§4571. Information technology acquisition: planning and oversight processes
(a)
(b)
(1) a documented process for information technology acquisition planning, requirements development and management, project management and oversight, earned value management, and risk management;
(2) the development of appropriate metrics that can be implemented and monitored on a real-time basis for performance measurement of-
(A) processes and development status of investments in major automated information system programs;
(B) continuous process improvement of such programs; and
(C) achievement of program and investment outcomes;
(3) a process to ensure that key program personnel have an appropriate level of experience, training, and education in the planning, acquisition, execution, management, and oversight of information technology systems;
(4) a process to ensure sufficient resources and infrastructure capacity for test and evaluation of information technology systems;
(5) a process to ensure that military departments and Defense Agencies adhere to established processes and requirements relating to the planning, acquisition, execution, management, and oversight of information technology programs and developments; and
(6) a process under which an appropriate Department of Defense official may intervene or terminate the funding of an information technology investment if the investment is at risk of not achieving major project milestones.
(Added
Editorial Notes
Amendments
2021-
Statutory Notes and Related Subsidiaries
Effective Date of 2021 Amendment
Amendment by
Policies for Management and Certification of Link 16 Military Tactical Data Link Network
"(a)
"(b)
"(1) A standardized process through a Chairman, Joint Chiefs of Staff Manual, to allow Link 16 frequency use within approved special use airspaces for the purpose of testing radio systems and associated software that have not completed electromagnetic compatibility features certification. Such process-
"(A) shall, at a minimum, ensure routine and continued approval for test operations of developmental systems in the Nevada Test and Training Range, Restricted Area 2508, Warning Area 151/470, Warning Area 386, and the Joint Pacific Alaska Range Complex; and
"(B) may incorporate standardized mitigations that enable routine approval including effective radiated power settings and coordination for rapid test termination.
"(2) Processes to streamline approval or denial of temporary frequency assignment for Link 16 operations to not more than 15 days for test, training, and large-scale exercises. In developing such processes, the Secretary of Defense-
"(A) shall ensure that the processes cover operations in excess of uncoordinated operations time slot duty factor limits, inclusion of foreign participants, and participation of non-stage 4 approved terminals or platforms; and
"(B) consider delegating sole authority for temporary frequency assignment to the Department of Defense and the automation of decision-making processes relating to such assignments.
"(3) Delegation of authority to the system manager for Link 16 to determine when new software within Department of Defense Link 16 terminals affects electromagnetic compatibility features and requires recertification.
"(4) The self-certification by the Department of Defense of the compliance of the Department's radios with electromagnetic compatibility features.
"(5) Processes to internally manage Link 16 uncoordinated operations that enable approval for test, training, and exercises that does not exceed 15 days for systems holding an active radio frequency authorization or temporary frequency assignment.
"(c)
"(1) a briefing on the policies developed under subsection (a), along with a timeline for implementation of such policies; and
"(2) a list of such additional resources or authorities as the Secretary determines may be required to implement such policies.
"(d)
"(1)
"(2)
Requirements for Deployment of Fifth Generation Information and Communications Capabilities to Military Installations and Other Department Facilities
"(a)
"(1)
"(A) based on fifth generation information and communications capabilities and Open Radio Access Network architecture; and
"(B) tailored to the mission, security, and performance requirements of the respective military installation or other facility.
"(2)
"(A)
"(B)
"(3)
"(A) neutral hosting, under which infrastructure and services would be provided to companies deploying private wireless networks and public wireless network services to such installation or other facility through multi-operator core network architectures; or
"(B) separate private wireless network and public wireless network infrastructure at such installation or other facility (which shall include a determination by the Secretary on how to establish roaming agreements and policies between such networks).
"(4)
"(b)
"(1) improve the implementation of the strategy under subsection (a)(1); and
"(2) inform the deployment of private wireless networks to military installations and other facilities of the Department pursuant to such strategy.
"(c)
Target Date for Deployment of 5G Wireless Broadband Infrastructure at All Military Installations
"(a)
"(1) establish a target date by which the Secretary plans to deploy 5G wireless broadband infrastructure at all military installations; and
"(2) establish metrics, which shall be identical for each of the military departments, to measure progress toward reaching the target required by paragraph (1).
"(b)
"(1) the metrics in use pursuant to subsection (a)(2); and
"(2) the progress of the Secretary in reaching the target required by subsection (a)(1).
"(c)
Pilot Programs for Deployment of Telecommunications Infrastructure To Facilitate 5G Deployment on Military Installations
"(a)
"(1)
"(2)
"(A) A list of military installations at which the pilot program will be carried out, including at least one military installation of the department.
"(B) A description of authorities that will be used to execute the pilot program.
"(C) A timeline for the implementation and duration of the pilot program.
"(D) The identity of each telecommunication carrier that intends to use the telecommunications infrastructure deployed pursuant to the pilot to provide fifth-generation wireless telecommunication services at each of the military installations listed under subparagraph (A).
"(E) An assessment of need for centralized processes and points of contacts to facilitate deployment of the telecommunications infrastructure.
"(b)
"(c)
"(1)
"(2)
"(A) A description of the status of the pilot program at each military installation at which the pilot program is carried out.
"(B) A description of the use of, and services provided by, telecommunications carriers of the telecommunications infrastructure at each military installation under the pilot program.
