William M. (Mac) Thornberry National Defense Authorization Act for Fiscal Year 2021, Division A, Title XCIV, Section 9407 ("National cybersecurity challenges")

• Authority: United States Congress
• Parent authority: Federal government
• Jurisdiction: United States
• Collections: NDAA provisions;U.S. federal laws
• Most recent activity: Enacted
• Most recent activity date: 2021-01-01

Risk subdomain coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the risk subdomain are explicitly described.

• AI system security vulnerabilities
• Cyberattacks, weapon development or use
• Lack of capability or robustness

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the risk subdomain are described.

• Compromise of privacy
• Fraud, scams, and targeted manipulation
• Competitive dynamics
• Governance failure
• AI possessing dangerous capabilities

All other risk subdomains had no coverage in this document.

Risk Coverage Summary

The document has minimal to good coverage of approximately 5-7 subdomains, with primary focus on AI system security (2.2), cyberattacks and weapons (4.2), competitive dynamics (6.4), lack of robustness (7.3), and governance failure (6.5). Coverage is concentrated in cybersecurity, emerging technology risks, and workforce development domains.

Sector coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the sector are explicitly described.

• Public Administration (excl. National Security)
• National Security

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the sector are described.

• Information
• Professional & Technical Services
• Scientific Research & Development Services
• Educational Services

All other sectors had no coverage in this document.

Sectors Summary

This document primarily governs Public Administration (excluding National Security) and National Security sectors through requirements for federal agency cybersecurity resilience. It also has minimal coverage of Information, Professional and Technical Services, and Scientific Research and Development Services sectors through references to emerging technologies, cybersecurity workforce development, and coordination with research agencies.

Legislative Status

Hard Law

Legislative Status Summary

This is a binding federal statute enacted by the United States Congress as part of the National Defense Authorization Act for Fiscal Year 2021, with mandatory language requiring the Secretary of Commerce to establish national cybersecurity challenges and pursue them through specific mechanisms.

Actors

Proposer

• Entity Types: AI_Governance_Actor
• Entities: United States Congress
• Summary: This section is part of the William M. (Mac) Thornberry National Defense Authorization Act for Fiscal Year 2021, which is federal legislation enacted by the United States Congress.

Target

• Entity Types: AI_Governance_Actor, AI_Developer, AI_Deployer
• Entities: Secretary of Commerce; Under Secretary of Commerce for Standards and Technology; Federal agencies; private sector for-profit entities; nonprofit entities; State, United States territory, local, or Tribal government agencies
• Summary: The document primarily targets the Secretary of Commerce who must establish and pursue cybersecurity challenges. It also targets federal agencies for coordination and resilience improvements, and indirectly targets private sector entities, nonprofits, and other government agencies who may participate in competitions and provide funding.

Enforcer

• Entity Types: AI_Governance_Actor
• Entities: Secretary of Commerce; Under Secretary of Commerce for Standards and Technology
• Summary: The Secretary of Commerce, acting through the Under Secretary of Commerce for Standards and Technology, is responsible for implementing and overseeing the national cybersecurity challenges, including establishing competitions and coordinating with other agencies.

Monitor

• Entity Types: AI_Governance_Actor
• Entities: Advisory council designated by Secretary of Commerce; Director of the National Science Foundation; Secretary of Homeland Security; Director of the Defense Advanced Research Projects Agency; Director of the Office of Science and Technology Policy; Director of the Office of Management and Budget; Administrator of the General Services Administration; Federal Trade Commission
• Summary: The document establishes an advisory council to provide recommendations and oversight. Multiple federal agencies are designated for coordination, which implies monitoring responsibilities. The advisory council will assess submissions and provide metrics for evaluating progress.

AI Lifecycle Stages

Lifecycle stages covered by the documents, as defined in the OECD Framework for the Classification of AI Systems

• Plan and Design
• Build and Use Model
• Verify and Validate
• Operate and Monitor

AI Lifecycle Summary

The document primarily addresses the Plan and Design stage by establishing national cybersecurity challenges and frameworks for pursuing breakthroughs. It also covers Operate and Monitor through requirements for improving federal agency resilience and response to cybersecurity incidents. The Build and Use Model stage is implicitly covered through references to emerging technologies including artificial intelligence.

Technical Scope

Terms relating to technical scope that are mentioned or implicitly referenced in the document

No technical scope terms identified.

Technical Scope Summary

The document explicitly mentions artificial intelligence as one of several emerging technologies requiring cybersecurity advancement. It does not define AI models, AI systems, or any specific AI categories. There are no references to compute thresholds, foundation models, generative AI, or open-weight models. The focus is on cybersecurity challenges broadly applicable to emerging technologies.