after the date of the enactment of this Act, the Secretary of 
     Defense shall, in coordination with the Chief Information 
     Officer of the Department of Defense, Principal Cyber 
     Advisor, and the Director of Operational Test and 
     Evaluation--
       (1) conduct a joint assessment of Department cyber red team 
     capabilities, capacity,

[[Page S3502]]

     demand, and future requirements that affect the Department's 
     ability to develop, test, and maintain secure systems in a 
     cyber environment; and
       (2) brief the congressional defense committees on the 
     results of the joint assessment.
       (b) Elements.--The joint assessment required by subsection 
     (a)(1) shall--
       (1) specify demand for cyber red team support for 
     acquisition and operations;
       (2) specify shortfalls in meeting demand and future 
     requirements, disaggregated by the Department of Defense and 
     by each of the military departments;
       (3) examine funding and retention initiatives to increase 
     cyber red team capacity to meet demand and future 
     requirements identified to support the testing, training, and 
     development communities;
       (4) examine the feasibility and benefit of developing and 
     procuring a common Red Team Integrated Capabilities Stack 
     that better utilizes increased capacity of cyber ranges and 
     better models the capabilities and tactics, techniques, and 
     procedures of adversaries;
       (5) examine the establishment of oversight and assessment 
     metrics for Department cyber red teams;
       (6) assess the implementation of common development for 
     tools, techniques, and training;
       (7) assess potential industry and academic partnerships and 
     services;
       (8) assess the mechanisms and procedures in place to 
     deconflict red-team activities and defensive cyber operations 
     on active networks;
       (9) assess the use of Department cyber personnel in 
     training as red team support;
       (10) assess the use of industry and academic partners and 
     contractors as red team support and the cost- and resource-
     effectiveness of such support; and
       (11) assess the need for permanent, high-end dedicated red-
     teaming activities to model sophisticated adversaries' 
     attacking critical Department systems and infrastructure.
                                 ______