"(C) Such additional information as the Secretary of the military department considers appropriate.
"(d)
"(1) Macro towers.
"(2) Small cell poles.
"(3) Distributed antenna systems.
"(4) Dark fiber.
"(5) Power solutions."
Legacy Information Technologies and Systems Accountability
"(a)
"(b)
"(1) An identification of the applications, software, and information technologies that are considered active or operational, but which are judged to no longer be required by the respective Department.
"(2) Information relating to the sources of funding for the applications, software, and information technologies identified pursuant to paragraph (1).
"(3) An identification of the senior official responsible for each such application, software, or information technology.
"(4) A plan to discontinue use and funding for each such application, software, or information technology.
"(c)
"(d)
Governance of Fifth-Generation Wireless Networking in the Department of Defense
"(a)
"(1)
"(2)
"(A) A timeline for the transition of responsibility for 5G wireless networking to the Chief Information Officer, as required under subsection (b)(1).
"(B) A description of the roles and responsibilities of the organizations and elements of the Department of Defense with respect to the acquisition, sustainment, and operation of 5G wireless networking for the Department, as determined by the Secretary of Defense in accordance with subsection (d).
"(3)
"(4)
"(b)
"(1)
"(A) policy, oversight, guidance, research, and coordination on matters relating to 5G wireless networking; and
"(B) making proposals to the Secretary on governance, management, and organizational policy for 5G wireless networking.
"(2)
"(c)
"(1)
"(2)
"(A) to assist the Secretary of Defense in determining the roles and responsibilities of the organizations and elements of the Department of Defense with respect to the acquisition, sustainment, and operation of 5G wireless networking, as required under subsection (d);
"(B) to assist the senior official responsible for 5G wireless networking in carrying out the responsibilities assigned to such official under subsection (b);
"(C) to oversee the implementation of the strategy developed under section 254 of the National Defense Authorization Act for Fiscal Year 2020 (
"(D) to advance the adoption of commercially available, next-generation wireless communication technologies, capabilities, security, and applications by the Department and the defense industrial base; and
"(E) to support public-private partnerships between the Department and industry on matters relating to 5G wireless networking;
"(F) to coordinate research and development, implementation and acquisition activities, warfighting concept development, spectrum policy, industrial policy and commercial outreach and partnership relating to 5G wireless networking in the Department, and interagency and international engagement;
"(G) to integrate the Department's 5G wireless networking programs and policies with major initiatives, programs, and policies of the Department relating to secure microelectronics and command and control; and
"(H) to oversee, coordinate, execute, and lead initiatives to advance 5G wireless network technologies and associated applications developed for the Department.
"(3)
"(d)
"(e)
"(1) establishing the cross-functional team under subsection (c); and
"(2) determining the roles and responsibilities of the organizations and elements of the Department of Defense with respect to 5G wireless networking as required under subsection (d).
"(f) 5G
"(g)
"(1)
"(2)
"(A) develop a capability to communicate clearly and authoritatively about threats by foreign adversaries;
"(B) conduct independent red-team security analysis of systems, subsystems, devices, and components of the Department of Defense including no-knowledge testing and testing with limited or full knowledge of expected functionalities;
"(C) verify the integrity of personnel who are tasked with design fabrication, integration, configuration, storage, test, and documentation of noncommercial 5G technology to be used by the Department;
"(D) verify the efficacy of the physical security measures used at Department locations where system design, fabrication, integration, configuration, storage, test, and documentation of 5G technology occurs;
"(E) direct the Chief Information Officer to assess, using existing government evaluation models and schema where applicable, 5G core service providers whose services will be used by the Department through the Department's provisional authorization process; and
"(F) direct the Defense Information Systems Agency and the United States Cyber Command to develop a capability for continuous, independent monitoring of non-commercial, government-transiting packet streams for 5G data on frequencies assigned to the Department to validate the availability, confidentiality, and integrity of the Department's communications systems.
"(3)
"(4)
"(A) a comprehensive assessment of the findings and conclusions of the program under paragraph (1);
"(B) recommendations on how to mitigate vulnerabilities in the telecommunications infrastructure of the Department of Defense; and
"(C) an explanation of how the Department plans to implement such recommendations.
"(h)
"(1)
"(2)
Demonstration Project on Use of Certain Technologies for Fifth-Generation Wireless Networking Services
"(a)
"(b)
"(c)
"(d)
"(1) a disaggregated or virtualized radio access network and core in which components can be provided by different vendors and interoperate through open protocols and interfaces, including those protocols and interfaces utilizing the Open Radio Access Network (commonly known as 'Open RAN' or 'oRAN') approach; and
"(2) one or more massive multiple-input, multiple-output radio arrays, provided by one or more companies based in the United States, that have the potential to compete favorably with radios produced by foreign companies in terms of cost, performance, and efficiency."
Pilot Program on the Use of Consumption-Based Solutions To Address Software-Intensive Warfighting Capability
"(a)
"(b)
"(1) rapidly analyze sensor data;
"(2) secure warfighter networks, including multilevel security;
"(3) swiftly transport information across various networks and network modalities;
"(4) enable joint all-domain operational concepts, including in a contested environment; or
"(5) advance military capabilities and effectiveness.
