§2412 Cybersecurity Risk Inventory, Assessment, and Mitigation Working Group

Summary

Creates a working group inside the Administration called the Cybersecurity Risk Inventory, Assessment, and Mitigation Working Group. Members must include the Deputy Administrator for Defense Programs, the Associate Administrator for Information Management and the Chief Information Officer, plus any other staff the Chairperson picks. The Deputy Administrator for Defense Programs will be Chair unless the Administrator names someone else. The group must make a plan to list systems at risk in operational technology and nuclear weapons IT, assess those risks by mission impact, and set actions to reduce them. The plan must spell out goals, objectives, activities, and how success will be measured; who is responsible and how they will coordinate; the resources needed through 2034; and detailed milestones and schedules. The group must brief the congressional defense committees within 120 days after December 22, 2023 on its plan to develop the strategy and must deliver the finished strategy by April 1, 2025. The group ends on a date the Administrator sets, but not earlier than five years after December 22, 2023.