10 U.S.C. § 4571 — Information technology acquisition: plan-

Page 2788 TITLE 10—ARMED FORCES § 4571 order to achieve interoperability, information sharing, and other efficiencies. ‘‘(c) LIMITATION.—The requirements of subparagraphs (B), (C), and (D) of subsection (a)(1) shall not apply to a contract for the acquisition of cloud computing capa- bilities in an amount less than $1,000,000. ‘‘(d) RULE OF CONSTRUCTION.—Nothing in this section shall be construed to alter or affect the authorities or responsibilities of the Director of National Intelligence under section 102A of the National Security Act of 1947 (50 U.S.C. 3024).’’ § 4571. Information technology acquisition: plan- ning and oversight processes (a) ESTABLISHMENT OF PROGRAM.—The Sec- retary of Defense shall establish a program to improve the planning and oversight processes for the acquisition of major automated informa- tion systems by the Department of Defense. (b) PROGRAM COMPONENTS.—The program es- tablished under subsection (a) shall include— (1) a documented process for information technology acquisition planning, requirements development and management, project man- agement and oversight, earned value manage- ment, and risk management; (2) the development of appropriate metrics that can be implemented and monitored on a real-time basis for performance measurement of— (A) processes and development status of investments in major automated informa- tion system programs; (B) continuous process improvement of such programs; and (C) achievement of program and invest- ment outcomes; (3) a process to ensure that key program per- sonnel have an appropriate level of experience, training, and education in the planning, acqui- sition, execution, management, and oversight of information technology systems; (4) a process to ensure sufficient resources and infrastructure capacity for test and eval- uation of information technology systems; (5) a process to ensure that military depart- ments and Defense Agencies adhere to estab- lished processes and requirements relating to the planning, acquisition, execution, manage- ment, and oversight of information technology programs and developments; and (6) a process under which an appropriate De- partment of Defense official may intervene or terminate the funding of an information tech- nology investment if the investment is at risk of not achieving major project milestones. (Added Pub. L. 111–383, div. A, title VIII, § 805(a)(1), Jan. 7, 2011, 124 Stat. 4259, § 2223a; re- numbered § 4571 and amended Pub. L. 116–283, div. A, title XVIII, § 1857(b), Jan. 1, 2021, 134 Stat. 4276.) Editorial Notes AMENDMENTS 2021—Pub. L. 116–283, § 1857(b)(2), amended section catchline generally. Prior to amendment, section catchline read as follows: ‘‘Information technology ac- quisition planning and oversight requirements’’. Pub. L. 116–283, § 1857(b)(1), renumbered section 2223a of this title as this section. Statutory Notes and Related Subsidiaries EFFECTIVE DATE OF 2021 AMENDMENT Amendment by Pub. L. 116–283 effective Jan. 1, 2022, with additional provisions for delayed implementation and applicability of existing law, see section 1801(d) of Pub. L. 116–283, set out as a note preceding section 3001 of this title. ELECTROMAGNETIC SPECTRUM DEMONSTRATION PROGRAM Pub. L. 118–159, div. A, title II, § 234, Dec. 23, 2024, 138 Stat. 1839, provided that: ‘‘(a) IN GENERAL.—Not later than November 30, 2025, the Chief Information Officer of the Department of De- fense, in coordination with the Under Secretary of De- fense for Research and Engineering and the Director of Operational Test and Evaluation, shall complete a demonstration program to assess the viability of using wideband adaptive signal processing technology to sup- port simultaneous transmit and receive signals on the same electromagnetic spectrum frequency band that— ‘‘(1) does not produce harmful interference; ‘‘(2) significantly reduces electromagnetic spectrum guard bands; ‘‘(3) maintains signal quality with respect to la- tency and throughput; and ‘‘(4) increases electromagnetic spectrum access within the frequency band. ‘‘(b) LOCATION.—The demonstration program required by subsection (a) shall be conducted at a test and train- ing range of the Department of Defense. ‘‘(c) CONSULTATION.—In carrying out the demonstra- tion program required by subsection (a), the Chief In- formation Officer, the Under Secretary, and the Direc- tor shall consult with, at a minimum, the following: ‘‘(1) The Joint Staff. ‘‘(2) The military departments and their associated research labs. ‘‘(3) Other Department of Defense organizations and agencies. ‘‘(4) The Federal Communications Commission. ‘‘(5) The National Telecommunications and Infor- mation Administration. ‘‘(6) Other Federal agencies. ‘‘(7) Industry and nongovernmental entities. ‘‘(d) AUTHORITY TO ENTER INTO CONTRACTS.—Subject to the availability of appropriations, the Chief Infor- mation Officer may enter into such contracts or other agreements as the Chief Information Officer considers appropriate to conduct studies and demonstration projects under the demonstration program required by subsection (a). ‘‘(e) BRIEFING ON PLANS FOR PROGRAM.—Not later than 60 days after the date of the enactment of this Act [Dec. 23, 2024], the Chief Information Officer, the Under Secretary, and the Director shall jointly provide to the congressional defense committees [Committees on Armed Services and Appropriations of the Senate and the House of Representatives] a briefing on the plans to carry out the demonstration program required by sub- section (a). ‘‘(f) PERIODIC ASSESSMENTS OF PROGRAM.—The Chief Information Officer, the Under Secretary, and the Di- rector shall, periodically, assess the demonstration program required by subsection (a) while the program is being carried out. ‘‘(g) BRIEFING ON COMPLETED PROGRAM.—Upon com- pletion of the demonstration program required by sub- section (a), the Chief Information Officer, the Under Secretary, and the Director shall jointly provide the congressional defense committees a briefing on their findings with respect to the demonstration program.’’ POLICIES FOR MANAGEMENT AND CERTIFICATION OF LINK 16 MILITARY TACTICAL DATA LINK NETWORK Pub. L. 118–31, div. A, title II, § 228, Dec. 22, 2023, 137 Stat. 199, provided that: ‘‘(a) POLICIES REQUIRED.—The Secretary of Defense shall develop and implement policies to adapt Link 16 Page 2789 TITLE 10—ARMED FORCES § 4571 system management and certification to align with agile development practices. ‘‘(b) ELEMENTS.