"(c)
"(1) the effectiveness of the solution to be measurable at regular intervals customary for the type of solution provided under contract or other agreement; and
"(2) that the awardee notify the Secretary of Defense when consumption under the contract or other agreement reaches 75 percent and 90 percent of the funded amount, respectively, of the contract or other agreement.
"(d)
"(e)
"(f)
"(g)
"(1)
"(2)
"(3)
"(h)
Balancing Security and Innovation in Software Development and Acquisition
"(a)
"(1) establishment and enforcement of secure coding practices;
"(2) management of supply chain risks and third-party software sources and component risks;
"(3) security of the software development environment;
"(4) secure deployment, configuration, and installation processes; and
"(5) an associated vulnerability management plan and identification of tools that will be applied to achieve an appropriate level of security.
"(b)
"(1) procedures for the security review of code; and
"(2) other procedures necessary to fully implement the pilot program required under section 875 of the National Defense Authorization Act for Fiscal Year 2018 (
"(c)
Establishment of Secure Next-Generation Wireless Network (5G) Infrastructure for the Nevada Test and Training Range and Base Infrastructure
"(a)
"(b)
"(1)
"(A) The Nevada Test and Training Range, which shall serve as a Major Range and Test Facility Base (MRTFB) for fifth-generation wireless networking.
"(B) Such Department installations or other installations as the Secretary considers appropriate for the purpose set forth in paragraph (2).
"(2)
"(A) The potential military utility of high bandwidth, scalable, and low latency fifth-generation wireless networking technology.
"(B) Advanced security technology that is applicable to fifth-generation networks as well as legacy Department command and control networks.
"(C) Secure interoperability with fixed and wireless systems (legacy and future systems).
"(D) Enhancements such as spectrum and waveform diversity, frequency hopping and spreading, and beam forming for military requirements.
"(E) Technology for dynamic network slicing for specific use cases and applications requiring varying levels of latency, scale, and throughput.
"(F) Technology for dynamic spectrum sharing and network isolation.
"(G) Base infrastructure installation of high bandwidth, scalable, and low latency fifth-generation wireless networking technology.
"(H) Applications for secure fifth-generation wireless network capabilities for the Department, such as the following:
"(i) Interactive augmented reality or synthetic training environments.
"(ii) Internet of things devices.
"(iii) Autonomous systems.
"(iv) Advanced manufacturing through the following:
"(I) Department-sponsored centers for manufacturing innovation (as defined in section 34(c) of the National Institute of Standards and Technology Act (15 U.S.C. 278s(c))).
"(II) Department research and development organizations.
"(III) Manufacturers in the defense industrial base of the United States."
Digital Engineering Capability To Automate Testing and Evaluation
"(a)
"(1)
"(A) for the development and deployment of digital engineering models for use in the defense acquisition process; and
"(B) to provide testing infrastructure and software to support automated approaches for testing, evaluation, and deployment throughout the defense acquisition process.
"(2)
"(A) The capability will be accessible to, and useable by, individuals throughout the Department of Defense who have responsibilities relating to capability design, development, testing, evaluation, and operation.
"(B) The capability will provide for the development, validation, use, curation, and maintenance of technically accurate digital systems, models of systems, subsystems, and their components, at the appropriate level of fidelity to ensure that test activities adequately simulate the environment in which a system will be deployed.
"(C) The capability will include software to automate testing throughout the program life cycle, including to satisfy developmental test requirements and operational test requirements. Such software may be developed in accordance with the authorities provided under section 800 [of
"(i) security testing that includes vulnerability scanning and penetration testing performed by individuals, including threat-based red team exploitations and assessments with zero-trust assumptions; and
"(ii) high-confidence distribution of software to the field on a time-bound, repeatable, frequent, and iterative basis.
"(b)
"(1)
"(A) enable continuous software development and delivery;
"(B) satisfy developmental test requirements for the software-intensive programs of the Department of Defense; and
"(C) satisfy operational test and evaluation requirements for such programs.
"(2)
"(A) at least one program participating in the pilot program authorized under section 873 of the National Defense Authorization Act for Fiscal Year 2018 (
"(B) at least one program participating in the pilot program authorized under section 874 of such Act (
"(C) at least one major defense acquisition program (as defined in section 2430 of title 10, United States Code [now 10 U.S.C. 4201]);
"(D) at least one command and control program;
"(E) at least one defense business system (as defined in section 2222(i) of title 10, United States Code); and
"(F) at least one program from each military service.
"(3)
"(A) conduct a comparative analysis that assesses the risks and benefits of the digital engineering supported automated testing approaches of the programs participating in the demonstration activities relative to traditional testing approaches that are not supported by digital engineering;
"(B) ensure that the intellectual property strategy for each of the programs participating in the demonstration activities is best aligned to meet the goals of the program; and
"(C) develop a workforce and infrastructure plan to support any new policies and guidance implemented in connection with the demonstration activities, including any policies and guidance implemented after the completion of such activities.
"(c)
"(1) promote the use of digital engineering capabilities for development and for automated testing; and
"(2) address roles, responsibilities, and procedures relating to such capabilities.
"(d)
"(1)
"(2)
"(A) The Under Secretary of Defense for Research and Engineering.
"(B) The Under Secretary of Defense for Acquisition and Sustainment.
"(C) The Chief Information Officer.
"(D) The Director of Operational Test and Evaluation.
"(E) The Director of Cost Assessment and Program Evaluation.
