---
kind: "section"
citation: "6 U.S.C. § 665h"
title: "6"
title_heading: "Domestic Security"
number: "665h"
heading: "National Cyber Exercise Program"
release: "119-102"
date: "2026-07-12"
url: "https://uscodex.org/usc/6/665h"
units:
  - "Chapter 1 — Homeland Security Organization"
  - "Subchapter XVIII — Cybersecurity and Infrastructure Security Agency"
  - "Part A — Cybersecurity and Infrastructure Security"
---

# §665h. National Cyber Exercise Program

- (a) **Establishment of program—**
  - (1) **In general—** There is established in the [Agency](/usc/6/650.md?p=1) the National Cyber Exercise Program (referred to in this section as the “Exercise Program”) to evaluate the National [Cyber Incident](/usc/6/681.md?p=5) Response Plan, and other related plans and strategies.
  - (2) **Requirements—**
    - (A) **In general—** The Exercise Program shall be—
      - (i) based on current risk assessments, including credible threats, vulnerabilities, and consequences;
      - (ii) designed, to the extent practicable, to simulate the partial or complete incapacitation of a government or [critical infrastructure](/usc/6/101.md?p=4) network resulting from a [cyber incident](/usc/6/681.md?p=5);
      - (iii) designed to provide for the systematic evaluation of cyber readiness and enhance operational understanding of the [cyber incident](/usc/6/681.md?p=5) response system and relevant information [sharing](/usc/6/650.md?p=26) agreements; and
      - (iv) designed to promptly develop after-action reports and plans that can quickly incorporate lessons learned into future operations.
    - (B) **Model exercise selection—** The Exercise Program shall—
      - (i) include a selection of model exercises that government and private [entities](/usc/6/301c.md?p=2) can readily adapt for use; and
      - (ii) aid such governments and private [entities](/usc/6/301c.md?p=2) with the design, implementation, and evaluation of exercises that—
        - (I) conform to the requirements described in [subparagraph (A)](#a-2-A);
        - (II) are consistent with any applicable national, [State](/usc/6/101.md?p=17), local, or Tribal strategy or plan; and
        - (III) provide for systematic evaluation of readiness.
  - (3) **Consultation—** In carrying out the Exercise Program, the [Director](/usc/6/650.md?p=10) may consult with appropriate representatives from [Sector Risk Management Agencies](/usc/6/650.md?p=23), the Office of the National Cyber [Director](/usc/6/650.md?p=10), cybersecurity research stakeholders, and Sector Coordinating [Councils](/usc/6/681.md?p=2).
- (b) **Definitions—** In this section:
  - (1) **State—** The term “[State](/usc/6/101.md?p=17)” means any [State](/usc/6/101.md?p=17) of the [United States](/usc/6/101.md?p=19-A), the District of Columbia, the Commonwealth of Puerto Rico, the Northern Mariana Islands, the [United States](/usc/6/101.md?p=19-A) Virgin Islands, Guam, American Samoa, and any other territory or possession of the [United States](/usc/6/101.md?p=19-A).
  - (2) **Private entity—** The term “private [entity](/usc/6/301c.md?p=2)” has the meaning given such term in [section 1501 of this title](/usc/6/1501.md).
- (c) **Rule of construction—** Nothing in this section shall be construed to affect the authorities or responsibilities of the [Administrator](/usc/6/601.md?p=1) of the Federal [Emergency Management](/usc/6/701.md?p=7) [Agency](/usc/6/650.md?p=1) pursuant to [section 748 of this title](/usc/6/748.md).

## Source credit

(Pub. L. 107–296, title XXII, § 2220B, as added Pub. L. 117–81, div. A, title XV, § 1547(a), Dec. 27, 2021, 135 Stat. 2059.)