LIVE: Senate Hearing Examines Cyber Posture of Department of Defense

Today's hearing comes at a time of increased cyber activity targeting U.S. infrastructure, including recent campaigns against telecommunications and critical infrastructure networks. It also comes at a time when cyber operations are being integrated into military operations more than ever before. U.S. Cyber Command has supported recent operations, including Operation Midnight Hammer in Iran and Operation Absolute Resolve in Venezuela. The Department, with the support of Congress, has continued to develop its cyber forces. Over the past several years, the Cyber Mission Force has grown and matured. Cyber Command has received and enhanced budget control. The role of the Assistant Secretary of the Cyber Policy has been established and filled. And the Department has stood up the Department of Defense Cyber Defense Command, DCDC, as a subunified command. The maturation is continuing. Cyber Command has initiated organizational and force generation to form an effort known as CyberComm 2.0, focused on improving workforce management, training, readiness, and operational effectiveness. This effort is intended to create more defined career paths, enable greater specialization, and improve the Department's ability to respond to emerging threats. We look forward to hearing about how these efforts are improving the Department's cyber posture and where challenges remain. We are joined today by Ms. Katie Sutton, the Assistant Secretary of Defense for Cyber Policy and Principal Cyber Advisor to the Secretary of Defense. Prior to her appointment, she served at Cyber Command and on the staff of both the House and Senate Armed Services Committees. Ms. Sutton, thank you for being here. We are also joined by General Joshua Rudd, who was sworn in as the Commander of U.S. Cyber Command and Director of the National Security Agency in March. General Rudd, thank you for joining us. So what we're going to do is just going to yield directly to the testimony. So with that, we yield to Ms. Sutton, and then we'll go to General Rudd. Chairman Bacon and distinguished members of this committee, thank you for the opportunity to testify here today. I'm honored to be here with General Rudd, whose immense experience, especially in the Indo-Pacific region, will prove invaluable as we posture to implement the National Defense Strategy. I also congratulate Lieutenant General Hartman on his retirement and thank him for his service and visionary leadership that has built the cyber enterprise over the years, setting the stage for our future success. In my role, I'm responsible for overseeing the Department's cyberspace operations policy, integrating cyber activities across the Department, and exercising authority, direction, and control over U.S. Cyber Command. I'd like to start by highlighting today the new and ever-dynamic strategic environment that we face in the cyber domain. The character of cyber warfare is changing rapidly, shaped by a growing threat posed by our adversaries and accelerated by the ever-growing power of technology. We must act decisively to transform our cyber enterprise and deliver the robust cyber capabilities and optionality required for the President and Secretary to defend American security, freedom, and prosperity. One major change that we're seeing is that our cyber actors are no longer just conducting espionage. They are preparing for conflict. Our adversaries have moved beyond theft and are pre-positioning disruptive capabilities inside our nation's critical infrastructure. This strategic shift from exploitation to effects aims to disrupt military deployments and sow chaos in crisis or conflict. Cyber threat actors like Volt Typhoon are not just a nuance, they represent a significant and persistent threat to our national security. Second large change is artificial intelligence has become a powerful force multiplier, increasing the speed, scale, and sophistication of these threats. AI accelerates the entire attack lifestyle, creating a new dynamic where the pace of attacks challenges our ability to react and the scale overwhelms our ability to defend. Rapid innovation has also lowered the barrier for entry for advanced cyber capabilities. We must gain strategic advantage below the level of armed conflict. We will deny our adversaries freedom of movement. This means not only building a resilient defense, but also empowering our world-class cyber operators to work across the full spectrum of cyber operations. Our adversaries must be deterred in cyberspace and we must reevaluate our approach to contesting the growing aggression in cyberspace that threatens U.S. interests, our national security, and our ways of life. Third priority is that our force must organize to dominate. Our strategies are only effective as the force that executes them. Through the Cyber Command 2.0 initiative, we are undertaking the most comprehensive transformation of our cyber force since its inception. This evolution transcends legacy structures to elevate our operational readiness, scale our technical advantage, and propel our force to meet the demands of modern conflict. We are forging a more lethal, agile, and specialized force based on domain mastery to ensure that we have the world's most talented operators to dominate in this domain. To achieve these priorities, we are leveraging the engine of American industry, harnessing the speed and innovation of the private sector to protect the cyber domain that powers our national security, our economic prosperity, and the American way of life. My office is leading the development of a Department of War cyber strategy to implement this pivot and I look forward to sharing with the committee when complete. Let there be no doubt, the Department of War's commitment to the defense of this nation is absolute. We have a solemn duty to ensure our joint force is equipped to dominate across the spectrum of conflict and within the highly contested cyber domain. The support of this committee is fundamental to our mission success. Thank you and I look forward to our questions here today. Thank you, Ms. Sutton. General Rudge, you're recognized. Chairman Bacon, Ranking Member Khanna, and distinguished members of the subcommittee, thank you for the opportunity to testify before you today. It's my distinct honor to testify beside Honorable Katie Sutton, Assistant Secretary of War for Cyber Policy. I'm honored to represent the soldiers, sailors, airmen, Marines, guardians, Coast Guardsmen, and civilians who defend our networks and deliver effects that matter every day. I want to thank this committee for your continued support for our critical mission at U.S. Cyber Command. I, too, want to thank and recognize Lieutenant General Joe Hartman, his wife Katherine, and their service for over three decades to this nation and an incredible contribution to Cyber Command and the National Security Agency. Cyber Comm's