Cyber Posture of the Department of Defense

Okay first of all, thank you to both of our folks coming in here today. We appreciate you. But first, I got to ask unanimous consent that non-subcommittee members be allowed to participate in today's hearing after all subcommittee members have had an opportunity to ask questions. Is there an objection? Okay, without objection, non-subcommittee members will be recognized at the appropriate time for five minutes. And I welcome everyone today at today's hearing on cyber posture of the Department of Defense. Today's hearing comes at a time of increased cyber activity targeting U.S. infrastructure, including recent campaigns against telecommunications and critical infrastructure networks. It also comes at a time when cyber operations are being integrated into military operations more than ever before. U.S. Cyber Command has supported recent operations including Operation Midnight Hammer in Iran and Operation Absolute Resolve in Venezuela. The department with the support of Congress has continued to develop its cyber forces. Over the past several years, the Cyber Mission Force has grown and matured. Cyber Command has received enhanced budget control. The role of the Assistant Secretary of the Cyber Policy has been established and filled. And the department has stood up the Department of Defense Cyber Defense Command, DCDC, as a sub-unified command. The maturation is continuing. Cyber Command has initiated organizational and force generation perform effort known as Cybercom 2.0. Focused on improving workforce management, training, readiness, and operational effectiveness. This effort is intended to create more defined career paths, enable greater specialization and improve the department's ability to respond to emerging threats. We look forward to hearing about how these efforts are improving department cyber posture and where challenges remain. We are joined today by Ms. Katie Sutton, the Assistant Secretary of Defense for Cyber Policy and Principal Cyber Advisor to the Secretary of Defense. Prior her appointment, she served at Cyber Command and on the staff of both the House and Senate Armed Services Committees. Ms. Sutton, thank you for being here. We are also joined by General Joshua Rudd, who was sworn in as the commander of U.S. Cyber Command and director of the National Security Agency in March. General Rudd, thank you for joining us. We'll just go ahead, okay. So what we're going to do is just going to yield directly to the testimony. So with that, we yield to Ms. Sutton and then we'll go to General Rudd.

Chairman Bacon and distinguished members of this committee, thank you for the opportunity to testify here today. I'm honored to be here with General Rudd, whose immense experience, especially in the INDOPACOM Pacific region, will prove invaluable as we posture to implement the National Defense Strategy. I also congratulate Lieutenant General Hartman on his retirement and thank him for his service and visionary leadership that has built the cyber enterprise over the years, setting the stage for our future success. In my role, I'm responsible for overseeing the department's cyberspace operations policy, integrating cyber activities across the department, and exercising authority, direction, and control over U.S. Cyber Command. I'd like to start by highlighting today the new and ever-dynamic strategic environment that we face in the cyber domain. The character of cyber warfare is changing rapidly, shaped by a growing threat posed by our adversaries and accelerated by the ever-growing power of technology. We must act decisively to transform our cyber enterprise and deliver the robust cyber capabilities and optionality required for the President and Secretary to defend American security, freedom, and prosperity. One major change that we're seeing is that our cyber actors are no longer just conducting espionage. They are preparing for conflict. Our adversaries have moved beyond theft and are pre-positioning disruptive capabilities inside our nation's critical infrastructure. This strategic shift from exploitation to effects aims to disrupt military deployments and sow chaos in crisis or conflict. Cyber threat actors like Volt Typhoon are not just a nuisance, they represent a significant and persistent threat to our national security. Second large change is artificial intelligence has become a powerful force multiplier, increasing the speed, scale, and sophistication of these threats. AI accelerates the entire attack lifestyle, creating a new dynamic where the pace of attacks challenges our ability to react and the scale overwhelms our ability to defend. Rapid innovation has also lowered the barrier for entry for advanced cyber capabilities, blurring the lines between nation-states and other malicious actors. Our adversaries are operationalizing AI to outcompete us, and we must move urgently to put these same tools in the hands of our warfighters. Given these realities, a purely defensive posture is no longer sufficient. To implement the 2026 National Defense Strategy's vision of achieving peace through strength, we must pivot our approach. That pivot is guided by three core priorities. The first is that we must integrate cyber across all domains of warfare. Cyber is the connective tissue of modern warfare. We will integrate cyber capabilities across every warfighting domain to provide the President and Secretary with a full range of options to deter conflict and ensure the joint force has every advantage. Second, we must gain strategic advantage below the level of armed conflict. We will deny our adversaries freedom of movement. This means not only building a resilient defense, but also empowering our world-class cyber operators to work across the full spectrum of cyber operations. Our adversaries must be deterred in cyberspace, and we must reevaluate our approach to contesting the growing aggression in cyberspace that threatens U.S. interests, our national security, and our ways of life. Third priority is that our force must organize to dominate. Our strategies are only effective as the force that executes them. Through the Cybercom 2.0 initiative, we are undertaking the most comprehensive transformation of our cyber force since its inception. This evolution transcends legacy structures to elevate our operational readiness, scale our technical advantage, and propel our force to meet the demands of modern conflict. We are forging a more lethal, agile, and specialized force based on domain mastery to ensure that we have the world's most talented operators to dominate in this domain. To achieve these priorities, we are leveraging the engine of American industry, harnessing the speed and innovation of the private sector to protect the cyber domain that powers our national security, our economic prosperity, and the American way of life. My office is leading the development of a Department of War cyber strategy to implement this pivot, and I look forward to sharing with the committee when complete. Let there be no doubt, the Department of War's commitment to the defense of this nation is absolute. We have a solemn duty to ensure our joint force is equipped to dominate across the spectrum of conflict and within the highly contested cyber domain. The support of this committee is fundamental to our mission success. Thank you, and I look forward to our questions here today.

