---
kind: "section"
citation: "10 U.S.C. § 391b"
title: "10"
title_heading: "Armed Forces"
number: "391b"
heading: "Strategic cybersecurity program"
release: "119-102"
date: "2026-07-12"
url: "https://uscodex.org/usc/10/391b"
units:
  - "Subtitle A — General Military Law"
  - "Part I — Organization and General Military Powers"
  - "Chapter 19 — Cyber and Information Operations Matters"
---

# §391b. Strategic cybersecurity program

- (a) **In General.—**
  - (1) There is a [program](/usc/10/2101.md?p=1) to be known as the “Strategic Cybersecurity [Program](/usc/10/2101.md?p=1)” (in this section referred to as the “[Program](/usc/10/2101.md?p=1)”) to ensure the ability of the [Department](/usc/10/101.md?p=a-6) of Defense to conduct the most critical [military](/usc/10/801.md?p=8) missions of the [Department](/usc/10/101.md?p=a-6).
  - (2) The [Secretary](/usc/10/4951.md?p=3) of Defense shall designate a principal staff assistant from within the Office of the [Secretary](/usc/10/4951.md?p=3) of Defense whose office shall serve as the office of primary responsibility for the [Program](/usc/10/2101.md?p=1), and provide policy, direction, and oversight regarding the execution of the responsibilities of the [program manager](/usc/10/1737.md?p=a-1) selected pursuant to [subsection (c)(1)](#c-1).
- (b) **Membership.—** In addition to the office of primary responsibility for the [Program](/usc/10/2101.md?p=1) under [subsection (a)(2)](#a-2) and the [program manager](/usc/10/1737.md?p=a-1) selected pursuant to [subsection (c)(1)](#c-1), membership in the [Program](/usc/10/2101.md?p=1) shall include the following:
  - (1) The Vice Chairman of the Joint Chiefs of Staff.
  - (2) The Commanders of the [United States](/usc/10/101.md?p=a-1) [Cyber](/usc/10/2200e.md?p=1) Command, [United States](/usc/10/101.md?p=a-1) European Command, [United States](/usc/10/101.md?p=a-1) Indo-Pacific Command, [United States](/usc/10/101.md?p=a-1) Northern Command, [United States](/usc/10/101.md?p=a-1) Strategic Command, [United States](/usc/10/101.md?p=a-1) Space Command, [United States](/usc/10/101.md?p=a-1) Transportation Command.
  - (3) The Under [Secretary](/usc/10/4951.md?p=3) of Defense for Acquisition and Sustainment.
  - (4) The Under [Secretary](/usc/10/4951.md?p=3) of Defense for Policy.
  - (5) The Chief Information [Officer](/usc/10/101.md?p=b-1) of the [Department](/usc/10/101.md?p=a-6) of Defense.
  - (6) The Chief Digital and Artificial Intelligence [Officer](/usc/10/101.md?p=b-1) of the [Department](/usc/10/101.md?p=a-6) of Defense.
  - (7) The chief information [officers](/usc/10/101.md?p=b-1) of the [military departments](/usc/10/101.md?p=a-8).
  - (8) The Principal [Cyber](/usc/10/2200e.md?p=1) Advisor of the [Department](/usc/10/101.md?p=a-6) of Defense.
  - (9) The Principal [Cyber](/usc/10/2200e.md?p=1) Advisors of the [military departments](/usc/10/101.md?p=a-8).
  - (10) Each senior official identified pursuant to subsection (i) of section 1647 of the National Defense Authorization Act for Fiscal Year 2016 (Public Law 114–92; 129 Stat. 1118).
  - (11) Such other officials as may be determined necessary by the [Secretary](/usc/10/4951.md?p=3) of Defense.
- (c) **Program Office.—**
  - (1) There is in the Cybersecurity Directorate of the [National Security](/usc/10/801.md?p=16) [Agency](/usc/10/3451.md?p=3) a [program](/usc/10/2101.md?p=1) office to support the [Program](/usc/10/2101.md?p=1) by identifying threats to, vulnerabilities in, and remediations for, the missions and mission elements specified in [subsection (d)(1)](#d-1). Such [program](/usc/10/2101.md?p=1) office shall be headed by a [program manager](/usc/10/1737.md?p=a-1) selected by the Director of the [National Security](/usc/10/801.md?p=16) [Agency](/usc/10/3451.md?p=3).
