on information, direction, and cues from other security elements on a network through this framework. (3) A security product integration framework should ideally be non-proprietary or designed as a modular open system. (4) A security integration framework is essential to achieve the speed, scale, and agility of response required for cyber warfare, and to reduce the cost and time needed to integrate new products and services into the existing security environment. (b) Demonstration program The Principal Cyber Adviser, the Chief Information Officer, and the Commander of the United States Cyber Command shall select a network or network segment and associated computer network defense service provider to conduct a demonstration and evaluation of one or more existing security product integration frameworks, including modifying network security systems to enable such systems to ingest, publish, subscribe, tip and cue, and request information or services from each other. 1632. Report on enhancement of software security for critical systems (a) Report required Not later than March 1, 2019, the Principal Cyber Adviser to the Secretary of Defense and the Chief Information Officer of the Department of Defense shall jointly submit to the congressional defense committees a report on a study, based on the authorities specified in subsection (b), on the costs, benefits, technical merits, and other merits of applying the technology described in subsection (c) to the vulnerability assessment and remediation of the following: (1) Nuclear systems and nuclear command and control. (2) A critical subset of conventional power projection capabilities. (3) Cyber command and control. (4) Other defense critical infrastructure (b) Basis for conduct of study The study required for purposes of subsection (a) shall be conducted pursuant to the following: (1) Section 1640 of the National Defense Authorization Act for Fiscal Year 2018 ( Public Law 115–91 ). (2) Section 1650 of the National Defense Authorization Act for Fiscal Year 2017 ( 10