§2412 Cybersecurity Risk Inventory, Assessment, and Mitigation Working Group

Summary

Creates a working group inside the Administration called the Cybersecurity Risk Inventory, Assessment, and Mitigation Working Group. The group must include the Deputy Administrator for Defense Programs, the Associate Administrator for Information Management and Chief Information Officer, and other staff the chair picks. The Deputy Administrator for Defense Programs leads the group unless the Administrator names a different chair. The group must make a detailed plan to list systems in operational technology and nuclear weapons IT that might be at risk, rank those risks by mission impact, and carry out fixes. The plan must show goals, tasks, how people and offices will work together, the resources needed through 2034, and schedules with milestones. The group must brief the congressional defense committees within 120 days after December 22, 2023, and give the finished plan by April 1, 2025. The group ends on a date the Administrator sets, but not before five years after December 22, 2023.