"(F) The Service Acquisition Executives.
"(G) The Service testing commands.
"(H) The Director of the Defense Digital Service.
"(e)
"(1)
"(2)
"(f)
"(1)
"(2)
"(A) a report summarizing the assessment; and
"(B) a briefing on the findings of the assessment."
Strategy and Implementation Plan for Fifth Generation Information and Communications Technologies
"(a)
"(1) a strategy for harnessing fifth generation (commonly known as '5G') information and communications technologies to enhance military capabilities, maintain a technological advantage on the battlefield, and accelerate the deployment of new commercial products and services enabled by 5G networks throughout the Department of Defense; and
"(2) a plan for implementing the strategy developed under paragraph (1).
"(b)
"(1) Adoption and use of secure fourth generation (commonly known as '4G') communications technologies and the transition to advanced and secure 5G communications technologies for military applications and for military infrastructure.
"(2) Science, technology, research, and development efforts to facilitate the advancement and adoption of 5G technology and new uses of 5G systems, subsystems, and components, including-
"(A) 5G testbeds for developing military and dual-use applications; and
"(B) spectrum-sharing technologies and frameworks.
"(3) Strengthening engagement and outreach with industry, academia, international partners, and other departments and agencies of the Federal Government on issues relating to 5G technology and the deployment of such technology, including development of a common industrial base for secure microelectronics.
"(4) Defense industrial base supply chain risk, management, and opportunities.
"(5) Preserving the ability of the Joint Force to achieve objectives in a contested and congested spectrum environment.
"(6) Strengthening the ability of the Joint Force to conduct full spectrum operations that enhance the military advantages of the United States.
"(7) Securing the information technology and weapon systems of the Department against malicious activity.
"(8) Advancing the deployment of secure 5G networks nationwide.
"(9) Such other matters as the Secretary of Defense determines to be relevant.
"(c)
"(1) The Chief Information Officer of the Department of Defense.
"(2) The Under Secretary of Defense for Research and Engineering.
"(3) The Under Secretary of Defense for Acquisition and Sustainment.
"(4) The Under Secretary of Defense for Intelligence [now Under Secretary of Defense for Intelligence and Security].
"(5) Service Acquisition Executives of each military service.
"(d)
"(1)
"(A) is using secure 5G wireless network technology;
"(B) is reshaping the Department's policy for producing and procuring secure microelectronics; and
"(C) is working in the interagency and internationally to develop common policies and approaches.
"(2)
"(A) efforts to ensure a secure supply chain for 5G wireless network equipment and microelectronics;
"(B) the continued availability of electromagnetic spectrum for warfighting needs;
"(C) planned implementation of 5G wireless network infrastructure in warfighting networks, base infrastructure, defense-related manufacturing, and logistics;
"(D) steps taken to work with allied and partner countries to protect critical networks and supply chains; and
"(E) such other topics as the Secretary of Defense considers relevant."
Department-Wide Software Science and Technology Strategy
"(a)
"(1) research and development activities on new technologies for the creation of highly secure, scalable, reliable, time-sensitive, and mission-critical software;
"(2) research and development activities on new approaches and tools to software development and deployment, testing, integration, and next generation software management tools to support the rapid insertion of such software into defense systems;
"(3) foundational scientific research activities to support advances in software;
"(4) technical workforce and infrastructure to support defense science and technology and software needs and mission requirements;
"(5) providing capabilities, including technologies, systems, and technical expertise to support improved acquisition of software reliant business and warfighting systems; and
"(6) providing capabilities, including technologies, systems, and technical expertise to support defense operational missions which are reliant on software.
"(b)
"(1) types of software-related activities within the science and technology portfolio of the Department;
"(2) investment in new approaches to software development and deployment, and next generation management tools;
"(3) ongoing research and other support of academic, commercial, and development community efforts to innovate the software development, engineering, and testing process, automated testing, assurance and certification for safety and mission critical systems, large scale deployment, and sustainment;
"(4) to the extent practicable, implementing or continuing the implementation of the recommendations set forth in-
"(A) the final report of the Defense Innovation Board submitted to the congressional defense committees [Committees on Armed Services and Appropriations of the Senate and the House of Representatives] under section 872 of the National Defense Authorization Act for Fiscal Year 2018 (
"(B) the final report of the Defense Science Board Task Force on the Design and Acquisition of Software for Defense Systems described in section 868 of the John S. McCain National Defense Authorization Act for Fiscal Year 2019 (
"(C) other relevant studies on software research, development, and acquisition activities of the Department of Defense.
"(5) supporting the acquisition, technology development, testing, assurance, and certification and operational needs of the Department through the development of capabilities, including personnel and research and production infrastructure, and programs in-
"(A) the science and technology reinvention laboratories (as designated under section 4121(b) of title 10, United States Code);
"(B) the facilities of the Major Range and Test Facility Base (as defined in section 2358a(g) of title 10, United States Code [now 10 U.S.C. 4091(f)]);
"(C) the Defense Advanced Research Projects Agency; and
"(D) universities, federally funded research and development centers, and service organizations with activities in software engineering; and
"(6) the transition of relevant capabilities and technologies to relevant programs of the Department, including software-reliant cyber-physical systems, tactical systems, enterprise systems, and business systems.
