Page 68 - Security Today, March 2020

Policy Bill Includes
Cyber Investments
Congress agrees on 2020 National Defense Authorization Act BDy Lauren C. Williams
efense committees in Congress have come to an agreement on the 2020 National Defense Autho- rization Act that features a $738 billion topline budget with $71.5 billion for overseas operations.
In its report released late Dec. 9, Congress homes in on other transaction authorities (OTAs), drones and cybersecurity investments. Here’s a breakdown of a few provi-
sions in the bill the House plans to vote on Dec. 11:
Data on OTAs and prototypes. The House proposed an an- nual reporting requirement on how the Defense Department is using OTAs. The final amendment revises section 873 of the 2019 NDAA to extend such reporting until 2023. Ellen Lord, DOD acquisition head, told reporters Dec. 10 that OTA use for proto- typing has nearly tripled from $1.7 billion in 2016 to $3.7 billion in 2018, with 88% of OTAs awarded to companies that haven’t
previously worked with the government, Lord said. Microelectronics under the scope. One of several supply chain- related provisions requires DOD to establish “supply chain and operational security standards and requirements for microelec- tronics” by Jan. 1, 2021. The conferees intend that “by incor- porating and standardizing best practices the Department will improve its acquisition of securely manufactured, commercially- available products and ensure that a growing industrial base is more resilient to a variety of risks in the supply chain,” they wrote
in the legislative explanation.
Additionally, conferees request the undersecretary of defense
acquisition and sustainment brief Congress by Aug. 31, 2020, on the military’s reliance on foreign sources for microelectronics used in precision-guided munitions. They also want more information on cybersecurity risk, including whether contractors are single- or sole-source providers and which subcontractors supply them. This was in lieu of a separate provision that wasn’t adopted.
Foreign influence. A provision directs the defense secretary to modify current policies and regulations to increase scrutiny of contractors for foreign influence, hacking or access to sensitive defense assets. “The acquisition community must have greater visibility into all cleared and uncleared potential contractors and subcontractors seeking to do business with the Department” to ensure they “do not pose a risk to the security of sensitive data, systems, or processes such as personally identifiable information, cybersecurity, or national security systems,” the conferees wrote.
Drone ban. If the bill passes, DOD will be prohibited from buying or renewing contracts to acquire foreign-made un- manned aircraft systems except when used for counter-UAS ac- tivities.TheDefenseDepartmentisalreadyworkingtoexpand the U.S.-based drone manufacturing to combat foreign domi- nance in the drone industry.
IT and cyber investment management. DOD’s chief informa- tion and data officers would be required to “account for, man- age, and report its information technology and cyberspace invest-
ments” and make any legislative suggestions by Feb. 3, 2020. The conferees call DOD’s current accounting process for its $50 billion in IT and cyber spending “inefficient,” adding that
it creates “unnecessary delays in preparing the annual budget.” New software chief? The conference report includes a provi- sion that would create a “Chief Digital Engineering Recruitment and Management Officer” who would implement policy and help “maintain digital expertise and software development as core
competencies of the civilian and military workforce.”
Another provision requires the undersecretary of defense for research and engineering to “designate a senior official or existing entity” to guide next-generation software and software-intensive systems development via a new strategy due to Congress next year. Cybersecurity for all. The report also contains a provision re- quiring DOD’s CIO to ensure an enterprisewide cybersecurity in- frastructure and make mission data accessible to other DOD com- ponents. A separate provision tasks the National Security Agency as a cyber advisor to the DOD CIO when evaluating the security of
commercial products.
Moreover, the bill calls for a cybersecurity framework, such as
the Cybersecurity Maturity Model Certification, for the defense industrial base. The provision notes CMMC as a third-party certification pilot program that could be used “as the basis for a mandatory Department standard.
CYBERCOM’s acquisition authority. U.S. Cyber Command’s acquisition authority is amended to not permit spending more than $75 million on new contract efforts.
Lauren C. Williams is a staff writer at FCW covering defense and cybersecurity.
66
0320 | SECURITY TODAY
GOVERNMENT CYBERSECURITY
Jeremy Christensen/Shutterstock.com