  - (2) The Chief Information [Officer](/usc/10/101.md?p=b-1) of the [Department](/usc/10/101.md?p=a-6) of Defense, in exercising authority, direction, and control over the Cybersecurity Directorate of the [National Security](/usc/10/801.md?p=16) [Agency](/usc/10/3451.md?p=3), shall ensure that the [program](/usc/10/2101.md?p=1) office under [paragraph (1)](#c-1) is responsive to the requirements and direction of the [program manager](/usc/10/1737.md?p=a-1) selected pursuant to such paragraph.
  - (3) The [Secretary](/usc/10/4951.md?p=3) may augment the personnel assigned to the [program](/usc/10/2101.md?p=1) office under [paragraph (1)](#c-1) by assigning personnel as appropriate from among members of any covered armed force (including the [reserve](/usc/10/101.md?p=c-6) [components](/usc/10/3011.md?p=13) thereof), civilian employees of the [Department](/usc/10/101.md?p=a-6) of Defense (including the Defense Intelligence [Agency](/usc/10/3451.md?p=3)), and personnel of the research laboratories of the [Department](/usc/10/101.md?p=a-6) of Defense, who have particular expertise in the areas of responsibility referred to in [subsection (d)](#d).
- (d) **Designation of Mission Elements of Program.—**
  - (1) The Under [Secretary](/usc/10/4951.md?p=3) of Defense for Policy, the Under [Secretary](/usc/10/4951.md?p=3) of Defense for Acquisition and Sustainment, and the Vice Chairman of the Joint Chiefs of Staff shall identify and designate for inclusion in the [Program](/usc/10/2101.md?p=1) all of the systems, critical infrastructure, kill chains, and processes, including systems and [components](/usc/10/3011.md?p=13) in development, that comprise the following [military](/usc/10/801.md?p=8) missions of the [Department](/usc/10/101.md?p=a-6) of Defense:
    - (A) Nuclear deterrence and strike.
    - (B) Select long-[range](/usc/10/101.md?p=f-1) conventional strike missions germane to the warfighting plans of the [United States](/usc/10/101.md?p=a-1) European Command and the [United States](/usc/10/101.md?p=a-1) Indo-Pacific Command.
    - (C) Offensive [cyber](/usc/10/2200e.md?p=1) operations.
    - (D) Homeland missile defense.
  - (2) The Vice Chairman of the Joint Chiefs of Staff shall coordinate the identification and prioritization of the missions and mission [components](/usc/10/3011.md?p=13), and the development and approval of requirements relating to the cybersecurity of the missions and mission [components](/usc/10/3011.md?p=13), of the [Program](/usc/10/2101.md?p=1).
- (e) **Additional Responsibilities of Head of Office of Primary Responsibility.—** In addition to providing policy, direction, and oversight as specified in [subsection (a)(2)](#a-2), the head of the office of primary responsibility for the [Program](/usc/10/2101.md?p=1) designated under such subsection shall be responsible—
  - (1) for overseeing and providing direction on any covered statutory requirement that is ongoing, recurrent (including on an annual basis), or unfulfilled, including by—
    - (A) reviewing any materials required to be submitted to Congress under the covered statutory requirement prior to such submission; and
    - (B) ensuring such submissions occur by the applicable deadline under the covered statutory requirement; and
  - (2) recording and monitoring the remediation of identified vulnerabilities in constituent systems, infrastructure, kill chains, and processes of the missions specified in [subsection (d)(1)](#d-1).
- (f) **Responsibilities of Program Manager.—** The [program manager](/usc/10/1737.md?p=a-1) selected pursuant to [subsection (c)(1)](#c-1) shall be responsible for the following:
  - (1) Conducting end-to-end vulnerability assessments of the constituent systems, infrastructure, kill chains, and processes of the missions specified in [subsection (d)(1)](#d-1).
  - (2) Prioritizing and facilitating the remediation of identified vulnerabilities in such constituent systems, infrastructure, kill chains, and processes.