Thank you, Ms. Sutton. General Rudd, you're recognized.

Chairman Bacon, Ranking Member Khanna, and distinguished members of the subcommittee, thank you for the opportunity to testify before you today. It's my distinct honor to testify beside Honorable Katie Sutton, Assistant Secretary of War for Cyber Policy. I'm honored to represent the soldiers, sailors, airmen, marines, guardians, coastguardsmen, and civilians who defend our networks and deliver effects that matter every day. I want to thank this committee for your continued support for our critical mission at U.S. Cyber Command. I too want to thank and recognize Lieutenant General Joe Hartman, his wife Catherine, and their service for over three decades to this nation and an incredible contribution to Cyber Command and the National Security Agency. Cybercom's mission is threefold. Defend the homeland, defend the Department of War's information networks, and support the joint force. In executing these missions, we maintain a formidable partnership with the National Security Agency. NSA's roles, responsibilities, and capabilities complement Cybercom's, creating a unity of effort that strengthens our common defense. Since taking command, I have emphasized four operating principles. Speed, scale, innovation, and integration. I'm proud to report that Cybercom has been executing under these principles since before my arrival, which has made for a smooth transition. The team at Fort Meade has set the conditions for success, allowing me to hit the ground running, and I'm excited about the future of Cyber Command. Throughout 2025 and into 2026, we've quickly adapted to the fast-paced strategic environment and rapidly changing character of warfare. In 2025 alone, we executed more than 8,000 missions, an increase of over 25 percent compared to 2024. We expect to exceed that pace in 2026, and with your support, I'm certain our talented force is up to the task. Cybercom gains experience and insights from real-world operations every day. And that experience guides our operational support to the warfighter. Our innovative activity contributes to mission outcomes, to initiatives like Cybercom 2.0, and to the employment of technologies like AI. The cyber domain cuts across all warfighting domains, and integrating cyber into joint force operation enhances combatant command effectiveness across the board. When called upon, Cybercom employs full-spectrum cyber operations with and on behalf of other commands to deter and if necessary, defeat our adversaries. Our participation in Operation Absolute Resolve and Operation Epic Fury are prime examples of this integration in action. We're also executing the service-like authorities granted to us by Congress. Cybercom 2.0, approved by the Secretary of War, is moving at pace and achieving new milestones each month. Through Cybercom 2.0, we will deliver the capability and capacity to identify and hire a talented workforce, provide them with optimal training, and incentivize them to stay in the cyber force. Additionally, it will enhance our ability to work more closely with industry and academia to develop, acquire, and operationalize cutting-edge technologies. Cyber Command will continue to work with the cyber policy team and the services to ensure Cybercom 2.0 is implemented effectively. Thank you for the privilege of appearing before you today. I look forward to working with you, and I look forward to your questions.

Thanks to you both, appreciate your opening comments. My first question, General Rudd, you said the third, your third missionary is supporting the joint force. You have had a lot of opportunity to do that in the last few months, particularly with Venezuela and now Iran. I know this is an unclassified setting, but I think it's important for the public to the degree that you're allowed to say, talk about how you supported those the joint force, and then we can go more in the closed session.