—The policies required by subsection (a) shall include the following: ‘‘(1) A standardized process through a Chairman, Joint Chiefs of Staff Manual, to allow Link 16 fre- quency use within approved special use airspaces for the purpose of testing radio systems and associated software that have not completed electromagnetic compatibility features certification. Such process— ‘‘(A) shall, at a minimum, ensure routine and con- tinued approval for test operations of develop- mental systems in the Nevada Test and Training Range, Restricted Area 2508, Warning Area 151/470, Warning Area 386, and the Joint Pacific Alaska Range Complex; and ‘‘(B) may incorporate standardized mitigations that enable routine approval including effective ra- diated power settings and coordination for rapid test termination. ‘‘(2) Processes to streamline approval or denial of temporary frequency assignment for Link 16 oper- ations to not more than 15 days for test, training, and large-scale exercises. In developing such processes, the Secretary of Defense— ‘‘(A) shall ensure that the processes cover oper- ations in excess of uncoordinated operations time slot duty factor limits, inclusion of foreign partici- pants, and participation of non-stage 4 approved terminals or platforms; and ‘‘(B) consider delegating sole authority for tem- porary frequency assignment to the Department of Defense and the automation of decision-making processes relating to such assignments. ‘‘(3) Delegation of authority to the system manager for Link 16 to determine when new software within Department of Defense Link 16 terminals affects elec- tromagnetic compatibility features and requires re- certification. ‘‘(4) The self-certification by the Department of De- fense of the compliance of the Department’s radios with electromagnetic compatibility features. ‘‘(5) Processes to internally manage Link 16 unco- ordinated operations that enable approval for test, training, and exercises that does not exceed 15 days for systems holding an active radio frequency author- ization or temporary frequency assignment. ‘‘(c) INFORMATION TO CONGRESS.—Not later than 180 days after the date of the enactment of this Act [Dec. 22, 2023], the Secretary of Defense shall provide to the congressional defense committees— ‘‘(1) a briefing on the policies developed under sub- section (a), along with a timeline for implementation of such policies; and ‘‘(2) a list of such additional resources or authori- ties as the Secretary determines may be required to implement such policies. ‘‘(d) TESTING REQUIRED.— ‘‘(1) IN GENERAL.—In conjunction with the develop- ment of the policies required under subsection (a), the Secretary of Defense shall conduct, sponsor, or review testing and analysis that determines if any ef- fects on air traffic systems are possible due to Link 16 terminals which have not completed electro- magnetic compatibility features certification and quantifies any such effects. Such testing shall evalu- ate Link 16 transmission within plus or minus 7 megahertz of the 1030 and 1090 megahertz frequency bands to determine if effects on air traffic systems are possible, under what conditions such effects could occur, and the impact of such effects. ‘‘(2) REPORT.—Not later than 180 days after the date of the enactment of this Act, the Secretary of De- fense shall submit to the congressional defense com- mittees [Committees on Armed Services and Appro- priations of the Senate and the House of Representa- tives] a report on the results of the testing conducted under paragraph (1), with an emphasis on procedures that the Secretary intends to implement to negate harmful effects on air traffic from the use of Link 16 terminals or platforms that have not completed elec- tromagnetic compatibility features certification, within special use airspace.’’ REQUIREMENTS FOR DEPLOYMENT OF FIFTH GENERATION INFORMATION AND COMMUNICATIONS CAPABILITIES TO MILITARY INSTALLATIONS AND OTHER DEPARTMENT FACILITIES Pub. L. 118–31, div. A, title XV, § 1526, Dec. 22, 2023, 137 Stat. 557, provided that: ‘‘(a) REQUIREMENTS.— ‘‘(1) STRATEGY FOR PRIVATE WIRELESS NETWORKS.— Not later than 120 days after the date of the enact- ment of this Act [Dec. 22, 2023], the Secretary of De- fense shall develop and implement a strategy for de- ploying to military installations and other facilities of the Department of Defense private wireless net- works that are— ‘‘(A) based on fifth generation information and communications capabilities and Open Radio Ac- cess Network architecture; and ‘‘(B) tailored to the mission, security, and per- formance requirements of the respective military installation or other facility. ‘‘(2) PROCESS FOR PUBLIC WIRELESS NETWORK SERVICE PROVIDERS.— ‘‘(A) ESTABLISHMENT.—The Secretary shall estab- lish a Department-wide process under which a pub- lic wireless network service provider of fifth gen- eration information and communications capabili- ties may gain access to a military installation or other facility of the Department to provide com- mercial subscriber services to military and civilian personnel of the Department (including contractor personnel) located at, and organizational elements of the Department maintained at, such installation or facility. ‘‘(B) DESIGN REQUIREMENTS.—In establishing the process under subparagraph (A), the Secretary shall ensure relevant system architectures and sup- porting infrastructure are designed to support mod- ular upgrades to future generation technologies. ‘‘(3) DETERMINATION RELATING TO CONTRACT AUTHOR- ITY.—The Secretary shall determine, on a contract- by-contract basis or as a determination with uniform applicability to contracts across military installa- tions and other facilities of the Department, whether to enter into a contract for— ‘‘(A) neutral hosting, under which infrastructure and services would be provided to companies de- ploying private wireless networks and public wire- less network services to such installation or other facility through multi-operator core network archi- tectures; or ‘‘(B) separate private wireless network and public wireless network infrastructure at such installa- tion or other facility (which shall include a deter- mination by the Secretary on how to establish roaming agreements and policies between such net- works). ‘‘(4) BRIEFING.—Not later than 150 days after the date of the enactment of this Act, the Secretary shall provide to the congressional defense committees [Committees on Armed Services and Appropriations of the Senate and the House of Representatives] a briefing on the strategy developed under paragraph (1) and any other activity carried out pursuant to this subsection. ‘‘(b) INTERNATIONAL COOPERATION ACTIVITIES.—The Secretary, using existing authorities available to the Secretary, may engage in cooperation activities with foreign allies and partners of the United States to— ‘‘(1) improve the implementation of the strategy under subsection (a)(1); and ‘‘(2) inform the deployment of private wireless net- works to military installations and other facilities of the Department pursuant to such strategy. ‘‘(c) OPEN RADIO ACCESS NETWORK ARCHITECTURE DE- FINED.—In this section, the term ‘Open Radio Access Network architecture’ means a network architecture Page 2790 TITLE 10—ARMED FORCES § 4571 that is modular, uses open interfaces, and virtualizes functionality on commodity hardware through soft- ware.’’ TARGET DATE FOR DEPLOYMENT OF 5G WIRELESS BROADBAND INFRASTRUCTURE AT ALL MILITARY IN- STALLATIONS Pub. L. 117–263, div. A, title II, § 221, Dec. 23, 2022, 136 Stat. 2478, provided that: ‘‘(a) TARGET REQUIRED.—Not later than July 30, 2023, the Secretary of Defense shall— ‘‘(1) establish a target date by which the Secretary plans to deploy 5G wireless broadband infrastructure at all military installations; and ‘‘(2) establish metrics, which shall be identical for each of the military departments, to measure progress toward reaching the target required by para- graph (1). ‘‘(b) ANNUAL REPORT.