  - (3) Conducting, prior to the Milestone B approval for any proposed such system or infrastructure germane to the missions of the [Program](/usc/10/2101.md?p=1), appropriate reviews of the acquisition and system engineering plans for that proposed system or infrastructure, in accordance with the policy and guidance of the Under [Secretary](/usc/10/4951.md?p=3) of Defense for Acquisition and Sustainment regarding the [components](/usc/10/3011.md?p=13) of such reviews and the [range](/usc/10/101.md?p=f-1) of systems and infrastructure to be reviewed.
  - (4) Advising the [Secretaries](/usc/10/4951.md?p=3) of the [military departments](/usc/10/101.md?p=a-8), the commanders of the combatant commands, and the Joint Staff on the vulnerabilities and cyberattack vectors that pose substantial risk to the missions of the [Program](/usc/10/2101.md?p=1) and their constituent systems, critical infrastructure, kill chains, or processes.
  - (5) Ensuring that the [Program](/usc/10/2101.md?p=1) builds upon (including through the provision of oversight and direction by the head of the office of primary responsibility for the [Program](/usc/10/2101.md?p=1) pursuant to [subsection (e)](#e), as applicable), and does not duplicate, other efforts of the [Department](/usc/10/101.md?p=a-6) of Defense relating to cybersecurity, including the following:
    - (A) The evaluation of [cyber](/usc/10/2200e.md?p=1) vulnerabilities of [major weapon systems](/usc/10/4401.md?p=c-9) of the [Department](/usc/10/101.md?p=a-6) of Defense required under section 1647 of the National Defense Authorization Act for Fiscal Year 2016 (Public Law 114–92; 129 Stat. 1118).
    - (B) The evaluation of [cyber](/usc/10/2200e.md?p=1) vulnerabilities of critical infrastructure of the [Department](/usc/10/101.md?p=a-6) of Defense required under section 1650 of the National Defense Authorization Act for Fiscal Year 2017 (Public Law 114–328; [10 U.S.C. 2224](/usc/10/2224.md) note).
    - (C) The activities of the [cyber](/usc/10/2200e.md?p=1) protection teams of the [Department](/usc/10/101.md?p=a-6) of Defense.
- (g) **Responsibilities of Secretary of Defense.—** The [Secretary](/usc/10/4951.md?p=3) of Defense shall define and issue guidance on the roles and responsibilities for [components](/usc/10/3011.md?p=13) of the [Department](/usc/10/101.md?p=a-6) of Defense other than those specified in this section with respect to the [Program](/usc/10/2101.md?p=1), including—
  - (1) the roles and responsibilities of the acquisition and sustainment organizations of the [military departments](/usc/10/101.md?p=a-8) in supporting and implementing remedial actions;
  - (2) the alignment of [Cyber](/usc/10/2200e.md?p=1) Protection Teams with the prioritized missions of the [Program](/usc/10/2101.md?p=1);
  - (3) the role of the Director of Operational Test and Evaluation in conducting periodic assessments, including through [cyber](/usc/10/2200e.md?p=1) red teams, of the cybersecurity of missions in the [Program](/usc/10/2101.md?p=1); and
  - (4) the role of the Principal [Cyber](/usc/10/2200e.md?p=1) Adviser in coordinating and monitoring the execution of the [Program](/usc/10/2101.md?p=1).
- (h) **Annual Reporting.—** Not later than December 31 of each year, the head of the office of primary responsibility for the [Program](/usc/10/2101.md?p=1), in coordination with the appropriate members of the [Program](/usc/10/2101.md?p=1) under [subsection (b)](#b), shall submit to the [congressional defense committees](/usc/10/101.md?p=a-16) an annual report on the efforts carried out pursuant to this section or any covered provision of law, including with respect to such efforts concerning—
  - (1) the evaluation of [cyber](/usc/10/2200e.md?p=1) vulnerabilities of each [major weapon system](/usc/10/4401.md?p=c-9) of the [Department](/usc/10/101.md?p=a-6) of Defense and related mitigation activities under section 1647 of the National Defense Authorization Act for Fiscal Year 2016 (Public Law 114–92; 129 Stat. 1118);
