Page:United States Statutes at Large Volume 124.djvu/2693

124 STAT. 2667 PUBLIC LAW 111–259—OCT. 7, 2010 (c) TERMINATION.—A pilot program established under sub- section (a) shall terminate on the date that is five years after the date on which such pilot program is established. (d) AUTHORIZATION OF APPROPRIATIONS.— (1) IN GENERAL.—There is authorized to be appropriated to carry out this section $2,000,000. (2) AVAILABILITY.—Funds authorized to be appropriated under paragraph (1) shall remain available until the termi- nation of the pilot program in accordance with subsection (c). Subtitle C—Acquisition Matters SEC. 321. VULNERABILITY ASSESSMENTS OF MAJOR SYSTEMS. (a) VULNERABILITY ASSESSMENTS OF MAJOR SYSTEMS.— (1) IN GENERAL.—Title V of the National Security Act of 1947 (50 U.S.C. 413 et seq.), as amended by section 305 of this Act, is further amended by inserting after section 506B, as added by section 305(a), the following new section: ‘‘VULNERABILITY ASSESSMENTS OF MAJOR SYSTEMS ‘‘SEC. 506C. (a) INITIAL VULNERABILITY ASSESSMENTS.—(1)(A) Except as provided in subparagraph (B), the Director of National Intelligence shall conduct and submit to the congressional intel- ligence committees an initial vulnerability assessment for each major system and its significant items of supply— ‘‘(i) except as provided in clause (ii), prior to the completion of Milestone B or an equivalent acquisition decision for the major system; or ‘‘(ii) prior to the date that is 1 year after the date of the enactment of the Intelligence Authorization Act for Fiscal Year 2010 in the case of a major system for which Milestone B or an equivalent acquisition decision— ‘‘(I) was completed prior to such date of enactment; or ‘‘(II) is completed on a date during the 180-day period following such date of enactment. ‘‘(B) The Director may submit to the congressional intelligence committees an initial vulnerability assessment required by clause (ii) of subparagraph (A) not later than 180 days after the date such assessment is required to be submitted under such clause if the Director notifies the congressional intelligence committees of the extension of the submission date under this subparagraph and provides a justification for such extension. ‘‘(C) The initial vulnerability assessment of a major system and its significant items of supply shall include use of an analysis- based approach to— ‘‘(i) identify vulnerabilities; ‘‘(ii) define exploitation potential; ‘‘(iii) examine the system’s potential effectiveness; ‘‘(iv) determine overall vulnerability; and ‘‘(v) make recommendations for risk reduction. ‘‘(2) If an initial vulnerability assessment for a major system is not submitted to the congressional intelligence committees as required by paragraph (1), funds appropriated for the acquisition of the major system may not be obligated for a major contract related to the major system. Such prohibition on the obligation Deadline. Notification. 50 USC 415a–5.