mission is threefold, defend the homeland, defend the Department of War's information networks, and support the Joint Force. In executing these missions, we maintain a formidable partnership with the National Security Agency. NSA's roles, responsibilities, and capabilities complement Cyber Comm's, creating a unity of effort that strengthens our common defense. Since taking command, I've emphasized four operating principles, speed, scale, innovation, and integration. I'm proud to report that Cyber Comm has been executing under these principles since before my arrival, which has made for a smooth transition. The team at Fort Meade has set the conditions for success, allowing me to hit the ground running and I'm excited about the future of Cyber Command. Throughout 2025 and into 2026, we've quickly adapted to the fast-paced strategic environment and rapidly changing character of warfare. In 2025 alone, we executed more than 8,000 missions, an increase of over 25% compared to 2024. We expect to exceed that pace in 2026 and with your support, I'm certain our talented force is up to the task. Cyber Comm gains experience and insights from real-world operations every day and that experience guides our operational support to the warfighter. Our innovative activity contributes to mission outcomes, to initiatives like Cyber Comm 2.0, and to the employment of technologies like AI. The Cyber domain cuts across all warfighting domains and integrating Cyber into joint force operation enhances combatant command effectiveness across the board. When called upon, Cyber Comm employs full-spectrum cyber operations with and on behalf of other commands to deter and, if necessary, defeat our adversaries. Our participation in Operation Absolute Resolve and Operation Epic Fury are prime examples of this integration in action. We're also executing the service-like authorities granted to us by Congress. Cyber Comm 2.0, approved by the Secretary of War, is moving at pace and achieving new milestones each month. Through Cyber Comm 2.0, we will deliver the capability and capacity to identify and hire a talented workforce, provide them with optimal training, and incentivize them to stay in the cyber force. Additionally, it will enhance our ability to work more closely with industry and academia to develop, acquire, and operationalize cutting-edge technologies. Cyber Command will continue to work with the Cyber Policy Team and the services to ensure Cyber Comm 2.0 is implemented effectively. Thank you for the privilege of appearing before you today. I look forward to working with you, and I look forward to your questions. Thanks to you both. I appreciate your opening comments. My first question is to General Rudd. You said your third missionary is supporting the joint force. You have had a lot of opportunity to do that in the last few months, particularly with Venezuela and now Iran. I know this is an unclassified setting, but I think it's important for the public, to the degree that you're allowed to say, talk about how you supported the joint force, and then we can go more in a closed session. Chairman, absolutely. Again, it's a privilege to step in at this time right now while the command is in a fight supporting a combatant command, 24-7, laser-like focus, side-by-side with the men and women of NSA, providing real-time support to the warfighter, and that's exactly what I would expect out of the combatant command that delivers the most in this critical domain. If I just may add, it's been impressive to hear the role that Cyber Command has had with our joint warfighters. You've done a tremendous job, the whole team. Ms. Sutton, are roles and responsibilities for the oversight of network operations and network defense across your office, the CIO, U.S. Cyber Command, and the military services clear today, or do we need to work on further delineation? I think there's some overlap, and overlap produces friction. Chairman, I appreciate the question today. As you know, I appreciate the support from Congress on the stand-up and creation of my office to consolidate some of the policy and principal cyber advisor roles. As you're aware, we're about two years in the making and have been working internally to clarify some of those areas. As I think about network defense, I see it as a spectrum of activities, and we need to focus less on having silos across these different organizations, but how do we really bring together what we're understanding from our adversaries, from an operational perspective, with how we're doing cybersecurity across the department. We're really looking at taking not only a whole of ASW approach, but a whole of department approach where we're really integrating the network security aspects and how we do cybersecurity with that operational aspect. The best way that I know to do that for my career is to work on how we partner and how we find common areas to make sure that we are bringing that information that we have from operations to how we set the standards across the department. Who is ultimately accountable for the DoD, securing the DoD networks? The chief information officer has responsibility for cybersecurity of the networks. Thank you. I know there's a little bit of overlap there, so I thought I'd ask. Given the pace and scale of cyber threats from countries like China and Russia, this is something we're working on in this NDAA and our defense approach. Are current cyber investments sufficient and where are additional resources or authorities needed? It is my impression that we may be underfunded compared to what China and Russia are doing. So I'm excited to be able to talk today about the budget that has been released I believe earlier this morning. What you'll see in that as we dig in is that there has been a substantial increase in investment for cyber priorities across the department, across a range of activities. I think as we look at continuing to grow those, we need to also make sure that we have the right approach to talent who are going to be really the linchpin in how we accomplish those. And so making sure that we have that right balance of being able to grow and train. And then also looking at where we can gain some efficiencies of implementing technology rather than just continuing to grow. What had we potentially adopted in our posture before that we might be able to improve with something else and then phase out the original approach? One of the tasks I have from the chairman of the overall committee is compared to look at the investments of Russia and China and say, are we doing an adequate level to counter that? And it's a little bit ambiguous right now what that data is showing. So your help, your all's help will be needed. My last question I'm going to yield to the ranking member, Cybercom 2.0 is intended to drive toward more specialized and mission ready cyber teams across the services. How are you ensuring the services are delivering a consistently trained