—Not later than December 31, 2023, and on an annual basis thereafter until the date specified in subsection (c), the Secretary of Defense shall submit to the congressional defense committees [Committees on Armed Services and Appropriations of the Senate and the House of Representatives] a report that includes— ‘‘(1) the metrics in use pursuant to subsection (a)(2); and ‘‘(2) the progress of the Secretary in reaching the target required by subsection (a)(1). ‘‘(c) TERMINATION.—The requirement to submit an- nual reports under subsection (b) shall terminate on the date that is five years after the date of the enact- ment of this Act [Dec. 23, 2022].’’ PILOT PROGRAMS FOR DEPLOYMENT OF TELECOMMUNI- CATIONS INFRASTRUCTURE TO FACILITATE 5G DEPLOY- MENT ON MILITARY INSTALLATIONS Pub. L. 117–81, div. A, title II, § 233, Dec. 27, 2021, 135 Stat. 1614, provided that: ‘‘(a) PLANS.— ‘‘(1) IN GENERAL.—Not later than 180 days after en- actment of this Act [Dec. 27, 2021], each Secretary of a military department shall submit to the congres- sional defense committees [Committees on Armed Services and Appropriations of the Senate and the House of Representatives] a plan for a pilot program for the deployment of telecommunications infra- structure to facilitate the availability of fifth-gen- eration wireless telecommunications services on military installations under the jurisdiction of the Secretary. ‘‘(2) PLAN ELEMENTS.—Each plan submitted under paragraph (1) by a Secretary of a military depart- ment shall include, with respect to such military de- partment, the following: ‘‘(A) A list of military installations at which the pilot program will be carried out, including at least one military installation of the department. ‘‘(B) A description of authorities that will be used to execute the pilot program. ‘‘(C) A timeline for the implementation and dura- tion of the pilot program. ‘‘(D) The identity of each telecommunication car- rier that intends to use the telecommunications in- frastructure deployed pursuant to the pilot to pro- vide fifth-generation wireless telecommunication services at each of the military installations listed under subparagraph (A). ‘‘(E) An assessment of need for centralized proc- esses and points of contacts to facilitate deploy- ment of the telecommunications infrastructure. ‘‘(b) PILOT PROGRAMS REQUIRED.—Not later than one year after the date of the enactment of this Act, each Secretary of a military department shall establish a pilot program in accordance with the plan submitted by the Secretary under subsection (a)(1). ‘‘(c) REPORTS.— ‘‘(1) IN GENERAL.—Not later than 180 days after the date on which a Secretary of a military department commences a pilot program under subsection (b), and not less frequently than once every 180 days there- after until the completion of the pilot program, the Secretary shall submit to the congressional defense committees a report on the pilot program. ‘‘(2) CONTENTS.—Each report submitted under para- graph (1) for a pilot program shall include the fol- lowing: ‘‘(A) A description of the status of the pilot pro- gram at each military installation at which the pilot program is carried out. ‘‘(B) A description of the use of, and services pro- vided by, telecommunications carriers of the tele- communications infrastructure at each military in- stallation under the pilot program. ‘‘(C) Such additional information as the Sec- retary of the military department considers appro- priate. ‘‘(d) TELECOMMUNICATIONS INFRASTRUCTURE DE- FINED.—In this section, the term ‘telecommunications infrastructure’ includes, at a minimum, the following: ‘‘(1) Macro towers. ‘‘(2) Small cell poles. ‘‘(3) Distributed antenna systems. ‘‘(4) Dark fiber. ‘‘(5) Power solutions.’’ LEGACY INFORMATION TECHNOLOGIES AND SYSTEMS ACCOUNTABILITY Pub. L. 117–81, div. A, title XV, § 1522, Dec. 27, 2021, 135 Stat. 2041, provided that: ‘‘(a) IN GENERAL.—Not later than 270 days after the date of the enactment of this Act [Dec. 27, 2021], the Secretaries of the Army, Navy, and Air Force shall each initiate efforts to identify legacy applications, software, and information technology within their re- spective Departments and eliminate any such applica- tion, software, or information technology that is no longer required. ‘‘(b) SPECIFICATIONS.—To carry out subsection (a), that Secretaries of the Army, Navy, and Air Force shall each document the following: ‘‘(1) An identification of the applications, software, and information technologies that are considered ac- tive or operational, but which are judged to no longer be required by the respective Department. ‘‘(2) Information relating to the sources of funding for the applications, software, and information tech- nologies identified pursuant to paragraph (1). ‘‘(3) An identification of the senior official respon- sible for each such application, software, or informa- tion technology. ‘‘(4) A plan to discontinue use and funding for each such application, software, or information tech- nology. ‘‘(c) EXEMPTION.—Any effort substantially similar to that described in subsections (a) and (b) that is being carried out by the Secretary of the Army, Navy, or Air Force as of the date of the enactment of this Act and completed not later 180 days after such date shall be treated as satisfying the requirements under such sub- sections. ‘‘(d) REPORT.—Not later than 270 days after the date of the enactment of this Act, the Secretaries of the Army, Navy, and Air Force shall each submit to the congressional defense committees [Committees on Armed Services and Appropriations of the Senate and the House of Representatives] the documentation re- quired under subsection (b).’’ GOVERNANCE OF FIFTH-GENERATION WIRELESS NETWORKING IN THE DEPARTMENT OF DEFENSE Pub. L. 116–283, div. A, title II, § 224, Jan. 1, 2021, 134 Stat. 3472, provided that: ‘‘(a) TRANSITION OF 5G WIRELESS NETWORKING TO OPERATIONAL USE.— ‘‘(1) TRANSITION PLAN REQUIRED.—The Under Sec- retary of Defense for Research and Engineering, in consultation with the cross functional team estab- Page 2791 TITLE 10—ARMED FORCES § 4571 lished under subsection (c), shall develop a plan to transition fifth-generation (commonly known as ‘5G’) wireless technology to operational use within the De- partment of Defense. ‘‘(2) ELEMENTS.—The transition plan under para- graph (1) shall include the following: ‘‘(A) A timeline for the transition of responsi- bility for 5G wireless networking to the Chief Infor- mation Officer, as required under subsection (b)(1). ‘‘(B) A description of the roles and responsibil- ities of the organizations and elements of the De- partment of Defense with respect to the acquisi- tion, sustainment, and operation of 5G wireless net- working for the Department, as determined by the Secretary of Defense in accordance with subsection (d). ‘‘(3) INTERIM BRIEFING.—Not later than March 31, 2021[,] the Secretary of Defense shall provide to the congressional defense committees [Committees on Armed Services and Appropriations of the Senate and the House of Representatives] a briefing on the status of the plan required under paragraph (1). ‘‘(4) FINAL REPORT.