base. (c) Matters for consideration In developing the framework required by subsection (a), the Secretary shall consider the following: (1) Designating an official to be responsible for the cybersecurity of the defense industrial base. (2) Evaluating methods, standards, metrics, and third-party certifications for assessing the cybersecurity of individual contractors. (3) Ensuring a consistent approach across the Department to matters relating to the cybersecurity of the defense industrial base. (4) Tailoring cybersecurity requirements for small- and medium-sized contractors based on a risk-based approach. (5) Ensuring the Department’s traceability and visibility of cybersecurity compliance of suppliers to all levels of the supply chain. (6) Evaluating incentives and penalties for cybersecurity performance of suppliers. (7) Integrating cybersecurity and traditional counterintelligence measures, requirements, and programs. (8) Establishing a secure software development environment (DevSecOps) in a cloud environment inside the perimeter of the Department for contractors to do their development work. (9) Establishing a secure cloud environment where contractors could access the data of the Department needed for their contract work. (10) Establishing a Cybersecurity Maturity Model Certification for defense industrial base companies, scoring companies on a rating scale, and requiring certain ratings for contract awards. (11) Providing additional assistance to small companies in the form of training, mentoring, approved security product lists, and approved lists of security-as-a-service providers. (12) Technological means, operational concepts, reference architectures, offensive counterintelligence operation concepts, and plans for operationalization to complicate adversary espionage, including honeypotting and data obfuscation. (13) Implementing enhanced security vulnerability assessments for contractors working on critical acquisition programs, technologies, manufacturing capabilities, and research areas. (14)