"(c)
Authority for Continuous Integration and Delivery of Software Applications and Upgrades to Embedded Systems
"(a)
"(1)
"(2)
"(A) initiate the engineering of new software capabilities quickly;
"(B) demonstrate the viability and effectiveness of such capabilities for operational use not later than one year after the date on which funds are first obligated to acquire or develop software; and
"(C) allow for the continuous updating and delivery of new capabilities not less frequently than annually to iteratively meet a requirement.
"(3)
"(4)
"(b)
"(1)
"(2)
"(c)
"(1)
"(A) a streamlined and coordinated requirements, budget, and acquisition process to support rapid fielding of software applications and of software upgrades to embedded systems for operational use in a period of not more than one year from the time that the process is initiated;
"(B) the collection of data on software fielded; and
"(C) continuous engagement with the users of software to support engineering activities, and to support delivery of software for operational use in periods of not more than one year.
"(2)
"(A)
"(B)
"(d)
"(1) iterative development of requirements for software to be acquired or developed under the authority of this section through engagement with the user community and through the use of operational user feedback, in order to continuously define and update priorities for such requirements;
"(2) early identification of the warfighter or user need, including the rationale for how software capabilities will support increased lethality and efficiency, and identification of a relevant user community;
"(3) initial contract requirements and format, including the use of summary-level lists of problems and shortcomings in existing software and desired features or capabilities of new or upgraded software;
"(4) continuous refinement and prioritization of contract requirements through use of evolutionary processes, informed by continuous engagement with operational users throughout the development and implementation period;
"(5) continuous consideration of issues related to lifecycle costs, technical data rights, and systems interoperability;
"(6) planning for support of software capabilities in cases where the software developer may stop supporting the software;
"(7) rapid contracting procedures, including expedited timeframes for making awards, selecting contract types, defining teaming arrangements, and defining options;
"(8) program execution processes, including supporting development and test infrastructure, automation and tools, digital engineering, data collection and sharing with Department of Defense oversight organizations and with Congress, the role of developmental and operational testing activities, key decision making and oversight events, and supporting processes and activities (such as independent costing activity, operational demonstration, and performance metrics);
"(9) assurances that cybersecurity metrics of the software to be acquired or developed, such as metrics relating to the density of vulnerabilities within the code of such software, the time from vulnerability identification to patch availability, the existence of common weaknesses within such code, and other cybersecurity metrics based on widely-recognized standards and industry best practices, are generated and made available to the Department of Defense and the congressional defense committees [Committees on Armed Services and Appropriations of the Senate and the House of Representatives];
"(10) administrative procedures, including procedures related to who may initiate and approve an acquisition under this authority, the roles and responsibilities of the implementing project or product teams and supporting activities, team selection and staffing process, governance and oversight roles and responsibilities, and appropriate independent technology assessments, testing, and cost estimation (including relevant thresholds or designation criteria);
"(11) mechanisms and waivers designed to ensure flexibility in the implementation of a pathway under this section, including the use of other transaction authority, broad agency announcements, and other procedures; and
"(12) mechanisms the Secretary will use for appropriate reporting to Congress on the use of this authority, including notice of initiation of the use of a pathway and data regarding individual programs or acquisition activities, how acquisition activities are reflected in budget justification materials or requests to reprogram appropriated funds, and compliance with other reporting requirements.
"(e)
"(1)
"(2)
"(A) to establish a new pathway to acquire or develop software; or
"(B) to continue activities to acquire or develop software using a pathway established under initial guidance described in paragraph (1).
"(f)
"(1)
"(2)
"(A) The final guidance required by subsection (d)(2), including a description of the treatment of use of the authority that was initiated before such final guidance was issued.
"(B) A summary of how the authority under this section has been used, including a list of the cost estimate, schedule for development, testing and delivery, and key management risks for each initiative conducted pursuant to such authority.
"(C) Accomplishments from and challenges to using the authority under this section, including organizational, cultural, talent, infrastructure, testing, and training considerations.
"(D) Recommendations for legislative changes to the authority under this section.
"(E) Recommendations for regulatory changes to the authority under this section to promote effective development and deployment of software acquired or developed under this section."
Reorientation of Big Data Platform Program
"(a)
"(1)
"(A) reorient the Big Data Platform program as specified in this section; and
"(B) align the reorientation effort under an existing line of effort of the Cyber Strategy of the Department of Defense.
