§2412 Cybersecurity Risk Inventory, Assessment, and Mitigation Working Group

Summary

Creates a team inside the Administration called the Cybersecurity Risk Inventory, Assessment, and Mitigation Working Group. The Deputy Administrator for Defense Programs will chair the team unless the Administrator picks someone else. The group must include the Associate Administrator for Information Management and Chief Information Officer and any other Administration staff the Chair thinks should join. The team must make a full plan to list systems that could be at risk in operational technology and nuclear weapons IT, rate those risks by mission impact, and lay out how to reduce them. The plan must include goals and measures, who does what and how they coordinate, resources needed through 2034, and clear milestones and schedules. The group must brief the congressional defense committees within 120 days after December 22, 2023, and deliver the finished plan by April 1, 2025. The working group ends on a date the Administrator sets, but not earlier than five years after December 22, 2023.