  - (2) the evaluation of [cyber](/usc/10/2200e.md?p=1) vulnerabilities of the critical infrastructure of the [Department](/usc/10/101.md?p=a-6) of Defense under section 1650 of the National Defense Authorization Act for Fiscal Year 2017 (Public Law 114–328; [10 U.S.C. 2224](/usc/10/2224.md) note);
  - (3) operational technology and the mapping of mission-relevant terrain in cyberspace under section 1505 of the National Defense Authorization Act for Fiscal Year 2022 (Public Law 117–81; [10 U.S.C. 394](/usc/10/394.md) note);
  - (4) the assessments of the vulnerabilities to and mission risks presented by radio-frequency enabled [cyber](/usc/10/2200e.md?p=1) attacks with respect to the operational technology embedded in weapons systems, aircraft, ships, ground vehicles, space systems, sensors, and datalink networks of the [Department](/usc/10/101.md?p=a-6) of Defense under section 1559 of the National Defense Authorization Act for Fiscal Year 2023; and
  - (5) the work of the [Program](/usc/10/2101.md?p=1) in general, including information relating to staffing and accomplishments.
- (i) **Annual Budget Display.—**
  - (1) On an annual basis for each fiscal year, concurrently with the submission of the budget of the President for that fiscal year under [section 1105(a) of title 31](/usc/31/1105.md?p=a), United States Code, the head of the office of primary responsibility for the [Program](/usc/10/2101.md?p=1), in coordination with the appropriate members of the [Program](/usc/10/2101.md?p=1) under [subsection (b)](#b), shall submit to the [congressional defense committees](/usc/10/101.md?p=a-16) a consolidated budget justification display that covers all [programs](/usc/10/2101.md?p=1) and activities associated with this section and any covered provision of law, including with respect to the matters listed in [subsection (h)](#h).
  - (2) Each display under [paragraph (1)](#i-1) shall be submitted in unclassified form, but may include a classified annex.
  - (3) For the purpose of facilitating the annual budget display requirement under [paragraph (1)](#i-1), the Chief Information [Officer](/usc/10/101.md?p=b-1) of the [Department](/usc/10/101.md?p=a-6) of Defense shall provide to the head of the office of primary responsibility for the [Program](/usc/10/2101.md?p=1) and the appropriate members of the [Program](/usc/10/2101.md?p=1) under [subsection (b)](#b) fiscal guidance on the programming of funds in support of the [Program](/usc/10/2101.md?p=1).
- (j) **Definitions.—** In this section:
  - (1) The term “covered armed force” means the Army, Navy, Air Force, Marine Corps, or Space Force.
  - (2) The term “covered statutory requirement” means a requirement under any covered provision of law.
  - (3) The term “covered provision of law” means the following:
    - (A) Section 1647 of the National Defense Authorization Act for Fiscal Year 2016 (Public Law 114–92; 129 Stat. 1118).
    - (B) Section 1650 of the National Defense Authorization Act for Fiscal Year 2017 (Public Law 114–328; [10 U.S.C. 2224](/usc/10/2224.md) note).
    - (C) Section 1505 of the National Defense Authorization Act for Fiscal Year 2022 (Public Law 117–81; [10 U.S.C. 394](/usc/10/394.md) note).
    - (D) Section 1559 of the National Defense Authorization Act for Fiscal Year 2023.

## Source credit

(Added Pub. L. 118–31, div. A, title XV, § 1502(a)(1), Dec. 22, 2023, 137 Stat. 533; amended Pub. L. 118–159, div. A, title XVII, § 1701(a)(7), Dec. 23, 2024, 138 Stat. 2203.)

## Notes

### Editorial Notes

### References in Text

Section 1647 of the National Defense Authorization Act for Fiscal Year 2016, referred to in subsecs. (b)(10), (f)(5)(A), (h)(1), and (j)(3)(A), is section 1647 of Pub. L. 114–92, which is set out as a note under section 2224 of this title.

Section 1559 of the National Defense Authorization Act for Fiscal Year 2023, referred to in subsecs. (h)(4) and (j)(3)(D), is section 1559 of Pub. L. 117–263, which is set out as a note under section 2224 of this title.

### Amendments

2024—Subsec. (e)(1)(B). Pub. L. 118–159 substituted semicolon for colon after “requirement”.