and ready cyber force? Appreciate that question and appreciate the opportunity to have done the deep dive with the committee earlier this year. One of the key elements that you mentioned is that consistency and how we're addressing that is by setting the responsibilities of the services at the basic trained and qualified level and then a lot of the advanced training that we need, driving that into the responsibilities of cyber command through things like the advanced cyber training and education center so that we can have that unified approach and can also move at a speed that's easier to do within one organization and is operationally tied to our cyber mission force. Thank you. I yield now to my colleague and friend and ranking member, Rokata. Thank you, Mr. Chair, and thank you both for your service. I want to understand whatever can be explained in a non-classified setting in the shooting that happened in Iran of the school. Was AI used at all for that? Ranking member, I don't know that I have any information related to that and defer to Honorable Sutton on that. I would need to take that as a question for action. I also am not tracking the specifics of that. How would, though, a strike ordinarily like that take place, I mean, just in terms of targets in Iran? I mean, what is the role of the different intelligence agencies? How does the process work? So my roles and responsibilities are in the cyber domain. So unfortunately, I don't have the details on the specifics of how the kinetic targeting was done. Would you know, General, if that would happen? Ranking member, my previous experience, not within this command and not related to that operation, it's a very deliberate process that is, again, it would involve a tremendous amount of intelligence. It would involve a tremendous amount of expertise. It would involve experts that would analyze and assess weaponeering, again, outside of my current role. But the other thing that's consistent throughout all targeted processes, consistent legal reviews. How do you think we deal, though, with AI and lethal autonomy, I mean, in terms of your general view? Ranking member, I think this is a really important policy question, that as we look forward to the speed of how technology is moving, there's a couple of things that we're going to need to move quickly with the technology. The first is accountability. As we start looking at how AI gets integrated into different aspects of warfighting, really making sure we take the accountability that we've thought through from the kinetic domain and making sure that we're applying that to AI. I think this also highlights the importance of also how we secure these technologies to make sure that they aren't available for anybody else to have access to going forward. And we continue to hear that there's a shortage of qualified red team talent. Do you agree? And what can we do to address that? So I share your concern, and I would actually broaden your statement to say that there is a shortage of cyber talent. Red teaming is a specific element that I'm actually very personally familiar with in my previous capacities, have actually been responsible for red teaming. I think this is an area where we're seeing a lot of opportunity for AI use and how we can use AI from a red teaming perspective that we'll have to aggressively adopt going forward. And the last question is, do you think that the current cybersecurity service provider model is adequate to today's challenges? I think that as we go forward, we're going to have to look at how AI is going to change how we do that. And that will likely need to take a look at how we organize, as I mentioned, to most effectively use the resources that we have to be able to get at this problem. The scope and scale, as you know, of the Department of War Information Network is pretty extreme. And making sure we have the right team able to defend that quickly is going to be important. And that's something we'll be in partnership with the chief information officer, looking at very closely, particularly as we continue to stand up the DCDC subunified plan. Okay, Mr. Kano, Mr. Falun, you were recognized for five minutes. Thank you, Mr. Chairman. You know, obviously, cyber works, we can't take this for granted. And if you look just recently at Absolute Resolve and Operation Midnight Hammer, Operation Epicure, cyber comm was in the fight. And one of the things that I wanted to mention, too, and I would be remiss if I didn't is this is a testament to the men and women of this command and Secretary Sutton's office has been really instrumental and congrats on that. But we can't stand still the threat that isn't going to and Iran is a sophisticated cyber actor, as you all know. And we don't know what the leadership in that country is going to look like here shortly. But it may be something that they might double down on this because it's, they can hit us, you know, half a world away. And we all know this. One of the things that I'm most concerned about, and Secretary, when we're visiting is in retention, particularly recruitment, because the civilian sector can pay so much more. But much like our CIA, as we mentioned, that they can, the folks that want to serve do so because it's such a gratifying and significant contribution you can make to the Republic. And so is this, incidentally. So wanted to touch on, if you could, for the record, what's the rough breakdown between military or uniformed members as opposed to civilian, because I just want talented folks. And it might be easy for us to recruit talented folks that aren't in uniform because they might just have a little bit, you know, longer hair, they might have some tats, whatever. I don't care if they can hit those computer keys in a very adroit fashion. We need to, we need to recruit them and bring them in and keep them. Congressman, thanks for the question and really appreciate our discussion last week. As you mentioned, this is a fundamental problem that we need to look at. And today the, it varies by service, but it's approximately 80 to 90% uniformed within our cyber mission force. As we look at Cyber Command 2.0 going forward, one of the key pillars is how do we evaluate that balance so that, as you mentioned, we can bring in a wider pool of talent from civilians, from contractors, and then we also need to look at how we're going to leverage industry because there is tremendous innovation and talent in industry and we're going to have to figure out how we can leverage that through different mechanisms. So that is something that we are going to continue to focus on and need to be pretty aggressive going forward to make sure we have the talent that we need. I would just say aggressively recruit and we also need to let these young people know that if you come and you serve for even four or five years, you don't have to go career and then go out into the civilian workforce, I think it's going to add tremendous value