Chairman, absolutely. I again, it's it's a privilege to step in at this time right now while the command is at a in a fight supporting a combatant command. 24/7 laser-like focus side-by-side with the men and women of NSA providing real-time support to the warfighter, and that's exactly what I would expect to out of the combatant command that delivers the most in in this critical domain.

If I just may add, it's been impressive to to hear the role that Cyber Command has had with our joint warfighters. You've done a tremendous job, the whole team. Ms. Sutton, our roles and responsibilities for the oversight of network operations and network defense across your office, the CIO, U.S. Cyber Command and the military services clear today, or do we need to work on further delineation? I think there's some overlap, and overlap produces friction.

Chairman, I appreciate the question today. As you know, appreciate the support from Congress on the stand-up and creation of my office to consolidate some of the policy and principal cyber advisor roles. As you're aware, it's we're about two years in the making and have been working internally to clarify some of those areas. I think as I think about network defense, I see it as a spectrum of activities and we need to focus less on having silos across these different organizations, but how do we really bring together what we're understanding from our adversaries from an operational perspective with how we're doing cybersecurity across the department. And so we're really looking at taking a whole of not only a whole of ASW approach, but a whole of department approach where we're really integrating the network security aspects and how we do cybersecurity with that operational aspect. And the best way that I know of to do that from my career is to work on how we partner and how we find common areas to make sure that we are bringing that information that we have from operations to how we set the standards across the department.

Who is ultimately accountable for the DOD securing the DOD networks?

The Chief Information Officer has responsibility for cybersecurity of the networks.

Okay, thank you. I just I know there's a little bit of overlap there, so I thought I'd ask. Okay, given the pace and scale of cyber threats from countries like China and Russia, and this is something we're working on in this NDAA and our defense approps, are current cyber investments sufficient, and where are additional resources or authorities needed? It is my impression that we may be underfunded compared to what China and Russia are doing.

So excited to see the or excited to be able to talk today about the budget that has been released, I believe earlier this morning. What you'll see in that as we dig in is that there has been a substantial increase in investment for cyber priorities across the department across a range of activities. I think as we look at continuing to grow those, we need to also make sure that we have the that we have the right approach to talent who are going to be really the lynchpin in how we accomplish those. And so making sure that we have that right balance of being able to grow and train, and then also looking at where we can gain some efficiencies of implementing technology rather than just continuing to grow what had we potentially adopted in our posture before that we might be able to improve with something else and then phase out the original approach.

One of the tasks I have from the chairman of the overall committee is compared to look at the investments of Russia and China and that are we doing an adequate level to counter that. And I think it's a little bit ambiguous right now what that data is showing. So your help your also help will be needed. My last question, then I'm going to yield to the ranking member. Cybercom 2.0 is intended to drive toward more specialized and mission-ready cyber teams across the services. How are you ensuring the services are delivering a consistently trained and ready cyber force?

Appreciate that question and appreciate the opportunity to have done the deep dive with the committee earlier this year. One of the key thing elements that you mentioned is that consistency. And how we're addressing that is by setting the responsibilities of the services at the basic trained and qualified level, and then a lot of the advanced training that we need, driving that into the responsibilities of Cyber Command through things like the Advanced Cyber Training and Education Center so that we can have that unified approach and can also move at a speed that's easier to do within one organization and is operationally tied to our cyber mission force.

Okay, thank you. I yield now to my colleague and friend and ranking member, Ro Khanna.

Thank you, Mr. Chair, and thank you both for your service. I want to understand whatever can be explained in a non-classified setting in the shooting that happened in Iran of the school. Did was AI used at all for that?

Ranking member, I don't know that I have any information related to that and defer to Honorable Sutton on that.

I I would need to take that as a question for action. I also am not tracking the specifics of that.

How would though a strike ordinarily like that take place? I mean, just in terms of targets in Iran. I mean, what is the role of the different intelligence agencies? How does the process work?

So my roles and responsibilities are in the cyber domain. So unfortunately, I I don't have the details on the specifics of how the kinetic targeting was done.

Would you know, General, of how it happens?

I second the motion, by the way.

