; and (2) the capabilities deployed by the Department of Homeland Security and the General Services Administration under the Continuous Diagnostics and Mitigation program across the non-Department of Defense departments and agencies of the Federal Government. (c) Risk thresholds The Chief Information Officer of the Department of Defense, in coordination with the Principal Cyber Advisor, the Director of Operations of the Joint Staff, and the Commander of United States Cyber Command, shall establish risk thresholds for systems and network operations that, when exceeded, would trigger heightened security measures, such as enhanced monitoring and access policy changes. (d) Enterprise governance, risk, and compliance plan Not later than 180 days after the date of the enactment of this Act, the Chief Information Officer and the Principal Cyber Advisor shall develop a plan to implement an enterprise governance, risk, and compliance platform and process to maintain current status of all information and operational technology assets, vulnerabilities, threats, and mitigations. 1634. Cyberspace Solarium Commission (a) Establishment (1) In general There is established a commission to develop a consensus on a strategic approach to protecting the crucial advantages of the United States in cyberspace against the attempts of adversaries to erode such advantages. (2) Designation The commission established under paragraph (1) shall be known as the Cyberspace Solarium Commission (in this section the Commission ). (b) Membership (1) Composition (A) Subject to subparagraph (B), the Commission shall be composed of 13 members, as follows: (i) The Principal Deputy Director of National Intelligence. (ii) The Deputy Secretary of Homeland Security. (iii) The Deputy Secretary of Defense. (iv) Three members appointed by the majority leader of the Senate, in consultation with the Chairman of the Committee on Armed Services of the Senate , one of whom shall be a member of the Senate and two of whom shall not be. (v) Two members appointed by