to their resumes. I think the ranking member, you know, in the previous life he led could attest to that as well. Absolutely. One of the, I think, most compelling things to recruiting and retaining our force is our mission and the things that we allow our really talented service members and civilians to do. One of the things we need to work harder at is allowing them to keep on keyboard and stay on mission. And then, as you mentioned, the experiences that they gain for that will be highly valuable both in other roles in the government and in the private sector. So how do we leverage that throughout their life? And, Secretary, you also mentioned that, the quote here, that the current force is insufficiently scaled for the threat environment. And then I see the administration's FY27 budget request for CYBERCOM really doesn't reflect that urgency or its sourcing. So what I want to ask is, what is the delta between CYBERCOM 2.0, you know, the needs to execute and what the president's budget request provides? So one of the concepts of CYBERCOM 2.0 is that, instead of continuing to just grow the numbers of the force, to work on building the mastery of the force so that the capabilities of the people that we have are deeper and have that longer time on keyboard. And so that's really where we think we're going to get a lot of outsized impacts rather than just continuing to grow the level of the force that we have today. Thank you. General, thanks for your testimony today. I wanted to just visit real quick, if you could, in the time I have remaining, talk about timelines, because you were talking about new entities like the Cyber Talent Management Organization and Advanced Cyber Training and Education. Love all these ideas, and even the Innovation Warfare Center, and you say that they're under construction and slated to be operational in the near term. Can you talk more about the specifics on the timeline? Congressman, I would tell you just to lead with, again, going back to the principles against which we need to operate, speed, scale, innovation, integration, time's of the essence. So we need to move as fast as we can. And what I think I can provide you, maybe a follow-up for the record, is how we see those timelines being progressed and where we see opportunities to accelerate. Perfect. Thank you, General. Chairman, I yield. One quick follow-up question. Do we ever hire folks who are experts in the cyber field at a private company and bring them in, civilian or military? Just following up on this question. I believe we have. I can verify that. I'm pretty certain we have. And again, to me, that question speaks to a tremendous opportunity to get after scale and innovation. Again, it doesn't have to necessarily be in uniform all the time. There's other options, I think, where we can look creatively, where we can hire experts. We can maybe make them reservists or guardsmen. I think there's tremendous opportunity to be innovative here. We have a lot of cyber experts in our private industry in Omaha, and I think bringing them in would be helpful, too, just to have that exchange. Yeah. Chairman, I don't disagree with you at all. Ms. Houlihan, you are recognized for five minutes, ma'am. Thank you, Mr. Chair and General. It's nice to see you. Thank you. Thanks for joining me in my office. And, Secretary, it's also nice to be with you today, too. Time is of the essence, and speed and scale is really important, so I'll try to do my best with my five minutes to ask all these questions. As we know, CyberComm 2.0 is supposed to fix a number of problems, but one of them is around CyberComm's structure, which is supposed to now be modeled after SOCOM, correct? The CyberCommand 2.0 model was actually built on a blend of models within the department, so it included many elements of the Special Operations Force, but also things like the medical community and others as well. Excellent. And so, General Rudd, speaking from your prior position, not this position, would you consider Special Operations a domain, like the land, air, sea, space, and cyberspace area, or is it just unique operations that are shared with air, sea, and land domains? Congresswoman, the Special Operations Force is applied across all domains. So it's not its own domain. It is shared across all domains, as they are defined, land, air, sea, space. The specific forces within SOCOM span land, sea, and air, and interoperate with the cyber and space forces. So, Secretary Sutton, would you say that the cyber domain and the need for cyber operations will increase or reduce or hold steady over the next few decades? I think we've seen a very consistent upward trend that I don't anticipate to slow down any time soon. Me too, and that's why speed matters, and also, frankly, why I believe that this is its own domain that needs to be addressed in its own way, with its own force, to be honest. I'll move on and say that I believe that some of the issues that are confronting cyber comm are not just a cyber comm issue. They are coming from how our services, our individual services, are prioritizing cyber forces among their other requirements and responsibilities. So as an example, I would find it hard to believe that the Air Force would legitimately support a cyber wing over a fighter wing, as an example, or the Navy support a cyber group over a ship, or the Armory potentially supporting a cyber unit over an artillery battery, as an example. I know, General Rudd, in your new job, that you obviously are very interested in valuing cyber very highly, but it's because you're culturally incentivized to do that. But I believe that the Army is not necessarily incentivized to care about things like that, but rather infantry, artillery, tanks. And if you're a young cyber officer in the Army, I don't believe that you are thinking about your career in that way, but rather you're thinking about your career in Army operations terms that are more traditionally written. Would you assess that that might be true as well, General? Congresswoman, what I would expect in this role, I'll have the opportunity to work with all the services to express the importance of the talent management of the cyber force and advocate for advancement across all services. And I know that Mr. Bacon asked you, Secretary Sutton, a lot of good questions about incentivizing people and pay scales and recruiting, and a lot of really innovative ideas of how to do that. I would, I guess, argue my position is that we, just as much as we needed to separate the Air Force out in 1947, and just as much as we needed to separate out the Space Force in 2017, that there may indeed be a need to separate out the cyber force sooner rather than later. Assistant Secretary Sutton and General Rudd, do you think that Congress has made the right decision to establish an Air Force, even though the Army and the Navy opposed that? I second the motion, by the way. So I appreciate all the questions about