Ranking member, the my previous experience, not within this command and not related to that operation, it's a very deliberate process that is again, it it would involve a tremendous amount of intelligence, it would involve a tremendous amount of expertise, it would involve experts that would analyze and assess weaponeering. Again, outside of my current role, but the other thing that's consistent throughout all targeting processes is consistent legal reviews.

How how do you think we deal though with AI and lethal autonomy? I mean, in terms of your general views.

Ranking member, I think this is a really important policy question that as we look forward to the speed of how technology's moving, there's a couple things that we're going to need to move quickly with the technology. The first is accountability as we start looking at how AI gets integrated into different aspects of warfighting, really making sure we take the accountability that we've thought through from the kinetic domain and making sure that we're applying that to AI. I think this also highlights the importance of also how we secure these technologies to make sure that they aren't available for anybody else to have access to going forward.

And we continue here that there's a shortage of qualified red team talent. Do you agree, and what can we do to address that?

So I share your concern, and I would actually broaden your statement to say that there is a shortage of cyber talent. Red teaming is a specific element that I'm actually very personally familiar with in my previous capacities have actually been responsible for red teaming. I think this is an area where we're seeing a lot of opportunity for AI use and how we can use AI from a red teaming perspective that we'll have to aggressively adopt going forward.

And the last question is, do you think that the current cybersecurity service provider model is adequate to today's challenges?

I think that as we go forward, we're going to have to look at how AI is going to change how we do that, and that will likely need to take a look at how we organize, as I mentioned, to most effectively use the resources that we have to be able to get at this problem. The scope and scale, as you know, of the Department of War Information Network is pretty extreme, and making sure we have the right team able to defend that quickly is going to be important. And that's something we'll be in partnership with the Chief Information Officer looking at very closely, particularly as we continue to stand up the DCDC sub-unified command.

Thank you, Mr. Khanna. Mr. Fallon, you are recognized for five minutes.

Thank you, Mr. Chairman. You know, obviously, cyber works, we we can't take this for granted. And if you look just recently at Absolute Resolve and Operation Midnight Hammer, Operation Epic Fury, Cybercom was in the fight. And one of the things that I wanted to mention too, and I would be remiss if I didn't, is this is a testament to the men and women of this command and Secretary Sutton's office has been really instrumental and congrats on that. But we can't stand still, the threat isn't going to, and Iran is a sophisticated cyber actor, as you all know. And we don't know what the leadership in that country is going to look like here shortly, but it may be something that they might double down on this because they can hit us, you know, half a world away. And we all know this. One of the things that I'm most concerned about, and Secretary, when we were visiting, is recruitment and retention, and particularly the recruitment because the civilian sector can pay so much more. And but much like our CIA, as we mentioned, that they can the the folks that want to serve do so because it's such a gratifying and significant contribution you can make to the republic. And so is this, incidentally. So wanted to touch on, if you could for the record, what's the rough breakdown between military or uniformed members as opposed to civilian? Because I just want talented folks. And it might be easier for us to recruit talented folks that aren't in uniform because they might just have a little bit, you know, longer hair, they might have some tats, whatever, I don't care if they can hit those computer keys in a very adroit fashion, we need to we need to recruit them and bring them in and keep them.

Congressman, thanks for the question and really appreciate our discussion last week. As you mentioned, this is a fundamental problem that we need to look at. And today, the it varies by service, but it's approximately 80 to 90 percent uniformed within our cyber mission force. As we look at Cybercom 2.0 going forward, one of the key pillars is how do we evaluate that balance so that, as you mentioned, we can bring in a wider pool of talent from civilians, from contractors. And then we also need to look at how we're going to leverage industry because there is tremendous innovation and talent in industry, and we're going to have to figure out how we can leverage that through different mechanisms. So that is something that we are going to continue to focus on and need to be pretty aggressive going forward to make sure we have the talent that we need.

I just aggressively recruit, and we also need to let these young people know that if you come and you serve for even four, five years, you don't have to go career, and then go out into the civilian workforce, I think it's going to add tremendous value to their resumes. I think the ranking member, you know, in the previous life he led could attest to that as well.

Absolutely. One of the I think most compelling things to recruiting and retaining our force is our mission and the things that we allow our really talented service members and civilians to do. One of the things we need to work harder at is allowing them to keep on keyboard and do and stay on mission. And then as you mentioned, the experiences that they gain for that will be highly valuable both in other roles in the government and in the private sector. So how do we leverage that throughout their life?