—Not later than September 30, 2021, the Secretary of Defense shall submit to the congressional defense committees a report that in- cludes the plan developed under paragraph (1). ‘‘(b) SENIOR OFFICIAL FOR 5G WIRELESS NETWORKING.— ‘‘(1) DESIGNATION OF CHIEF INFORMATION OFFICER.— Not later than October 1, 2023, the Secretary of De- fense shall designate the Chief Information Officer as the senior official within Department of Defense with primary responsibility for— ‘‘(A) policy, oversight, guidance, research, and co- ordination on matters relating to 5G wireless net- working; and ‘‘(B) making proposals to the Secretary on gov- ernance, management, and organizational policy for 5G wireless networking. ‘‘(2) ROLE OF UNDER SECRETARY OF DEFENSE FOR RE- SEARCH AND ENGINEERING.—The Under Secretary of Defense for Research and Engineering shall carry out the responsibilities specified in paragraph (1) until the date on which the Secretary of Defense des- ignates the Chief Information Officer as the senior of- ficial responsible for 5G wireless networking under such paragraph. ‘‘(c) CROSS-FUNCTIONAL TEAM FOR 5G WIRELESS NET- WORKING.— ‘‘(1) ESTABLISHMENT.—Using the authority provided under section 911(c) of the National Defense Author- ization Act for Fiscal Year 2017 (Public Law 114–328; 10 U.S.C. 111 note), the Secretary of Defense shall es- tablish a cross-functional team for 5G wireless net- working. ‘‘(2) DUTIES.—The duties of the cross-functional team established under paragraph (1) shall be— ‘‘(A) to assist the Secretary of Defense in deter- mining the roles and responsibilities of the organi- zations and elements of the Department of Defense with respect to the acquisition, sustainment, and operation of 5G wireless networking, as required under subsection (d); ‘‘(B) to assist the senior official responsible for 5G wireless networking in carrying out the responsibil- ities assigned to such official under subsection (b); ‘‘(C) to oversee the implementation of the strat- egy developed under section 254 of the National De- fense Authorization Act for Fiscal Year 2020 (Public Law 116–92; 10 U.S.C. 2223a note [now 10 U.S.C. 4571 note]) for harnessing 5G wireless networking tech- nologies, coordinated across all relevant elements of the Department; ‘‘(D) to advance the adoption of commercially available, next-generation wireless communication technologies, capabilities, security, and applica- tions by the Department and the defense industrial base; and ‘‘(E) to support public-private partnerships be- tween the Department and industry on matters re- lating to 5G wireless networking; ‘‘(F) to coordinate research and development, im- plementation and acquisition activities, warfighting concept development, spectrum policy, industrial policy and commercial outreach and partnership relating to 5G wireless networking in the Department, and interagency and international engagement; ‘‘(G) to integrate the Department’s 5G wireless networking programs and policies with major ini- tiatives, programs, and policies of the Department relating to secure microelectronics and command and control; and ‘‘(H) to oversee, coordinate, execute, and lead ini- tiatives to advance 5G wireless network tech- nologies and associated applications developed for the Department. ‘‘(3) TEAM LEADER.—The Under Secretary of Defense for Research and Engineering shall lead the cross- functional team established under paragraph (1) until the date on which the Secretary of Defense des- ignates the Chief Information Officer as the senior of- ficial responsible for 5G wireless networking as re- quired under subsection (b)(1). Beginning on the date of such designation, the Chief Information Officer shall lead the cross functional team. ‘‘(d) DETERMINATION OF ORGANIZATIONAL ROLES AND RESPONSIBILITIES.—The Secretary of Defense, acting through the cross-functional team established under subsection (c), shall determine the roles and respon- sibilities of the organizations and elements of the De- partment of Defense with respect to the acquisition, sustainment, and operation of 5G wireless networking for the Department, including the roles and responsibil- ities of the Office of the Secretary of Defense, the intel- ligence components of the Department, Defense Agen- cies and Department of Defense Field Activities, the Armed Forces, combatant commands, and the Joint Staff. ‘‘(e) BRIEFING.—Not later than 90 days after the date of the enactment of this Act [Jan. 1, 2021], the Sec- retary of Defense shall submit to the congressional de- fense committees a briefing on the progress of the Sec- retary in— ‘‘(1) establishing the cross-functional team under subsection (c); and ‘‘(2) determining the roles and responsibilities of the organizations and elements of the Department of Defense with respect to 5G wireless networking as re- quired under subsection (d). ‘‘(f) 5G PROCUREMENT DECISIONS.—Each Secretary of a military department shall be responsible for decisions relating to the procurement of 5G wireless technology for that department. ‘‘(g) TELECOMMUNICATIONS SECURITY PROGRAM.— ‘‘(1) PROGRAM REQUIRED.—The Secretary of Defense shall carry out a program to identify and mitigate vulnerabilities in the 5G telecommunications infra- structure of the Department of Defense. ‘‘(2) ELEMENTS.—In carrying out the program under paragraph (1), the Secretary shall— ‘‘(A) develop a capability to communicate clearly and authoritatively about threats by foreign adver- saries; ‘‘(B) conduct independent red-team security anal- ysis of systems, subsystems, devices, and compo- nents of the Department of Defense including no- knowledge testing and testing with limited or full knowledge of expected functionalities; ‘‘(C) verify the integrity of personnel who are tasked with design fabrication, integration, con- figuration, storage, test, and documentation of non- commercial 5G technology to be used by the De- partment; ‘‘(D) verify the efficacy of the physical security measures used at Department locations where sys- tem design, fabrication, integration, configuration, storage, test, and documentation of 5G technology occurs; ‘‘(E) direct the Chief Information Officer to as- sess, using existing government evaluation models Page 2792 TITLE 10—ARMED FORCES § 4571 and schema where applicable, 5G core service pro- viders whose services will be used by the Depart- ment through the Department’s provisional author- ization process; and ‘‘(F) direct the Defense Information Systems Agency and the United States Cyber Command to develop a capability for continuous, independent monitoring of non-commercial, government- transiting packet streams for 5G data on fre- quencies assigned to the Department to validate the availability, confidentiality, and integrity of the Department’s communications systems. ‘‘(3) IMPLEMENTATION PLAN.—Not later than 90 days after the date of the enactment of this Act [Jan. 1, 2021], the Secretary of Defense shall submit to Con- gress a plan for the implementation of the program under paragraph (1). ‘‘(4) REPORT.