the cyber force. I actually think this is a really important debate that as policy makers, we look forward to continuing. This is a very rapidly evolving domain, and making sure that we're organized appropriately is something that we really need to address going forward. I agree. This, and we'll conclude by saying this domain is clearly growing, not shrinking. And at some point, the cyber forces that we have generated by services that deliberately don't prioritize cyber for practical and cultural reasons won't be enough to meet our future cyber demands. And any significant change to our military structure, up and until we actually have a brand new service, I believe will be difficult. So all I'm asking you both and us here is that we have an open mind to the idea of a cyber force. While I very much welcome Cyber 2.0 and its recommendations, I genuinely worry that it's just not enough. So all I'm asking is, Secretary and General, will you commit to keeping an open mind on this issue? So, yes, I also appreciate the opportunity that you highlighted to articulate that Cyber Command 2.0 and a cyber force aren't a competing interest. We need to focus on the talent management of our force. And then we need to look at the organizational structure. I appreciate Congress's interest in this. My office and the department have been supporting the National Academies Study that I think was formed to do an independent look. I've testified twice in front of that committee and look forward to their report this month. Thank you, Secretary. I've run out of time. I also support a cyber academy as well. And General, just yes or no, do you support keeping an open mind on having an independent cyber force? Congresswoman, again, I align with the department and Honorable Sutton on this topic and, again, appreciate the fact that they're not in competition. It's not an either or. Thank you. I yield and I appreciate the indulgence of the chair. Mr. McCormick, you're recognized for five minutes, sir. Thank you, Mr. Chair. First of all, I kind of like the idea of multiple academies and multiple schools. The University of North Georgia is one of those schools that competes across the nation, actually dominates. A little school in Georgia actually dominating the cyber intelligence community has been great to see. I think it's also an elite Army school for you Army guys out there. I see you've got a Marine here and cyber is just kind of an amazing leap of technology when we used to eat crayons. Well, we still eat crayons, but we're doing a little bit of things now. Really excited to see the evolution from a guy who literally learned how to use a computer in the Marine Corps, which is kind of a scary thought at that. But one of the things I've noticed that's maybe a great recruiting tool and I wanted to kind of get your affirmation, maybe expand upon. Just like we recruit lawyers. And one of the reasons we're great at recruiting lawyers because we give them real trial experience. Most people in the cyber community can't go out there and practice this offensively unless they work for the government. So this is a great opportunity, not just to develop something, but to actually apply it, which is a great selling tool. But what else can we do to not only train people, but recruit them and retain them in these cyber commands, which I think is essentially all in the same arena of being competitive in this very world competitive market. So I appreciate the highlighting you started out with, with the talent that we get from a pretty wide variety of universities, many of which are the NSA Cyber Centers of Excellence School has been a great program to be able to get that pipeline in. The challenge that we're really now faced with is how do we recruit them in full time and how do we retain them? I think there's the primary thing that we've seen from our force over the last few years is the importance of keeping them on mission and giving them the opportunities to build that talent that as you very accurately highlight is something they can only do in our force. And then also making sure that we have the right incentive structure, we have the right career paths so that they can grow and they can succeed in their service, but do it in a way that is meaningful for building that mastery into the skill that we have today. Fantastic. General Rudd, yesterday we had a great opportunity to speak in person and kind of talk about the futures. We talked about a united command, which is going to be a central focus I think of this committee is kind of do we do this combined, do we do this separate? And I've heard arguments of both. I'm kind of open minded and I'm forming an opinion every single day trying to be more educated. Specifically to the Marine Corps though, I was going to ask, when we first got computers and we broke a bunch of them along the way, we learned in service. Now we're out service and we're learning all these people. How does the Marine Forces Cyber, also known as MAR4 Cyber, currently support the joint force? What role do they play in the future fight as far as the difference between the separation as an independent entity, kind of like we did with the A6Bs where we use it as a purple force or is it used specifically for a Marine Corps mission, which is kind of a tough question I know, but if you could just tell me the difference between the applications, which will help me make up my mind as to how we form the future. So this is it right here, Congressman, right? No pressure. Hey, just one point on the recruiting, if I could go back to that question. I think there's tremendous opportunity to tell the cyber story, maybe in a different way, maybe in a more open way than what we've done previously, that it's going to generate interest around. I don't know that I can recall a time in our history where we've talked more about it openly, perhaps because maybe we're not doing, we've never done as much as we have done in recent history, but that's one point. The question with regard to support to the joint force, MAR4 Cyber is doing a tremendous job across a number of commands, and again, in support of the joint force, integrating really seamlessly, whether it's a combatant command or special operations command, they do tremendous work, again, in real time, 24-7 commitment. The integration is really dependent upon culture, communication, and co-location in many cases. If they can be side by side, it doesn't always have to be, obviously, there's a tremendous power in the remote aspect of the cyber force, but those are kind of key aspects that I'd highlight to your question. So specifically, do you think, both of you, I'm just curious, what is the main advantage of having each service have their own cyber command versus a combined? So I think one of the things that is important to discuss as we think about a cyber service is where the boundary of things and services, like defending their networks and defending