And Secretary, you also mentioned that, and I got the quote here, that the current force is insufficiently scaled for the threat environment. And then I see the administration's FY 27 budget request for Cybercom really doesn't reflect that urgency or its sourcing. So what I want to ask is, what is the delta between Cybercom 2.0, you know, the needs to execute and what the president's budget request provides?

So one of the concepts of Cybercom 2.0 is that instead of continuing to just grow the numbers of the force, to work on building the mastery of the force so that the capabilities of the people that we have are deeper and have that longer time on keyboard. And so that's really where we think we're going to get a lot of outsized impacts rather than just continuing to grow the level of the force that we have today.

Thank you. General, thanks for your testimony today. I wanted to just visit real quick if you could in the time I have remaining, talk about timelines because you were talking about new entities like the Cyber Talent Management Organization and Advanced Cyber Training and Education, love all these ideas, and even the Innovation Warfare Center. And you say that they're under construction and slated to be operational in the near term. Can you talk more about the specifics on the timeline?

Congressman, I would tell you just to lead you with, again, going back to the principles against which we need to operate: speed, scale, innovation, integration. Time's of the essence, so we need to move as fast as we can.

Amen.

And what I think I can provide you maybe a follow-up for the record is how we see those timelines being progressed and where we see opportunities to accelerate.

Perfect. Thank you, General. Mr. Chairman, I yield.

One quick follow-up question. Do we ever hire folks who are experts in the cyber field at a private company and bring them in, civilian or military? Just following up on this question.

I believe we have. I can verify that. I'm pretty certain we have. And again, to me, that question speaks to a tremendous opportunity to get after scale and innovation. Again, doesn't have to necessarily be in uniform all the time, there's other options I think where we can look creatively where we can hire experts, we can maybe make them reservists or guardsmen. I think there's tremendous opportunity to be innovative here.

We have a lot of cyber experts in our private industry in Omaha, and I think bringing them in would be helpful to just have that exchange.

Yeah, Chairman, I don't disagree with you at all.

Ms. Houlahan, you are recognized for five minutes, ma'am.

Thank you, Mr. Chair. And General, it's nice to see you, thanks for joining me in my office, and Secretary, it's also nice to be with you today too. Time is of the essence and speed and scale is really important, so I'll try to do my best with my five minutes to ask all these questions. As we know, Cybercom 2.0 is supposed to fix a number of problems, but one of them is around Cybercom structure, which is supposed to now be modeled after Socom, correct?

The Cybercom 2.0 model was actually built on a blend of models within the department. So it included many elements of the Special Operations Force, but also things like the medical community and others.

Excellent, excellent. And so General Rudd, speaking from your prior position, not this position, would you consider special operations a domain, like the land, air, sea, space, and cyberspace area, or is it just unique operations that are shared with air, sea, and land domains?

Congresswoman, the special operations force is applied across all domains.

So it's not its own domain. It is shared across all domains as they are defined: land, air, sea, space.

The specific forces within Socom span land, sea, and air and interoperate with cyber and space forces.

So Secretary Sutton, would you say that the cyber domain and the need for cyber operations will increase or reduce or hold steady over the next few decades?

I think we've seen a very consistent upward trend that I don't anticipate to slow down anytime soon.

Me too. And that's why speed matters and also, frankly, why I believe that this is its own domain that needs to be addressed in its own way with its own force, to be honest. I'll move on and say that I believe that some of the issues that are confronting Cybercom are not just a Cybercom issue, they are coming from how our services, our individual services, are prioritizing cyber forces among their other requirements and responsibilities. So as an example, I would find it hard to believe that the Air Force would legitimately support a cyber wing over a fighter wing, as an example, or the Navy support a cyber group over a ship, or the Army potentially support a cyber unit over an artillery battery, as an example. I know, General Rudd, in your new job that you obviously are very interested in valuing cyber very highly, but it's because you're culturally incentivized to do that. But I believe that the Army is not necessarily incentivized to care about things like that, but rather infantry, artillery, tanks. And if you're a young cyber officer in the Army, I don't believe that you are thinking about your career in that way, but rather you're thinking about your career in Army operations terms that are more traditionally written. Would you assess that that might be true as well, General?

Well, Congresswoman, what I would expect that in this role, I'll have the opportunity to work with all the services to express the importance of talent management of the cyber force and advocate for advancement across all services.