—Not later than 270 days after submit- ting the plan under paragraph (3), the Secretary of Defense shall submit to Congress a report that in- cludes— ‘‘(A) a comprehensive assessment of the findings and conclusions of the program under paragraph (1); ‘‘(B) recommendations on how to mitigate vulnerabilities in the telecommunications infra- structure of the Department of Defense; and ‘‘(C) an explanation of how the Department plans to implement such recommendations. ‘‘(h) RULE OF CONSTRUCTION.— ‘‘(1) IN GENERAL.—Nothing in this section shall be construed as providing the Chief Information Officer immediate responsibility for the activities of the De- partment of Defense in fifth-generation wireless net- working experimentation and science and technology development. ‘‘(2) PURVIEW OF EXPERIMENTATION AND SCIENCE AND TECHNOLOGY DEVELOPMENT.—The activities described in paragraph (1) shall remain within the purview of the Under Secretary of Defense for Research and En- gineering, but shall inform and be informed by the activities of the cross-functional team established pursuant to subsection (c).’’ DEMONSTRATION PROJECT ON USE OF CERTAIN TECH- NOLOGIES FOR FIFTH-GENERATION WIRELESS NET- WORKING SERVICES Pub. L. 116–283, div. A, title II, § 225, Jan. 1, 2021, 134 Stat. 3475, provided that: ‘‘(a) DEMONSTRATION PROJECT.—The Secretary of De- fense shall carry out a demonstration project to evalu- ate the maturity, performance, and cost of covered technologies to provide additional options for providers of fifth-generation wireless network services. ‘‘(b) LOCATION.—The Secretary of Defense shall carry out the demonstration project under subsection (a) in at least one location where the Secretary plans to de- ploy a fifth-generation wireless network. ‘‘(c) COORDINATION.—The Secretary shall carry out the demonstration project under subsection (a) in co- ordination with at least one major wireless network service provider based in the United States. ‘‘(d) COVERED TECHNOLOGIES DEFINED.—In this sec- tion, the term ‘covered technologies’ means— ‘‘(1) a disaggregated or virtualized radio access net- work and core in which components can be provided by different vendors and interoperate through open protocols and interfaces, including those protocols and interfaces utilizing the Open Radio Access Net- work (commonly known as ‘Open RAN’ or ‘oRAN’) ap- proach; and ‘‘(2) one or more massive multiple-input, multiple- output radio arrays, provided by one or more compa- nies based in the United States, that have the poten- tial to compete favorably with radios produced by foreign companies in terms of cost, performance, and efficiency.’’ PILOT PROGRAM ON THE USE OF CONSUMPTION-BASED SOLUTIONS TO ADDRESS SOFTWARE-INTENSIVE WARFIGHTING CAPABILITY Pub. L. 116–283, div. A, title VIII, § 834, Jan. 1, 2021, 134 Stat. 3754, provided that: ‘‘(a) IN GENERAL.—Subject to the availability of ap- propriations, the Secretary of Defense is authorized to establish a pilot program to explore the use of con- sumption-based solutions to address software-intensive warfighting capability. ‘‘(b) SELECTION OF INITIATIVES.—Each Secretary of a military department and each commander of a combat- ant command with acquisition authority shall propose for selection by the Secretary of Defense for the pilot program at least one and not more than three initia- tives that are well-suited to explore consumption-based solutions, to include addressing software-intensive warfighting capability. The initiatives may be new or existing programs of record, and may include applica- tions that— ‘‘(1) rapidly analyze sensor data; ‘‘(2) secure warfighter networks, including multi- level security; ‘‘(3) swiftly transport information across various networks and network modalities; ‘‘(4) enable joint all-domain operational concepts, including in a contested environment; or ‘‘(5) advance military capabilities and effectiveness. ‘‘(c) REQUIREMENTS.—A contract or other agreement for consumption-based solutions entered into under the pilot program shall require— ‘‘(1) the effectiveness of the solution to be measur- able at regular intervals customary for the type of solution provided under contract or other agreement; and ‘‘(2) that the awardee notify the Secretary of De- fense when consumption under the contract or other agreement reaches 75 percent and 90 percent of the funded amount, respectively, of the contract or other agreement. ‘‘(d) EXEMPTION.—A modification to a contract or other agreement entered into under this section to add new features or capabilities in an amount less than or equal to 25 percent of the total value of such contract or other agreement shall be exempt from the require- ments of full and open competition (as defined in sec- tion 2302 of title 10, United States Code [see 10 U.S.C. 3011]). ‘‘(e) DURATION.—The duration of a contract or other agreement entered into under this section may not ex- ceed three years. ‘‘(f) MONITORING AND EVALUATION OF PILOT PRO- GRAM.—The Director of Cost Assessment and Program Evaluation shall continuously monitor and evaluate the pilot program, including by collecting data on cost, schedule, and performance from the program office, the user community, and the awardees involved in the pro- gram. ‘‘(g) REPORTS.— ‘‘(1) INITIAL REPORT.—Not later than May 15, 2021, the Secretary of Defense shall submit to the congres- sional defense committees [Committees on Armed Services and Appropriations of the Senate and the House of Representatives] a report on initiatives se- lected for the pilot program, roles, and responsibil- ities for implementing the program, and the moni- toring and evaluation approach that will be used for the program. ‘‘(2) PROGRESS REPORT.—Not later than October 15, 2021, the Secretary of Defense shall submit to the congressional defense committees a report on the progress of the initiatives selected for the pilot pro- gram. ‘‘(3) FINAL REPORT.—Not later than 3 years after the date of the enactment of this Act [Jan. 1, 2021], the Secretary of Defense shall submit to the congres- sional defense committees a report on the cost, schedule, and performance outcomes of the initia- tives carried out under the pilot program. The report shall also include lessons learned about the use of consumption-based solutions for software-intensive capabilities and any recommendations for statutory or regulatory changes to facilitate the use of such so- lutions. ‘‘(h) CONSUMPTION-BASED SOLUTION DEFINED.—In this section, the term ‘consumption-based solution’ means Page 2793 TITLE 10—ARMED FORCES § 4571 any combination of software, hardware or equipment, and labor or services that provides a seamless capa- bility that is metered and billed based on actual usage and predetermined pricing per resource unit, and in- cludes the ability to rapidly scale capacity up or down.’’ BALANCING SECURITY AND INNOVATION IN SOFTWARE DEVELOPMENT AND ACQUISITION Pub. L. 116–283, div. A, title VIII, § 835, Jan. 1, 2021, 134 Stat. 3755, provided that: ‘‘(a) REQUIREMENTS FOR SOLICITATIONS OF COMMERCIAL AND DEVELOPMENTAL SOLUTIONS.