"(2)
"(b)
"(1)
"(2)
"(A) take such actions as the Secretary considers necessary to standardize deployed infrastructure, including the Department of Defense's perimeter capabilities at the Internet Access Points, the Joint Regional Security Stacks, or other approved solutions, and the routing of data laterally and vertically from Department of Defense Information Network segments and tiers, to enable standard and comprehensive metadata collection;
"(B) take such actions as the Secretary considers necessary to standardize deployed cybersecurity applications, products, and sensors and the routing of data laterally and vertically from Department of Defense Information Network segments and tiers, to enable standard and comprehensive metadata collection;
"(C) develop an enterprise-wide architecture and strategy for-
"(i) where to place sensors or extract data from network information technology, operational technology, and cybersecurity appliances, applications, products, and systems for cybersecurity purposes;
"(ii) which metadata data records should be universally sent to Big Data Platform instances and which metadata data records, if any, should be locally retained; and
"(iii) expeditiously and efficiently transmitting metadata records to the Big Data Platform instances, including the acquisition and installation of further data bandwidth;
"(D) determine the appropriate number, organization, and functions of separate Big Data Platform instances, and whether the Big Data Platform instances that are currently managed by Department of Defense components, including the military services, should instead be jointly and regionally organized, or terminated;
"(E) determine the appropriate roles of the Defense Information Systems Agency's Acropolis, United States Cyber Command's Scarif, and any similar Big Data Platforms as enterprise-wide real-time cybersecurity situational awareness capabilities or as complements or replacements for component level Big Data Platform instances;
"(F) ensure that all Big Data Platform instances are engineered and approved to enable standard access and expeditious query capabilities by the Unified Platform, the network defense service providers, and the Cyber Mission Forces, with centrally managed authentication and authorization services;
"(G) prohibit and remove barriers to information sharing, distributed query, data analysis, and collaboration across Big Data Platform instances, such as incompatible interfaces, interconnection service agreements, and the imposition of accreditation boundaries;
"(H) transition all Big Data Platform instances to a cloud computing environment in alignment with the cloud strategy of the Chief Information Officer of the Department of Defense;
"(I) consider whether packet capture databases should continue to be maintained separately from the Big Data Platform instances, managed at the secret level of classification, and treated as malware-infected when the packet data are copies of packets extant in the Department of Defense Information Network;
"(J) in the case that the Secretary decides to sustain the status quo on packet capture databases, ensure that analysts operating on or from the Unified Platform, the Big Data Platform instances, the network defense services providers, and the Cyber Mission Forces can directly access packets and query the database; and
"(K) consider whether the Joint Artificial Intelligence Center's cybersecurity artificial intelligence national mission initiative, and any other similar initiatives, should include an application for the metadata residing in the Big Data Platform instances.
"(c)
"(d)
"(1) seek advanced analytics and applications from Government and commercial sources that can be executed on the deployed Big Data Platform architecture; and
"(2) collaborate with vendors offering commercial analytics and applications, including support to refactoring commercial capabilities to the Government platform where industry can still own the intellectual property embedded in the analytics and applications.
"(e)
"(f)
[Reference to Joint Artificial Intelligence Center, referred to in subsec. (b)(2)(K) of section 1651 of
Policy Regarding the Transition of Data and Applications to the Cloud
"(a)
"(b)
"(1) making the data of the Department available to support new types of analyses;
"(2) preventing, to the maximum extent practicable, the replication in the cloud of data stores that cannot readily be accessed by applications for which the data stores were not originally engineered;
"(3) ensuring that data sets can be readily discovered and combined with others to enable new insights and capabilities; and
"(4) ensuring that data and applications are readily portable and not tightly coupled to a specific cloud infrastructure or platform."
Implementation of Recommendations of the Final Report of the Defense Science Board Task Force on the Design and Acquisition of Software for Defense Systems
"(a)
"(b)
"(1)
"(2)
"(A) the reasons for the decision not to implement the recommendation; and
"(B) a summary of the alternative actions the Secretary plans to take to address the purposes underlying the recommendation.
"(c)
"(1) a summary of actions that have been taken to implement the recommendation; and
"(2) a schedule, with specific milestones, for completing the implementation of the recommendation."
Activities and Reporting Relating to Department of Defense's Cloud Initiative
"(a)
"(1) Develop an approach to rapidly acquire advanced commercial network capabilities, including software-defined networking, on-demand bandwidth, and aggregated cloud access gateways, through commercial service providers in order-
"(A) to support the migration of applications and systems to commercial cloud platforms;
"(B) to increase visibility of end-to-end performance to enable and enforce service level agreements for cloud services;
"(C) to ensure efficient and common cloud access;
"(D) to facilitate shifting data and applications from one cloud platform to another;
"(E) to improve cybersecurity; and
"(F) to consolidate networks and achieve efficiencies and improved performance;
"(2) Conduct an analysis of existing workloads that would be migrated to the Joint Enterprise Defense Infrastructure, including-
"(A) identifying all of the cloud initiatives across the Department of Defense, and determining the objectives of such initiatives in connection with the intended scope of the Infrastructure;
"(B) identifying all the systems and applications that the Department would intend to migrate to the Infrastructure;
"(C) conducting rationalization of applications to identify applications and systems that may duplicate the processing of workloads in connection with the Infrastructure; and
"(D) as result of such actions, arriving at dispositions about migration or termination of systems and applications in connection with the Infrastructure.
"(b)
"(1) A description [of] the status of completion of the activities required under subsection (a).
"(2) Information relating to the current composition of the Cloud Executive Steering Group and the stakeholders relating to the Department of Defense's Cloud Initiative and associated mission, objectives, goals, and strategy.
"(3) A description of the characteristics and considerations for accelerating the cloud architecture and services required for a global, resilient, and secure information environment.
"(4) Information relating to acquisition strategies and timeline for efforts associated with the Department of Defense's Cloud Initiative, including the Joint Enterprise Defense Infrastructure.
"(5) A description of how the acquisition strategies referred to in paragraph (4) provides [sic] for a full and open competition, enable the Department of Defense to continuously leverage and acquire new cloud computing capabilities, maintain the ability of the Department to leverage other cloud computing vendor products and services, incorporate elements to maintain security, and provide for the best performance, cost, and schedule to meet the cloud architecture and services requirements of the Department for the duration of such contract.
