National Defense Authorization Act for Fiscal Year 2022, Section 1509 ("Assessment of cyber posture and operational assumptions and development of targeting strategies and supporting capabilities")

• Authority: United States Congress
• Parent authority: Federal government
• Jurisdiction: United States
• Collections: NDAA provisions;U.S. federal laws
• Most recent activity: Enacted
• Most recent activity date: 2021-12-27

Risk subdomain coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the risk subdomain are explicitly described.

• Cyberattacks, weapon development or use

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the risk subdomain are described.

• AI system security vulnerabilities
• Disinformation, surveillance, and influence at scale
• Competitive dynamics
• AI possessing dangerous capabilities
• Lack of capability or robustness

All other risk subdomains had no coverage in this document.

Risk Coverage Summary

The document has good coverage of approximately 6-8 subdomains, with strong focus on malicious actors (4.1, 4.2), AI system security (2.2), competitive dynamics (6.4), dangerous capabilities (7.2), and lack of robustness (7.3). Coverage is concentrated in security, offensive cyber operations, and AI capabilities assessment domains.

Sector coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the sector are explicitly described.

• National Security

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the sector are described.

• Trade, Transportation & Utilities
• Information
• Finance & Insurance
• Scientific Research & Development Services
• Health Care & Social Assistance
• Public Administration (excl. National Security)

All other sectors had no coverage in this document.

Sectors Summary

This document primarily governs National Security sector activities, specifically U.S. military cyber operations and intelligence activities. It also addresses critical infrastructure protection across multiple sectors through references to adversary targeting and deterrence strategies.

Legislative Status

Hard Law

Legislative Status Summary

This is a binding legislative provision enacted by the United States Congress as part of the National Defense Authorization Act for Fiscal Year 2022, containing mandatory requirements with specific deadlines and enforcement through congressional oversight.

Actors

Proposer

• Entity Types: AI_Governance_Actor
• Summary: This is Section 1509 of the National Defense Authorization Act for Fiscal Year 2022, which is federal legislation enacted by the United States Congress.

Target

• Entity Types: AI_Governance_Actor
• Summary: The document mandates specific actions by named Department of Defense officials and military commanders, requiring them to conduct assessments, develop strategies, and provide briefings on cyber operations and AI capabilities.

Enforcer

• Entity Types: AI_Governance_Actor
• Summary: Congressional defense committees receive mandatory briefings and reports, providing oversight and enforcement through their legislative and budgetary authority. Senior DoD officials also receive briefings for internal enforcement.

Monitor

• Entity Types: AI_Governance_Actor
• Summary: The same congressional committees and senior DoD officials that enforce compliance also monitor implementation through required briefings and reports on assessments, strategies, and capability development.

AI Lifecycle Stages

Lifecycle stages covered by the documents, as defined in the OECD Framework for the Classification of AI Systems

• Plan and Design
• Collect and Process Data
• Build and Use Model
• Verify and Validate
• Deploy
• Operate and Monitor

AI Lifecycle Summary

The document primarily addresses the Plan and Design stage through mandated assessments of adversary capabilities and development of targeting strategies. It also covers Verify and Validate through required assessments and war-gaming exercises, and Deploy and Operate and Monitor stages through development of operational concepts and persistent engagement strategies.

Technical Scope

Terms relating to technical scope that are mentioned or implicitly referenced in the document

No technical scope terms identified.

Technical Scope Summary

The document explicitly mentions artificial intelligence as an emerging technology that could affect adversary cyber capabilities and U.S. military operations. It does not define AI models, systems, or specific AI categories, but addresses AI in the context of assessing its potential effects on cyber warfare and operational assumptions.