—The Under Secretary of Defense for Acquisition and Sustainment, in coordi- nation with the Chief Information Officer of the De- partment of Defense, shall develop requirements for ap- propriate software security criteria to be included in solicitations for commercial and developmental solu- tions and the evaluation of bids submitted in response to such solicitations, including a delineation of what processes were or will be used for a secure software de- velopment life cycle. Such requirements shall include— ‘‘(1) establishment and enforcement of secure cod- ing practices; ‘‘(2) management of supply chain risks and third- party software sources and component risks; ‘‘(3) security of the software development environ- ment; ‘‘(4) secure deployment, configuration, and installa- tion processes; and ‘‘(5) an associated vulnerability management plan and identification of tools that will be applied to achieve an appropriate level of security. ‘‘(b) SECURITY REVIEW OF CODE.—The Under Secretary of Defense for Acquisition and Sustainment, in coordi- nation with the Chief Information Officer of the De- partment of Defense, shall develop— ‘‘(1) procedures for the security review of code; and ‘‘(2) other procedures necessary to fully implement the pilot program required under section 875 of the National Defense Authorization Act for Fiscal Year 2018 (Public Law 115–91; 10 U.S.C. 2223 note). ‘‘(c) COORDINATION WITH CYBERSECURITY ACQUISITION POLICY EFFORTS.—The Under Secretary of Defense for Acquisition and Sustainment shall develop the require- ments and procedures described under subsections (a) and (b) in coordination with the efforts of the Depart- ment of Defense to develop new cybersecurity and pro- gram protection policies and guidance that are focused on cybersecurity in the context of acquisition and pro- gram management and on safeguarding information.’’ ESTABLISHMENT OF SECURE NEXT-GENERATION WIRE- LESS NETWORK (5G) INFRASTRUCTURE FOR THE NE- VADA TEST AND TRAINING RANGE AND BASE INFRA- STRUCTURE Pub. L. 116–92, div. A, title II, § 226, Dec. 20, 2019, 133 Stat. 1269, provided that: ‘‘(a) ESTABLISHMENT REQUIRED.—Not later than one year after the date of the enactment of this Act [Dec. 20, 2019], the Secretary of Defense shall establish secure fifth-generation wireless network components and ca- pabilities at no fewer than two Department of Defense installations in accordance with this section. ‘‘(b) INSTALLATIONS.— ‘‘(1) LOCATIONS.—The Secretary shall establish com- ponents and capabilities under subsection (a) at the following: ‘‘(A) The Nevada Test and Training Range, which shall serve as a Major Range and Test Facility Base (MRTFB) for fifth-generation wireless networking. ‘‘(B) Such Department installations or other in- stallations as the Secretary considers appropriate for the purpose set forth in paragraph (2). ‘‘(2) PURPOSE.—The purpose of the establishment of components and capabilities under subsection (a) at the locations described in paragraph (1) of this sub- section is to demonstrate the following: ‘‘(A) The potential military utility of high band- width, scalable, and low latency fifth-generation wireless networking technology. ‘‘(B) Advanced security technology that is appli- cable to fifth-generation networks as well as legacy Department command and control networks. ‘‘(C) Secure interoperability with fixed and wire- less systems (legacy and future systems). ‘‘(D) Enhancements such as spectrum and wave- form diversity, frequency hopping and spreading, and beam forming for military requirements. ‘‘(E) Technology for dynamic network slicing for specific use cases and applications requiring vary- ing levels of latency, scale, and throughput. ‘‘(F) Technology for dynamic spectrum sharing and network isolation. ‘‘(G) Base infrastructure installation of high bandwidth, scalable, and low latency fifth-genera- tion wireless networking technology. ‘‘(H) Applications for secure fifth-generation wireless network capabilities for the Department, such as the following: ‘‘(i) Interactive augmented reality or synthetic training environments. ‘‘(ii) Internet of things devices. ‘‘(iii) Autonomous systems. ‘‘(iv) Advanced manufacturing through the fol- lowing: ‘‘(I) Department-sponsored centers for manu- facturing innovation (as defined in section 34(c) of the National Institute of Standards and Technology Act (15 U.S.C. 278s(c))). ‘‘(II) Department research and development organizations. ‘‘(III) Manufacturers in the defense industrial base of the United States.’’ DIGITAL ENGINEERING CAPABILITY TO AUTOMATE TESTING AND EVALUATION Pub. L. 116–92, div. A, title II, § 231, Dec. 20, 2019, 133 Stat. 1274, provided that: ‘‘(a) DIGITAL ENGINEERING CAPABILITY.— ‘‘(1) IN GENERAL.—The Secretary of Defense shall es- tablish a digital engineering capability to be used— ‘‘(A) for the development and deployment of dig- ital engineering models for use in the defense ac- quisition process; and ‘‘(B) to provide testing infrastructure and soft- ware to support automated approaches for testing, evaluation, and deployment throughout the defense acquisition process. ‘‘(2) REQUIREMENTS.—The capability developed under subsection (a) shall meet the following require- ments: ‘‘(A) The capability will be accessible to, and use- able by, individuals throughout the Department of Defense who have responsibilities relating to capa- bility design, development, testing, evaluation, and operation. ‘‘(B) The capability will provide for the develop- ment, validation, use, curation, and maintenance of technically accurate digital systems, models of sys- tems, subsystems, and their components, at the ap- propriate level of fidelity to ensure that test activi- ties adequately simulate the environment in which a system will be deployed. ‘‘(C) The capability will include software to auto- mate testing throughout the program life cycle, in- cluding to satisfy developmental test requirements and operational test requirements. Such software may be developed in accordance with the authori- ties provided under section 800 [of Pub. L. 116–92, set out as a note below], and shall support— ‘‘(i) security testing that includes vulnerability scanning and penetration testing performed by individuals, including threat-based red team ex- ploitations and assessments with zero-trust as- sumptions; and ‘‘(ii) high-confidence distribution of software to the field on a time-bound, repeatable, frequent, and iterative basis. ‘‘(b) DEMONSTRATION ACTIVITIES.— ‘‘(1) IN GENERAL.—In developing the capability re- quired under subsection (a), the Secretary of Defense Page 2794 TITLE 10—ARMED FORCES § 4571 shall carry out activities to demonstrate digital engi- neering approaches to automated testing that— ‘‘(A) enable continuous software development and delivery; ‘‘(B) satisfy developmental test requirements for the software-intensive programs of the Department of Defense; and ‘‘(C) satisfy operational test and evaluation re- quirements for such programs. ‘‘(2) PROGRAM SELECTION.