the weapons systems and ensuring cyber security in the weapons systems they build, how that would separate out from things like a cyber mission force that would conduct operations in support of the joint force, and ensuring that those boundaries are well-defined as you would think about different organizational constructs going forward. With that, I'm out of time, and I yield. Thank you, Mr. Chairman. Thank you. Mr. Ryan, you are recognized, sir, for five minutes. Thank you, Mr. Chair. Thank you both for being here. Assistant Secretary, thanks for the time, was that last week? This week? Whenever it was. Thank you. General, thanks. Twice in one week. Sorry about that. I want to build on really good, I think, encouraging bipartisan discussion about broadening the base and the foundation of our cyber talent force as a nation, not just whatever we end up, however we end up organizing within and across the services and within DOD, really thinking about this as a national problem. And General Rudd, you talked about this and sort of alluded to it earlier, and you talked about it in your written testimony. I think you described it as a joint cyber reserve component or funded reimbursable authority in your submitted statement. General Hartman, on his departure, talked about a cyber auxiliary. We talked a little bit as well, Assistant Secretary. I think would love to hear both of your thoughts on this. This is something I've been working on the last few years. We've had multiple attempts in the NDAA to introduce this concept, specifically how do we get the full breadth of our civilian cyber force engaged at various levels of, you know, if one level is I'm doing a PT test every month and I'm in uniform, and the other level is no engagement, how do we broaden that out and create multiple avenues for people to plug in and serve a whole host of missions? So General, starting with you, if you wouldn't mind expanding on your testimony and sharing any thoughts there. Sure. Thank you, Mr. Congressman. I think there's tremendous opportunity with this idea, whether it's reserve, auxiliary, or all of the above. I think we don't need to limit the manner in which we approach this because, again, the talent is so unique and there's such tremendous opportunity in the commercial sector to leverage expertise and, again, by extension, you're going to force multiply. We can be more creative. We can figure out, I think, you know, we may be some of our own impediments in terms of process, speed at which we can grant clearances, et cetera. I think we need to be more creative about that. It's definitely something that I'm interested in taking a deep look at as part of my initial assessment. I know Honorable Sutton and her team have looked at it in depth, but, again, I just don't think we can afford to limit the creative solutions to expanding the cyber workforce and, in doing so, leverage tremendous talent that's out there. And maybe just to lead in to you, Assistant Secretary, agree more is always better generally. I think particularly every dollar we can spend on cyber, the ROI is dramatically higher than a lot of our other opportunity costs. But what would you see as a first step or two? And I ask this because I think coming into this NDA, we want to be aligned with you all as you're rolling out your changes. Is there anything, any first initial steps, either for you, Assistant Secretary, or back to you, General, in terms of, you know, does the idea of some sort of joint reserve component resonate with you? Has your team been able to look at that with any great depth yet? Thank you again for meeting last week. I really appreciate the discussion and the ability to talk through some of these topics in depth. As we mentioned, I completely concur with everything General Rudd said. I think this is not a place for us to limit ourselves. We have to open up the talent pool that we can recruit from, and I think there's different models to look at. One of the things that my team has been focused on over the last year at the direction of this committee was to look at the civilian reserve model. That study has been completed. I think there's a lot of really good recommendations that we need to start looking at what the first steps would be to move forward with how we might implement pieces of that, and particularly how that can support also not just the Department of War, but the whole of government effort that's going to be a large-scale problem where civilians might have a really great tie-in to other areas as well. We talked about this a little in my office. As a former local elected official, imagine major debilitating cyber attack of some kind on the nation. The ability at local government level to answer that is just very limited, and I think folks would naturally look towards some ability to extend the very unique high-end capabilities right now out across the nation. That's part of the thinking here as well, to some degree, to provide capacity and expertise there. I only have a few seconds left. Anything you want to add, General Rubin, before I yield back? The only thing I'd add, Congressman, is that I think the same idea applies to National Guard as well. I mean, look at localized state protection in these domains, especially when you talk about critical infrastructure, tremendous opportunity. Thank you, and I yield back, Mr. Chair. Thank you. Mr. Vindman, you are recognized for five minutes. Thank you, Chairman. Thank you to the witnesses. Thank you, Honorable Sutton, for your engagement today and also for your engagement prior to this. I think that's a good model for the relationship we should have in Congress. So are there any key policy, legal, or bureaucratic constraints limiting CyberCom's ability or agility, and, for example, in authorities, data sharing, acquisition, and what specific statutory or policy changes are needed to make a more effective CyberCom 2.0? So thanks again for the meeting. I also agree that that's a great model to use going forward to make sure that we're in lockstep. I think as we dive into the implementation, and as General Rudd mentioned in his statement every month, we have outcomes that we're starting to deliver, we are going to start uncovering some of these statutory and policy hurdles, and that's the role of my office, is to identify those. If they're statutory, to bring them to the committee and let them know some of the challenges we're facing. If they're policy internals of the department, figuring out how we can fix those. And then I think as we think about, so that's from a talent perspective, and then as far as a technology perspective, one of the things as we think about AI and moving forward is that the technology is moving very quickly, much faster than we traditionally move as a policy perspective. And so making sure we're thinking about policies in the right way so that we can have all the authorities we need to use these in ways that allow us to have