And I know that Mr. Bacon asked you, Secretary Sutton, a lot of good questions about incentivizing people and pay scales and recruiting and a lot of really innovative ideas of how to do that. I would, I guess, argue, my position is that we, just as much as we needed to separate the Air Force out in 1947 and just as much as we needed to separate out the Space Force in 2017, that there may indeed be a need to separate out the cyber force sooner rather than later. Assistant Secretary Sutton and General Rudd, do you think that Congress has made the right decision to establish an Air Force even though the Army and the Navy opposed that?

So I appreciate all the questions about the cyber force. I actually think this is a really important debate that as policymakers we look forward to continuing. This is a very rapidly evolving domain and making sure that we're organized appropriately is something that we really need to address going forward.

I agree. And will conclude by saying this domain is clearly growing, not shrinking, and at some point the cyber forces that we have generated by services that deliberately don't prioritize cyber for practical and cultural reasons won't be enough to meet our future cyber demands. And any significant change to our military structure up until and until we actually have a brand new service, I believe, will be difficult. So all I'm asking you both and us here is that we have an open mind to the idea of a cyber force. While I very much welcome Cyber 2.0 and its recommendations, I genuinely worry that it's just not enough. So all I'm asking is, Secretary and General, will you commit to keeping an open mind on this issue?

So yes. I also appreciate the opportunity that you highlighted to articulate that Cyber Command 2.0 and a cyber force aren't a competing interest. We need to focus on the talent management of our force and then we need to look at the organizational structure. I appreciate Congress's interest in this. My office and the department have been supporting the National Academy's study that I think was formed to do an independent look. I've testified twice in front of that committee and look forward to their report this summer.

Thank you, Secretary. I've run out of time. I also support a cyber academy as well. And General, just yes or no, do you support keeping an open mind on having an independent cyber force?

Congresswoman, again, I align with the department and Honorable Sutton on this topic and again appreciate the fact that they're not in competition. It's not an either-or, it's a both-and.

Thank you. I yield and I appreciate the indulgence of the chair.

Mr. McCormick, you are recognized for five minutes, sir.

Thank you, Mr. Chair. First of all, I kind of like the idea of multiple academies and multiple schools. University of North Georgia is one of those schools that competes across the nation, actually dominates, a little school in Georgia actually dominating the cyber intelligence community. It's been great to see. I think it's also an elite Army school for you Army guys out there. I see you got a Marine here and the cyber is just kind of an amazing leap of technology when we used to eat crayons, well we still eat crayons, but we're doing a little bit of things in computers now. Really excited to see the evolution from a guy who literally learned how to use a computer in the Marine Corps, which is kind of a scary thought at that. But one of the things I've noticed that's maybe a great recruiting tool and I wanted to kind of get your affirmation and maybe expand upon, just like we recruit lawyers, and one of the reasons we're great at recruiting lawyers is because we give them real trial experience. Most people in the cyber community can't go out there and practice this offensively unless they work for the government. So this is a great opportunity not just to develop something but to actually apply it, which is a great selling tool. But what else can we do to not only train people but recruit them and retain them in these cyber commands, which I think is essentially all in the same arena of being competitive in this very world competitive market?

So I appreciate the highlighting you started out with with the talent that we get from a pretty wide variety of universities, many of which are the NSA Cyber Centers of Excellence schools. It's been a great program to be able to get that pipeline in. The challenge that we're really now faced with is how do we recruit them in full-time and how do we retain them? And I think there's the primary thing that we've seen from our force over the last few years is the importance of keeping them on mission and giving them the opportunities to build that talent that, as you very accurately highlight, is something they can only do in our force. And then also making sure that we have the right incentive structure, we have the right career paths so that they can grow and they can succeed in their service, but do it in a way that is meaningful for building that mastery into the skill that we have today.

Fantastic. General Rudd, you know, yesterday we had a great opportunity to speak in person and kind of talk about the futures. We talked about a unified command, which is going to be a central focus, I think, of this committee is kind of do we do this combined, do we do this separate? And I've heard arguments on both. I'm kind of open-minded and I'm forming an opinion every single day trying to be more educated. Specifically to the Marine Corps though, I was going to ask, when we first got computers and we broke a bunch along the way and we learned in-service, now we're out-service and we're learning all these people. How does the Marine Forces Cyber, also known as Marforcyber, currently support the joint force and what role do they play in the future fight as far as the difference between the separation as an independent entity, kind of like we did with the EA-6Bs where we used it as a purple force, or is it used specifically for a Marine Corps mission, which is kind of a tough question, I know, but if you could just tell me the difference between the applications, which will help me make up my mind as to how we form the future.