—Not later than 180 days after the date of the enactment of this Act [Dec. 20, 2019], the Secretary of Defense shall assess and select not fewer than four and not more than ten programs of the Department of Defense to participate in the demonstration activities under paragraph (1), includ- ing— ‘‘(A) at least one program participating in the pilot program authorized under section 873 of the National Defense Authorization Act for Fiscal Year 2018 (Public Law 115–91; 10 U.S.C. 2223a note [now former 10 U.S.C. 4571 note]); ‘‘(B) at least one program participating in the pilot program authorized under section 874 of such Act (Public Law 115–91; 10 U.S.C. 2302 note); ‘‘(C) at least one major defense acquisition pro- gram (as defined in section 2430 of title 10, United States Code [now 10 U.S.C. 4201]); ‘‘(D) at least one command and control program; ‘‘(E) at least one defense business system (as de- fined in section 2222(i) of title 10, United States Code); and ‘‘(F) at least one program from each military service. ‘‘(3) ADDITIONAL REQUIREMENTS.—As part of the demonstration activities under paragraph (1), the Secretary shall— ‘‘(A) conduct a comparative analysis that assesses the risks and benefits of the digital engineering supported automated testing approaches of the pro- grams participating in the demonstration activities relative to traditional testing approaches that are not supported by digital engineering; ‘‘(B) ensure that the intellectual property strat- egy for each of the programs participating in the demonstration activities is best aligned to meet the goals of the program; and ‘‘(C) develop a workforce and infrastructure plan to support any new policies and guidance imple- mented in connection with the demonstration ac- tivities, including any policies and guidance imple- mented after the completion of such activities. ‘‘(c) POLICIES AND GUIDANCE REQUIRED.—Not later than one year after the date of the enactment of this Act [Dec. 20, 2019], based on the results of the dem- onstration activities carried out under subsection (b), the Secretary of Defense shall issue or modify policies and guidance to— ‘‘(1) promote the use of digital engineering capabili- ties for development and for automated testing; and ‘‘(2) address roles, responsibilities, and procedures relating to such capabilities. ‘‘(d) STEERING COMMITTEE.— ‘‘(1) IN GENERAL.—The Secretary of Defense shall es- tablish a steering committee to assist the Secretary in carrying out subsections (a) through (c). ‘‘(2) MEMBERSHIP.—The steering committee shall be composed of the following members or their des- ignees: ‘‘(A) The Under Secretary of Defense for Research and Engineering. ‘‘(B) The Under Secretary of Defense for Acquisi- tion and Sustainment. ‘‘(C) The Chief Information Officer. ‘‘(D) The Director of Operational Test and Eval- uation. ‘‘(E) The Director of Cost Assessment and Pro- gram Evaluation. ‘‘(F) The Service Acquisition Executives. ‘‘(G) The Service testing commands. ‘‘(H) The Director of the Defense Digital Service. ‘‘(e) REPORTS REQUIRED.— ‘‘(1) IMPLEMENTATION.—Not later than March 15, 2020, the Secretary of Defense shall submit to the congressional defense committees [Committees on Armed Services and Appropriations of the Senate and the House of Representatives] a report on the progress of the Secretary in implementing sub- sections (a) through (c). The report shall include an explanation of how the results of the demonstration activities carried out under subsection (b) will be in- corporated into the policy and guidance required under subsection (c), particularly the policy and guidance of the members of the steering committee established under subsection (d). ‘‘(2) LEGISLATIVE RECOMMENDATIONS.—Not later than October 15, 2020, the Secretary of Defense shall provide to the congressional defense committees a briefing that identifies any changes to existing law that may be necessary to facilitate the implementa- tion of subsections (a) through (c). ‘‘(f) INDEPENDENT ASSESSMENT.— ‘‘(1) IN GENERAL.—Not later than March 15, 2021, the Defense Innovation Board and the Defense Science Board shall jointly complete an independent assess- ment of the progress of the Secretary in imple- menting subsections (a) through (c). The Secretary of Defense shall ensure that the Defense Innovation Board and the Defense Science Board have access to the resources, data, and information necessary to complete the assessment. ‘‘(2) INFORMATION TO CONGRESS.—Not later than 30 days after the date on which the assessment under paragraph (1) is completed, the Defense Innovation Board and the Defense Science Board shall jointly provide to the congressional defense committees— ‘‘(A) a report summarizing the assessment; and ‘‘(B) a briefing on the findings of the assessment.’’ STRATEGY AND IMPLEMENTATION PLAN FOR FIFTH GEN- ERATION INFORMATION AND COMMUNICATIONS TECH- NOLOGIES Pub. L. 116–92, div. A, title II, § 254, Dec. 20, 2019, 133 Stat. 1287, as amended by Pub. L. 117–263, div. A, title II, § 232, Dec. 23, 2022, 136 Stat. 2486, provided that: ‘‘(a) IN GENERAL.—Not later than 270 days after the date of the enactment of this Act [Dec. 20, 2019], the Secretary of Defense shall develop— ‘‘(1) a strategy for harnessing fifth generation (com- monly known as ‘5G’) information and communica- tions technologies to enhance military capabilities, maintain a technological advantage on the battle- field, and accelerate the deployment of new commer- cial products and services enabled by 5G networks throughout the Department of Defense; and ‘‘(2) a plan for implementing the strategy developed under paragraph (1). ‘‘(b) ELEMENTS.—The strategy required under sub- section (a) shall include the following elements: ‘‘(1) Adoption and use of secure fourth generation (commonly known as ‘4G’) communications tech- nologies and the transition to advanced and secure 5G communications technologies for military applica- tions and for military infrastructure. ‘‘(2) Science, technology, research, and develop- ment efforts to facilitate the advancement and adop- tion of 5G technology and new uses of 5G systems, subsystems, and components, including— ‘‘(A) 5G testbeds for developing military and dual- use applications; and ‘‘(B) spectrum-sharing technologies and frame- works. ‘‘(3) Strengthening engagement and outreach with industry, academia, international partners, and other departments and agencies of the Federal Government on issues relating to 5G technology and the deploy- ment of such technology, including development of a common industrial base for secure microelectronics. ‘‘(4) Defense industrial base supply chain risk, man- agement, and opportunities. ‘‘(5) Preserving the ability of the Joint Force to achieve objectives in a contested and congested spec- trum environment. Page 2795 TITLE 10—ARMED FORCES § 4571 ‘‘(6) Strengthening the ability of the Joint Force to conduct full spectrum operations that enhance the military advantages of the United States. ‘‘(7) Securing the information technology and weap- on systems of the Department against malicious ac- tivity. ‘‘(8) Advancing the deployment of secure 5G net- works nationwide. ‘‘(9) Such other matters as the Secretary of Defense determines to be relevant. ‘‘(c) CONSULTATION.