; and (2) establish requirements and processes for employing static and dynamic application security testing that can identify memory-use issues and vulnerabilities and resolve them for software contracted for, developed, or acquired as described in paragraph (1). (c) Briefing required Not later than 300 days after the date of the enactment of this Act, the Secretary shall provide the congressional defense committees a briefing on the policy and guidance developed under subsection (a). 1714. Development of regional cybersecurity strategies (a) Development of strategies required Not later than one year after the date of the enactment of this Act, the Secretary of Defense shall, in coordination with the Commander of United States Cyber Command and each commander of a geographic combatant command, develop, for each geographic combatant command, a regional cybersecurity strategy to support the operations of such command. (b) Elements Each regional cybersecurity strategy developed under subsection (a) for a geographic combatant command shall include the following: (1) A description or an outline of methods to identify both nation-state and non-state cyber threat actors. (2) Processes to enhance the targeting, intelligence, and cyber capabilities of the combatant command. (3) Plans to increase the number of cyber planners embedded in the combatant command. (4) Processes to integrate cyber forces into other warfare domains. (5) A plan to assist, train, advise, and participate in cyber capacity building with international partners. (6) A prioritization of cyber risks and vulnerabilities within the geographic region. (7) Processes to coordinate cyber activities with interagency partners with activities in the geographic region. (8) Specific plans to assist in the defense of foreign infrastructure that is critical to the national security interests of the United States. (9) Means by which the Cybersecurity and Infrastructure Security Agency will be integrated into each strategy. 1715. Cyber incident reporting (a) Cyber