Policy Bill Includes Cyber Investments
Congress agrees on 2020 National Defense Authorization Act
- By Lauren C. Williams
- Mar 01, 2020
Defense committees in Congress have come to an
agreement on the 2020 National Defense Authorization
Act that features a $738 billion topline
budget with $71.5 billion for overseas operations.
In its report released late Dec. 9, Congress
homes in on other transaction authorities (OTAs), drones and
cybersecurity investments. Here’s a breakdown of a few provisions
in the bill the House plans to vote on Dec. 11:
Data on OTAs and prototypes. The House proposed an annual
reporting requirement on how the Defense Department is
using OTAs. The final amendment revises section 873 of the 2019
NDAA to extend such reporting until 2023. Ellen Lord, DOD
acquisition head, told reporters Dec. 10 that OTA use for prototyping
has nearly tripled from $1.7 billion in 2016 to $3.7 billion
in 2018, with 88% of OTAs awarded to companies that haven’t
previously worked with the government, Lord said.
Microelectronics under the scope. One of several supply chainrelated
provisions requires DOD to establish “supply chain and
operational security standards and requirements for microelectronics”
by Jan. 1, 2021. The conferees intend that “by incorporating
and standardizing best practices the Department will
improve its acquisition of securely manufactured, commerciallyavailable
products and ensure that a growing industrial base is
more resilient to a variety of risks in the supply chain,” they wrote
in the legislative explanation.
Additionally, conferees request the undersecretary of defense
acquisition and sustainment brief Congress by Aug. 31, 2020, on
the military’s reliance on foreign sources for microelectronics used
in precision-guided munitions. They also want more information
on cybersecurity risk, including whether contractors are singleor
sole-source providers and which subcontractors supply them.
This was in lieu of a separate provision that wasn’t adopted.
Foreign influence. A provision directs the defense secretary to
modify current policies and regulations to increase scrutiny of
contractors for foreign influence, hacking or access to sensitive
defense assets. “The acquisition community must have greater
visibility into all cleared and uncleared potential contractors and
subcontractors seeking to do business with the Department” to
ensure they “do not pose a risk to the security of sensitive data,
systems, or processes such as personally identifiable information,
cybersecurity, or national security systems,” the conferees wrote.
Drone ban. If the bill passes, DOD will be prohibited from
buying or renewing contracts to acquire foreign-made unmanned
aircraft systems except when used for counter-UAS activities.
The Defense Department is already working to expand
the U.S.-based drone manufacturing to combat foreign dominance
in the drone industry.
IT and cyber investment management. DOD’s chief information
and data officers would be required to “account for, manage,
and report its information technology and cyberspace investments”
and make any legislative suggestions by Feb. 3, 2020.
The conferees call DOD’s current accounting process for its
$50 billion in IT and cyber spending “inefficient,” adding that
it creates “unnecessary delays in preparing the annual budget.”
New software chief? The conference report includes a provision
that would create a “Chief Digital Engineering Recruitment
and Management Officer” who would implement policy and help
“maintain digital expertise and software development as core
competencies of the civilian and military workforce.”
Another provision requires the undersecretary of defense for
research and engineering to “designate a senior official or existing
entity” to guide next-generation software and software-intensive
systems development via a new strategy due to Congress next year.
Cybersecurity for all. The report also contains a provision requiring
DOD’s CIO to ensure an enterprisewide cybersecurity infrastructure
and make mission data accessible to other DOD components.
A separate provision tasks the National Security Agency
as a cyber advisor to the DOD CIO when evaluating the security of
commercial products.
Moreover, the bill calls for a cybersecurity framework, such as
the Cybersecurity Maturity Model Certification, for the defense
industrial base. The provision notes CMMC as a third-party
certification pilot program that could be used “as the basis for a
mandatory Department standard.
CYBERCOM’s acquisition authority. U.S.
Cyber Command’s acquisition authority is
amended to not permit spending more than
$75 million on new contract efforts.
This article originally appeared in the March 2020 issue of Security Today.