So this is it right here, Congressman, right? No pressure. Hey, just one point on the recruiting if I could go back to that question. I think there's tremendous opportunity to tell the cyber story maybe in a different way, maybe in a more open way than what we've done previously, that it's going to generate interest around. I don't know that I can recall a time in our history where we've talked more about it openly, perhaps because maybe we're not doing, we've never done as much as we have done in recent history, but that's one point. On the question with regard to support to the joint force, Marforcyber is doing a tremendous job across a number of commands and again in support of the joint force, integrating really seamlessly, whether it's a combatant command or special operations command, they do tremendous work. Again, in real-time, 24/7 commitment. The integration is really dependent upon culture, communication, and co-location in many cases. If they can be side-by-side, doesn't always have to be, obviously there's a tremendous power in the remote aspect of the cyber force, but those are kind of key aspects that I'd highlight to your question.

So specifically, do you think, both of you, I'm just curious, what is the main advantage of having each service have their own cyber command versus a combined?

So I think one of the things that is important to discuss as we think about a cyber service is where the boundary of things in services, like defending their networks and defending the weapons systems and ensuring cybersecurity in the weapons systems they build, how that would separate out from things like a cyber mission force that would conduct operations in support of the joint force and ensuring that those boundaries are well-defined as you would think about different organizational constructs going forward.

All right, with that I'm out of time and I yield. Thank you, Mr. Chairman.

Thank you. Mr. Ryan, you are recognized, sir, for five minutes.

Thank you, Mr. Chair. Thank you both for being here. Assistant Secretary, thanks for the time last week or this week, whenever it was. Thank you. General, thanks twice in one week, sorry about that. I want to build on really good and I think encouraging bipartisan discussion about broadening the base and the foundation of our cyber talent force as a nation, not just whatever we end up, however we end up organizing within and across the services and within DOD, really thinking about this as a national problem. And General Rudd, you talked about this and sort of alluded to it earlier and you talked about it in your written testimony. I think you described it as a joint cyber reserve component or funded reimbursable authority in your submitted statement. General Hartman on his departure talked about a cyber auxiliary. We talked a little bit as well, Assistant Secretary. I think would love to hear both of your thoughts on this. This is something I've been working on the last few years. We've had multiple attempts in the NDAA to introduce this concept. Specifically, how do we get the full breadth of our civilian cyber force engaged at various levels of, you know, if one level is I'm doing a PT test every month and I'm in uniform and the other level is no engagement, how do we broaden that out and create multiple avenues for people to plug in and serve a whole host of missions? So General, starting with you if you wouldn't mind expanding on your testimony and sharing any thoughts there.

Sure, Congressman. No, I think there's tremendous opportunity with this idea, whether it's reserve, auxiliary, or all of the above. I think we don't need to limit the manner in which we approach this because again, the talent is so unique and there's such tremendous opportunity in the commercial sector to leverage expertise and by again, by extension, you're going to force multiply. We can be more creative. We can figure out, I think, you know, we may be some of our own impediments in terms of process, speed at which we can grant clearances, etc. I think we need to be more creative about that. It's definitely something that I am interested in taking a deep look at as part of my initial assessment. I know Honorable Sutton and her team have looked at it in depth, but again, I just don't think we can afford to limit the creative solutions to expanding the cyber workforce and in doing so leverage tremendous talent that's out there.

And maybe just to lead into you, Assistant Secretary, agree more is always better generally, I think particularly every dollar we can spend on cyber, the ROI is dramatically higher than a lot of our other other opportunity costs. But what would you see as a first step or two? And I ask this because I think coming into this NDAA, we want to be aligned with you all as you're rolling out your changes. Is there anything, any first initial steps, either for you, Assistant Secretary, or back to you, General, in terms of, you know, does the idea of some sort of joint reserve component resonate with you? Has your team been able to look at that with any great depth yet?

Thank you again for meeting last week. I really appreciate the discussion and the ability to talk through some of these topics in depth. As we mentioned, I completely concur with everything General Rudd said. I think this is not a place for us to limit ourselves. We have to open up the talent pool that we are that we can recruit from. And I think there is different models to look at. One of the things that my team has been focused on over the last year at the direction of this committee was to look at the civilian reserve model. That study has been completed. I think there's a lot of really good recommendations that we need to start looking at what would the first steps would be to move forward with how we might implement pieces of that and particularly how that can support also not just the Department of War, but the whole of government effort that's going to be a large scale problem where civilians might have a really great tie-in to other areas as well.