the advantage that we'll need going forward. Yeah. And especially as it relates to AI, and obviously there are some concerns and potential dangers that is important for us to have a dialogue on what the authorities are and what some of the constraints are to make sure we have the balance right. General Rudd, what are the biggest challenges in recruitment, retention, and proper utilization of the reserve and guard cyber talent? Congressman, I think I owe you a little bit deeper study on that before I can give you a very definitive answer. But what I would expect is a little bit of what we're already discussing is competition for incentives with the commercial sector, but then also where do we have our own obstacles within our own process? Does it take too long to onboard somebody? Are the requirements, you know, either medical or physical antiquated and or don't apply? I'm not implying that we reduce standards. But what I am suggesting is maybe we just need to look at how we move quickly through barriers if that is a competition and adds to the competition for talent. Maybe it's something we need to relook. But I think I owe you a little bit deeper look on that before I can give you a better answer, Congressman. I appreciate that. And I look forward to a deeper dive on that. And obviously, thinking through also what standards ought to apply to the types of folks that we want to be our cyber warriors, I think is important as well. How would a joint cyber reserve component resolve underlying issues? I don't know if you've thought about that yet. Are there any statutory or funding challenges that require this committee's assistance in that regard? I, I'm I suspect honorable sentence, put a little bit of thought to it. But I can tell you right now, just on the topic of reserve writ large, the funding goes through the services right now. So we're challenged at cyber calm to move quickly to leverage resources to activate reserve in a manner that would sometimes be late to need and in competition. But I'll defer to Honorable Sutton. I think Joe Rudd has really hit the nail on the head here, that this is something we need to look at from a joint perspective and something with cyber command service like authorities, we need to continually evaluate what those look like, as appreciate all the support from the committee on getting many of those authorities into law. As we start implementing those, for example, enhanced budget control, understanding where some of these lines need to settle out now that we have a couple years in the budget, as my role as assistant secretary, and in my service, secretary like role, I think those are exactly the questions we need to ask is, what is the structure in the department, we would need to fund a joint reserve? Is that part of cyber command service like authorities? And how do we get after that pretty quickly? Because, as General Rudd alluded, there's significant talent in our reserves. And I think that's a nut we just haven't fully cracked yet. Thank you. I yield back. Thank you, Mr. Whiteside. You're you are recognized for five minutes. Thank you, Mr. Chairman. Thank you both for your service. Cybercom and DoD generally have supported Ukraine against Russian hacking attempts, which has been effective at keeping Ukrainians with power and heat intermittently throughout the war with Russia. How is cybercom using lessons learned from that conflict to support protection of our own infrastructure? I can go first, but you look like you're going to lean in. So, as I mentioned earlier, I think one of the keys to our success is going to be able to identify adversary threat activity, and then do exactly what you said, which is how do we learn from that? And how do we implement that on our own critical infrastructure, bringing that offensive and defensive perspective is really important. And I think one of the key steps of how we're starting to get after that and get a need to continue to accelerate is the elevation of the subordinate DCDC Defense Command under Cyber Command. So we have the Offensive Cyber National Mission Force. Now we have the defensive all under one commander who might be sitting next to me. And so I think there's a lot of opportunity to need to take those lessons learned from where we've seen adversarial activity and really make sure we're quickly operationalizing it from a defensive perspective. And Congressman, I'll build on that. It even starts further left with the unique relationship with the NSA and the insights that we gain through intelligence that then inform the techniques and the locations and then to Honorable Sutton's point, moving through with the expertise of Cyber Comm, then in coordination and then distributed to the DCDC for the defensive activities that need to take place across the network. That is an example of where a multifaceted command structure under one authority, well, different authorities, but one person enables speed and agility to put ourselves in a better position to defend our critical infrastructure. Thank you, General. General, I was glad to see your testimony emphasize the workforce development efforts you're making to build your team in this rapidly evolving threat environment and the emphasis on building partnerships with other agencies, academia, and industry. I did want to express my concerns, not directly with your responsibility, but I think it's an important thing to say in this setting that certain actions that the Department is taking unnecessarily put those good efforts at risk, for example, by labeling a leading supplier, a supply chain risk, just as we are wanting to increase the number and types of nontraditional defense suppliers with expertise in cybersecurity and data analysis. I don't know if you have any comments on that general subject. So I think what is really where there's a tremendous opportunity in front of us is figuring out how we are going to approach what is a very momentous time where we're seeing a very rapid transition from human speed to machine speed. And we're going to need to make sure that we're really looking across the Department and how we address that. It's not going to be a single solution of a single model or a single company. As I mentioned, the technology is not what scares me the most from a policy perspective. It's how are we going to change TPs of how we operate in the Department. We're no longer going to be able to patch where we identify a patch, we have a lot of time to test it, and then we can issue an order and then have a lot of time to patch it. We're going to have to really compress that. And I think that's where from a policy perspective, not being in charge of acquisitions, but from a policy perspective, really looking at making sure that those things don't get lost as we see a lot of capabilities coming forward, really across the entire frontier model ecosystem, making sure that we're ready for that going forward. Congressman, I would