"(6) A detailed description of existing workloads that will be migrated to enterprise-wide cloud infrastructure or platforms as a result of the Department of Defense's Cloud Initiative, including estimated migration costs and timelines, based on the analysis required under subsection (a)(2).
"(7) A description of the program management and program office of the Department of Defense's Cloud Initiative, including the number of personnel, overhead costs, and organizational structure.
"(8) A description of the effect of the Joint Enterprise Defense Infrastructure on and the relationship of such Infrastructure to existing cloud computing infrastructure, platform, and service contracts across the Department of Defense, specifically the effect and relationship to the private cloud infrastructure of the Department, MilCloud 2.0 run by the Defense Information Systems Agency based on the analysis required under subsection (a)(2).
"(9) Information relating to the most recent Department of Defense Cloud Computing Strategy and description of any initiatives to update such Strategy.
"(10) Information relating to Department of Defense guidance pertaining to cloud computing capability or platform acquisition and standards, and a description of any initiatives to update such guidance.
"(11) Any other matters the Secretary of Defense determines relevant.
"(c)
"(d)
"(1)
"(2)
"(e)
Pilot Program To Use Agile or Iterative Development Methods To Tailor Major Software-Intensive Warfighting Systems and Defense Business Systems
Global Theater Security Cooperation Management Information System
"(a)
"(1)
"(A) update relevant security cooperation guidance issued by the Secretary for use of the Global Theater Security Cooperation Management Information System (in this section referred to as 'G-TSCMIS'), including guidance relating to the matters described in paragraph (3); and
"(B) submit to the congressional defense committees [Committees on Armed Services and Appropriations of the Senate and the House of Representatives] a report that contains such guidance.
"(2)
"(A) update relevant security cooperation guidance issued by the Secretary for use of such system, including guidance relating to the matters described in paragraph (3); and
"(B) submit to the congressional defense committees a report that contains such guidance.
"(3)
"(A) Designation of an authoritative data repository for security cooperation information, with enforceable data standards and data controls.
"(B) Responsibilities for entry of data relating to programs and activities into the system.
"(C) Oversight and accountability measures to ensure the full scope of activities are entered into the system consistently and in a timely manner.
"(D) Such other matters as the Secretary considers appropriate.
"(b)
"(1)
"(2)
"(A) An evaluation of the impacts of inconsistent information on the system's functionality as a tool for planning, resource allocation, and adjustment.
"(B) An evaluation of the effectiveness of oversight and accountability measures.
"(C) An evaluation of feedback from the operational community to inform future requirements.
"(D) Such other matters as the Secretary considers appropriate.
"(3)
Operational Metrics for Joint Information Environment and Supporting Activities
"(a)
"(b)
"(c)
Data Servers and Centers
"(a)
"(1)
"(A)
"(B)
"(2)
"(A)
"(B)
"(i) existing resources of the Department do not meet the operation requirements to be met through the obligation of funds; and
"(ii) the proposed obligation is in accordance with the performance standards and measures established by the Chief Information Officer of the Department under subsection (b).
"(3)
"(b)
"(1)
"(A)
"(i) A reduction in the square feet of floor space devoted to information systems technologies, attendant support technologies, and operations within data centers.
"(ii) A reduction in the use of all utilities necessary to power and cool information systems technologies and data centers.
"(iii) An increase in multi-organizational utilization of data centers, information systems technologies, and associated resources.
"(iv) A reduction in the investment for capital infrastructure or equipment required to support data centers as measured in cost per megawatt of data storage.
"(v) A reduction in the number of commercial and government developed applications running on data servers and within data centers.
"(vi) A reduction in the number of government and vendor provided full-time equivalent personnel, and in the cost of labor, associated with the operation of data servers and data centers.
"(B)
"(2)
"(A)
"(B)
"(i) A Department-wide performance plan for achieving the matters specified in paragraph (1)(A), including performance standards and measures for data centers and information systems technologies, goals and schedules for achieving such matters, and an estimate of cost savings anticipated through implementation of the plan.
"(ii) A Department-wide strategy for each of the following:
"(I) Desktop, laptop, and mobile device virtualization.
"(II) Transitioning to cloud computing.
"(III) Migration of Defense data and government-provided services from Department-owned and operated data centers to cloud computing services generally available within the private sector that provide a better capability at a lower cost with the same or greater degree of security.
"(IV) Utilization of private sector-managed security services for data centers and cloud computing services.
"(V) A finite set of metrics to accurately and transparently report on data center infrastructure (space, power and cooling): age, cost, capacity, usage, energy efficiency and utilization, accompanied with the aggregate data for each data center site in use by the Department in excess of 100 kilowatts of information technology power demand.
"(VI) Transitioning to just-in-time delivery of Department-owned data center infrastructure (space, power and cooling) through use of modular data center technology and integrated data center infrastructure management software.
"(3)
"(c)
"(1)
"(2)
Demonstration and Pilot Projects on Cybersecurity
"(a)
"(1)
"(2)
"(b)
"(1) Threat sensing and warning for information networks worldwide.
"(2) Managed security services for cybersecurity within the defense industrial base, military departments, and combatant commands.
"(3) Use of private processes and infrastructure to address threats, problems, vulnerabilities, or opportunities in cybersecurity.
