1. Cybersecurity Risk Inventory, Assessment, and Mitigation Working Group Subtitle A of title XXXII of the National Defense Authorization Act for Fiscal Year 2000 ( Public Law 106–65 ) is amended by adding at the end the following new section: 3222. Cybersecurity Risk Inventory, Assessment, and Mitigation Working Group (a) Establishment There is in the Administration a working group, to be known as the Cybersecurity Risk Inventory, Assessment, and Mitigation Working Group . (b) Membership Members of the working group shall include the Deputy Administrator for Defense Programs, the Associate Administrator for Information Management and Chief Information Officer, and staff from other offices as determined appropriate by the Deputy Administrator and Associate Administrator. (c) Comprehensive Strategy The working group shall prepare a comprehensive strategy for inventorying the range of National Nuclear Security Administration systems that are potentially at risk in the operational technology and nuclear weapons information technology environments, assessing the systems at risk, and implementing risk mitigation actions. Such strategy shall incorporate key elements of effective cybersecurity risk management strategies, as identified by the Government Accountability Office, including the specification of— (1) goals, objectives, activities, and performance measures; (2) organizational roles, responsibilities, and coordination; (3) necessary resources needed to implement the strategy over the next ten years