just add that we need to anticipate the speed to the extent we can possible and be in position to be able to leverage technology as it happens ahead of commercial and adversary potential uses of it. Yeah, I couldn't agree more. And I think just as an almost editorial comment, we need to take the best of American innovation and integrate that into our national security. And so I hope that we can sort of work as adults to do that across the ecosystem of private industry. Thanks for your service. And I yield back. Thank you, Ms. Alfroth. You're recognized. Thank you, Mr. Chair. Thank you for allowing me to wave on to the subcommittee today. Thank you, Madam Secretary. I appreciate your career-long focus on this issue. I was a little bit disappointed to see in the National Defense Strategy, just kind of a handful of references to cyber. You know, I think everybody here and on full committee fully appreciates. General, you said how Cyber Command enhances combatant command effectiveness. I mean, I think we could all agree with you. And I think it's so essential we wouldn't be successful. I think it's that critical at this point in this era of warfare. But I'm concerned by the lack of stress in the National Defense Strategy. But I'm curious, you mentioned soon to be coming out with the new cyber comm strategy. What is the timeline for that? And are you going to get that to us as soon as possible? Absolutely. So one of the primary goals of the Department of War Cyber Strategy that we're working on is to take sort of those higher level guidelines and really get specific about what that means in cyber. So there's a few things just to sort of broaden where we're looking at. Obviously, the National Security Strategy and the National Defense Strategy. But the recently released Cyber Strategy for America is also an area that provides pretty consistent guidance of where we need to go. We're taking all of those and really making it an integrated approach. It's going to be a very bold transformation of how we think about cyberspace. We're working it very quickly. The anticipation would be to have that completed this summer so that we can move out on implementation. And absolutely, we will be happy to not only provide with the committee, but come and have any discussions or go through any questions that you might want. I appreciate that. I hope I do get invited back for that important discussion. I do want to briefly touch the last time I waved onto this committee. It was kind of peak doge and significant rifts, particularly on the civilian side. Can you give us an update on, I believe, I don't want to say a number here in an open session, but were the proposed reductions in force actually executed on? So I would need to take that as a question for the record. I think largely most of that happened before I came in as Assistant Secretary. Okay. I appreciate that. General, so excited to have you. Welcome to the committee. Welcome to Maryland. Welcome to Fort Meade. It's exciting to have a combatant commander here and ready to take cyber command to the next level. I do, as this is such a healthy discussion about, you know, 16 years into this cyber comm exercise, what we've done well, what we can do better, how other countries are kicking our butts a little bit here and there. I also think as we're talking about, you know, thankfully, how essential cyber comm is, I'm not seeing that necessarily, and for Secretary Sutton, I'm not necessarily seeing that in how we are resourcing all of our installations that are essential to cyber comm. You know, representing the fence line of Fort Meade, a lot of money has gone to the NSA side, which is wonderful. Garrison side needs, I think, some greater support, particularly because it does support the incredible work on the NSA side. And I just, I'm not seeing as essential as cyber is, I would like to see DOD investment a little more in all of the whole of the installation. So I guess my question is, despite its operational significance, critical nature, Fort Meade is not formally designated or resourced as a traditional power projection platform. I'd like your thoughts on that, because I think we can do better. I will admit I'm not familiar with what it takes to get that designation, so would like to take that for the record. But share your sentiment, I believe, which is if we're going to build the world's most talented cyber force, we need to have facilities that they can operate in that meet those needs. And where we aren't putting artificial burdens up with their facilities or their ability to come to work and do what they need. And to be clear, we've made tremendous investment in the infrastructure of Fort Meade on both sides, Garrison side and NSA side. I just think there's, considering how it's expanded, generally you're speaking about all the operations percent increase over the years. I think we just need to have a different kind of focus on, in our MilCon, on the support of this essential operation. General, I only have a couple seconds left. I'll give you any thoughts here. Congresswoman, you're not going to get anything except tremendous support and agreement on doing everything we can to put our facilities in a position that offer world-class support to world-class cyber operators, warriors, and more importantly, their families. I appreciate that. A couple of seconds left. Last year, while you weren't here, we did talk about the emphasis needed on mental health support for our cyber warriors. They're dealing with a unique pressure, and I just want to make sure that we're doing everything we can. Perhaps we can talk about it more in closed session, but it's something I know, I hope you both are taking very seriously and we can continue to build out the support system necessary for our cyber warriors. Thank you, Mr. Chair. Thank you. I appreciate all the discussions, too, on the separate cyber force. I think it merits discussion. I, for one, am a little bit skeptical, just to say. My concerns are, I think we just add more general officers, more administrative costs. I like the SOCOM model that we have now. I think we've got to give it time to see it works and see how we can fine-tune it. I also fear if they had a separate cyber force, it would perhaps maybe break that linkage with NSA that I find so valuable that we have today with the dual hat. I think that's what gives us real power with Cyber Command is this synergy that we have formed with NSA, and I don't want to disturb that, but that's just my perspective, and I welcome those discussions. But at this time, we're going to conclude the open portion of today's subcommittee hearing. For members who will not be joining us, questions for the record will be due to the committee within a week after the conclusion of the hearing. With that, I want to thank you for this open session. We will convene now in the SCIF and Rayburn 2337 for the classified portion, and the subcommittee is adjourned.