And we talked about this a little in my office. As a former local elected official, imagine major debilitating cyber attack of some kind on the nation, the ability at local government level to answer that is just very limited. And I think folks would naturally look towards some ability to extend the very unique high-end capabilities right now out across the nation. So that's part of the thinking here as well to some degree to provide capacity and expertise there. I only have a few seconds left. Anything you want to add, General Rudd, before I yield back?

The only thing I'd add, Congressman, is that I think the same idea applies to National Guard as well. I mean, look at localized state protection in these domains, especially when you talk about critical infrastructure, tremendous opportunity.

Thank you, and I yield back, Mr. Chair.

Thank you. Mr. Vindman, you are recognized for five minutes.

Thank you, Chairman. Thank you to the witnesses. Thank you, Honorable Sutton, for your engagement today and also for your engagement prior to this. I think that's a good model for the relationship we should have in Congress. So are there any key policy, legal, or bureaucratic constraints limiting Cybercom's ability or agility? And, for example, in authorities, data sharing, acquisition? And what specific statutory or policy changes are needed to make a more effective Cybercom 2.0?

So thanks again for the meeting. I also agree that that's a great model to use going forward to make sure that we're in lockstep. I think as we dive into the implementation and as General Rudd mentioned in his statement every month, we have outcomes that we're starting to deliver. We are going to start uncovering some of these statutory and policy hurdles. And that's the role of my office is to identify those. If they're statutory, to bring them to the committee and let them know some of the challenges we're facing. If they're policy internal to the department, figuring out how we can fix those. And then I think as we think about, so that's from a talent perspective, and then as far as a technology perspective, one of the things as we think about AI and moving forward is that the technology is moving very quickly, much faster than we traditionally move as a policy perspective. And so making sure we're thinking about policies in the right way so that we can have all the authorities we need to use these in ways that allow us to have the advantage that we'll need going forward.

And especially as you as it relates to AI and obviously there are some concerns and potential dangers that is important for us to have a dialogue on what the authorities are and what some of the constraints are to make sure we have the balance right. General Rudd, what are the biggest challenges in recruitment, retention, and proper utilization of the reserve and guard cyber talent?

Well, Congressman, I think I owe you a little bit deeper study on that before I can give you a very definitive answer. But what I would expect is a little bit of what we're already discussing is competition for incentives with the, you know, commercial sector. But then also where do we have our own obstacles within our own process? Does it take too long to onboard somebody? Are the requirements, you know, either medical or physical, antiquated and or don't apply? I'm not implying that we reduce standards, but what I am suggesting is maybe we just need to look at how we move quickly through barriers if that is a competition then adds to the competition for talent. Maybe it's something we need to relook. But I think I owe you a little bit deeper look on that before I can give you a better answer, Congressman.

I appreciate that and I look forward to a deeper dive on that and obviously thinking through also what standards ought to apply to the types of folks that we want to be our cyber warriors, I think is important as well. How would a joint cyber reserve component resolve underlying issues? I don't know if you've thought about that yet. Are there any statutory or funding challenges that require this committee's assistance in that regard?

I suspect Honorable Sutton's put a little bit of thought to it. But I can tell you right now, just on the topic of reserves writ large, the funding goes through the services right now. So we're challenged at Cybercom to move quickly to leverage resources to activate reserve in a manner that would sometimes be late to need and or in competition. But I'll defer to Honorable Sutton.

I think General Rudd has really hit the nail on the head here, that this is something we need to look at from a joint perspective and something with Cyber Command service-like authorities, we need to continually evaluate what those look like. I appreciate all the support from the committee on getting many of those authorities into law. As we start implementing those, for example, enhanced budget control, understanding where some of these lines need to settle out now that we have a couple years in the budget as my role as Assistant Secretary and in my service secretary-like role, I think those are exactly the questions we need to ask is what is the structure in the department we would need to fund a joint reserve? Is that part of Cyber Command's service-like authority and how do we get after that pretty quickly because as General Rudd alluded, there's significant talent in our reserves and I think that's a nut we just haven't fully cracked yet.