"(4) Processes for securing the global supply chain.
"(5) Processes for threat sensing and security of cloud computing infrastructure.
"(c)
"(1)
"(2)
"(A) A description and assessment of any activities under the demonstration projects and pilot projects referred to in paragraph (1) during the preceding year.
"(B) For the pilot projects supported or conducted under subsection (b)(2)-
"(i) a quantitative and qualitative assessment of the extent to which managed security services covered by the pilot project could provide effective and affordable cybersecurity capabilities for components of the Department of Defense and for entities in the defense industrial base, and an assessment whether such services could be expanded rapidly to a large scale without exceeding the ability of the Federal Government to manage such expansion; and
"(ii) an assessment of whether managed security services are compatible with the cybersecurity strategy of the Department of Defense with respect to conducting an active, in-depth defense under the direction of United States Cyber Command.
"(C) For the pilot projects supported or conducted under subsection (b)(3)-
"(i) a description of any performance metrics established for purposes of the pilot project, and a description of any processes developed for purposes of accountability and governance under any partnership under the pilot project; and
"(ii) an assessment of the role a partnership such as a partnership under the pilot project would play in the acquisition of cyberspace capabilities by the Department of Defense, including a role with respect to the development and approval of requirements, approval and oversight of acquiring capabilities, test and evaluation of new capabilities, and budgeting for new capabilities.
"(D) For the pilot projects supported or conducted under subsection (b)(4)-
"(i) a framework and taxonomy for evaluating practices that secure the global supply chain, as well as practices for securely operating in an uncertain or compromised supply chain;
"(ii) an assessment of the viability of applying commercial practices for securing the global supply chain; and
"(iii) an assessment of the viability of applying commercial practices for securely operating in an uncertain or compromised supply chain.
"(E) For the pilot projects supported or conducted under subsection (b)(5)-
"(i) an assessment of the capabilities of Federal Government providers to offer secure cloud computing environments; and
"(ii) an assessment of the capabilities of commercial providers to offer secure cloud computing environments to the Federal Government.
"(3)
Implementation of New Acquisition Process for Information Technology Systems
Clearinghouse for Rapid Identification and Dissemination of Commercial Information Technologies
"(a)
"(b)
"(1) Developing a process to rapidly assess and set priorities and needs for significant information technology needs of the Department of Defense that could be met by commercial technologies, including a process for-
"(A) aligning priorities and needs with the requirements of the commanders of the combatant command; and
"(B) proposing recommendations to the commanders of the combatant command of feasible technical solutions for further evaluation.
"(2) Identifying and assessing emerging commercial technologies (including commercial off-the-shelf technologies) that could support the warfighting mission of the Department of Defense, including the priorities and needs identified pursuant to paragraph (1).
"(3) Disseminating information about commercial technologies identified pursuant to paragraph (2) to commanders of combatant commands and other potential users of such technologies.
"(4) Identifying gaps in commercial technologies and working to stimulate investment in research and development in the public and private sectors to address those gaps.
"(5) Enhancing internal data and communications systems of the Department of Defense for sharing and retaining information regarding commercial technology priorities and needs, technologies available to meet such priorities and needs, and ongoing research and development directed toward gaps in such technologies.
"(6) Developing mechanisms, including web-based mechanisms, to facilitate communications with industry regarding the priorities and needs of the Department of Defense identified pursuant to paragraph (1) and commercial technologies available to address such priorities and needs.
"(7) Assisting in the development of guides to help small information technology companies with promising technologies to understand and navigate the funding and acquisition processes of the Department of Defense.
"(8) Developing methods to measure how well processes developed by the clearinghouse are being utilized and to collect data on an ongoing basis to assess the benefits of commercial technologies that are procured on the recommendation of the clearinghouse.
"(c)
"(d)
Improvement of Software Acquisition Processes
"(a)
"(2) The head of each Defense Agency that manages a major defense acquisition program with a substantial software component shall establish a program to improve the software acquisition processes of that Defense Agency.
"(3) The programs required by this subsection shall be established not later than 120 days after the date of the enactment of this Act [Dec. 2, 2002].
"(b)
"(1) A documented process for software acquisition planning, requirements development and management, project management and oversight, and risk management.
"(2) Efforts to develop appropriate metrics for performance measurement and continual process improvement.
"(3) A process to ensure that key program personnel have an appropriate level of experience or training in software acquisition.
"(4) A process to ensure that each military department and Defense Agency implements and adheres to established processes and requirements relating to the acquisition of software.
"(c)
"(1) prescribe uniformly applicable guidance for the administration of all of the programs established under subsection (a) and take such actions as are necessary to ensure that the military departments and Defense Agencies comply with the guidance; and
"(2) assist the Secretaries of the military departments and the heads of the Defense Agencies to carry out such programs effectively by-
"(A) ensuring that the criteria applicable to the selection of sources provides added emphasis on past performance of potential sources, as well as on the maturity of the software products offered by the potential sources; and
"(B) identifying, and serving as a clearinghouse for information regarding, best practices in software development and acquisition in both the public and private sectors.
"(d)
"(1) The term 'Defense Agency' has the meaning given the term in section 101(a)(11) of title 10, United States Code.
"(2) The term 'major defense acquisition program' has the meaning given such term in section 139(a)(2)(B) of title 10, United States Code."