Cybersecurity Policy Report, Senate Adopts Defense Bill That Seeks Progress Toward Deterring Cyber Adversaries, (Oct 10, 2025)
The Department of Defense would have to find ways “to create a credible deterrence” against cyber attacks on U.S. critical infrastructure under a defense policy bill adopted by the Senate yesterday.
The National Defense Authorization Act for Fiscal Year 2026 (S.B. 2296, 119th Cong. (2025)) would require DoD to develop strategies for “credible deterrence against cyberspace attacks and posturing for future such attacks against United States defense critical infrastructure,” according to its text.
A report from the Senate Armed Services Committee that accompanies the bill notes that lawmakers are “concerned that the current strategy to deter attacks against defense critical infrastructure is not adequate as evidenced by the activities of the Volt Typhoon and Salt Typhoon persistent cyber actors.”
Volt Typhoon and Salt Typhoon are names for cyber campaigns attributed to the Chinese government targeting electric and communications infrastructure.
The deterrence strategy, which would be due Dec. 1, 2026, would have to include a “comprehensive assessment of adversary cyber capabilities and intent regarding defense critical infrastructure attacks,” the bill says, and identification “of what specific adversary cyber capabilities and actor’s actions under this strategy seeks to deter.”
The deterrence strategy was included in the bill as passed by the Armed Services Committee in July (CPR, July 16). The Senate passed the bill yesterday by a vote of 77-20.
The House recently passed its version of the NDAA (CPR, Sept. 11). A House-Senate conference committee will reconcile the two bills and produce a final bill that will be voted on by the House and Senate.
The Senate’s NDAA also attempts to reinforce the DoD’s cyber workforce. It would authorize the secretary of Defense “to expand the cyber excepted service to include any position the Secretary considers necessary to carry out the cyber mission of the Department of Defense,” the committee report says.
“Additionally, the provision would authorize the Secretary to provide basic pay to employees in the cyber excepted service that is consistent with comparable positions in the Federal Government, but not to exceed 150 percent of salary paid for positions at Level I of the Executive Schedule, and additional compensation up to a maximum amount that is equivalent to the salary of the Vice President of the United States,” according to the report.
Along with financial incentives for cyber personnel, DoD would have to “develop a comprehensive cyber workforce strategy” to address chronic shortages of skilled cyber personnel, the report says.
“The committee notes with concern that current cyber talent acquisition and retention efforts have not kept pace with the sophistication and scale of adversarial cyber capabilities, creating critical vulnerabilities in national defense infrastructure and operations,” it says.
The report adds that “this comprehensive strategy represents a vital step toward addressing systemic workforce challenges that have hindered the DOD’s ability to effectively counter state and non-state cyber actors who continue to target critical defense systems and sensitive information.”
MainStory: TopStory FederalLegislation DataSecurity