—In developing the strategy and implementation plan required under subsection (a), the Secretary of Defense shall consult with the following: ‘‘(1) The Chief Information Officer of the Depart- ment of Defense. ‘‘(2) The Under Secretary of Defense for Research and Engineering. ‘‘(3) The Under Secretary of Defense for Acquisition and Sustainment. ‘‘(4) The Under Secretary of Defense for Intel- ligence [now Under Secretary of Defense for Intel- ligence and Security]. ‘‘(5) Service Acquisition Executives of each mili- tary service. ‘‘(d) PERIODIC BRIEFINGS.— ‘‘(1) IN GENERAL.—Not later than March 15, 2020, and not less frequently than once every three months thereafter through December 1, 2026, the Secretary of Defense shall provide to the congressional defense committees [Committees on Armed Services and Ap- propriations of the Senate and the House of Rep- resentatives] a briefing on the development and im- plementation of the strategy required under sub- section (a), including an explanation of how the De- partment of Defense— ‘‘(A) is using secure 5G wireless network tech- nology; ‘‘(B) is reshaping the Department’s policy for pro- ducing and procuring secure microelectronics; and ‘‘(C) is working in the interagency and inter- nationally to develop common policies and ap- proaches. ‘‘(2) ELEMENTS.—Each briefing under paragraph (1) shall include information on— ‘‘(A) efforts to ensure a secure supply chain for 5G wireless network equipment and microelectronics; ‘‘(B) the continued availability of electro- magnetic spectrum for warfighting needs; ‘‘(C) planned implementation of 5G wireless net- work infrastructure in warfighting networks, base infrastructure, defense-related manufacturing, and logistics; ‘‘(D) steps taken to work with allied and partner countries to protect critical networks and supply chains; and ‘‘(E) such other topics as the Secretary of Defense considers relevant.’’ DEPARTMENT-WIDE SOFTWARE SCIENCE AND TECHNOLOGY STRATEGY Pub. L. 116–92, div. A, title II, § 255, Dec. 20, 2019, 133 Stat. 1288, as amended by Pub. L. 117–81, div. A, title II, §§ 212(c)(1), 215(d)(10), Dec. 27, 2021, 135 Stat. 1588, 1594, provided that: ‘‘(a) DESIGNATION OF SENIOR OFFICIAL.—Not later than 180 days after the date of the enactment of this Act [Dec. 20, 2019], the Secretary of Defense, acting through the Under Secretary of Defense for Research and Engi- neering and in consultation with the Under Secretary of Defense for Acquisition and Sustainment and appro- priate public and private sector organizations, shall designate a single official or existing entity within the Department of Defense as the official or entity (as the case may be) with principal responsibility for guiding the development of science and technology activities related to next generation software and software reli- ant systems for the Department, including— ‘‘(1) research and development activities on new technologies for the creation of highly secure, scal- able, reliable, time-sensitive, and mission-critical software; ‘‘(2) research and development activities on new ap- proaches and tools to software development and de- ployment, testing, integration, and next generation software management tools to support the rapid in- sertion of such software into defense systems; ‘‘(3) foundational scientific research activities to support advances in software; ‘‘(4) technical workforce and infrastructure to sup- port defense science and technology and software needs and mission requirements; ‘‘(5) providing capabilities, including technologies, systems, and technical expertise to support improved acquisition of software reliant business and warfighting systems; and ‘‘(6) providing capabilities, including technologies, systems, and technical expertise to support defense operational missions which are reliant on software. ‘‘(b) DEVELOPMENT OF STRATEGY.—The official or en- tity designated under subsection (a) shall develop a De- partment-wide strategy for the research and develop- ment of next generation software and software reliant systems for the Department of Defense, including strat- egies for— ‘‘(1) types of software-related activities within the science and technology portfolio of the Department; ‘‘(2) investment in new approaches to software de- velopment and deployment, and next generation management tools; ‘‘(3) ongoing research and other support of aca- demic, commercial, and development community ef- forts to innovate the software development, engineer- ing, and testing process, automated testing, assur- ance and certification for safety and mission critical systems, large scale deployment, and sustainment; ‘‘(4) to the extent practicable, implementing or con- tinuing the implementation of the recommendations set forth in— ‘‘(A) the final report of the Defense Innovation Board submitted to the congressional defense com- mittees [Committees on Armed Services and Appro- priations of the Senate and the House of Represent- atives] under section 872 of the National Defense Authorization Act for Fiscal Year 2018 (Public Law 115–91; 131 Stat. 1497); ‘‘(B) the final report of the Defense Science Board Task Force on the Design and Acquisition of Soft- ware for Defense Systems described in section 868 of the John S. McCain National Defense Authorization Act for Fiscal Year 2019 (Public Law 115–232; 10 U.S.C. 2223[a] note [now 10 U.S.C. 4571 note]); and ‘‘(C) other relevant studies on software research, development, and acquisition activities of the De- partment of Defense. ‘‘(5) supporting the acquisition, technology develop- ment, testing, assurance, and certification and oper- ational needs of the Department through the develop- ment of capabilities, including personnel and re- search and production infrastructure, and programs in— ‘‘(A) the science and technology reinvention lab- oratories (as designated under section 4121(b) of title 10, United States Code); ‘‘(B) the facilities of the Major Range and Test Facility Base (as defined in section 2358a(g) of title 10, United States Code [now 10 U.S.C. 4091(f)]); ‘‘(C) the Defense Advanced Research Projects Agency; and ‘‘(D) universities, federally funded research and development centers, and service organizations with activities in software engineering; and ‘‘(6) the transition of relevant capabilities and tech- nologies to relevant programs of the Department, in- cluding software-reliant cyber-physical systems, tac- tical systems, enterprise systems, and business sys- tems. ‘‘(c) SUBMITTAL TO CONGRESS.—Not later than one year after the date of the enactment of this Act [Dec. 20, 2019], the official or entity designated under sub- section (a) shall submit to the congressional defense Page 2796 TITLE 10—ARMED FORCES § 4571 committees the strategy developed under subsection (b).’’ AUTHORITY FOR CONTINUOUS INTEGRATION AND DELIV- ERY OF SOFTWARE APPLICATIONS AND UPGRADES TO EMBEDDED SYSTEMS Pub. L. 116–92, div. A, title VIII, § 800, Dec. 20, 2019, 133 Stat. 1478, which authorized establishment of pathways to provide for the efficient and effective acquisition, development, integration, and timely delivery of secure software, was repealed by Pub. L. 118–159, div. A, title VIII, § 805(c)(1), Dec. 23, 2024, 138 Stat. 1972. See section 3603 of this title. REORIENTATION OF BIG DATA PLATFORM PROGRAM Pub. L. 116–92, div. A, title XVI, § 1651, Dec. 20, 2019, 133 Stat. 1759, as amended by Pub. L. 116–283, div. A, title XVII, § 1709(a), Jan. 1, 2021, 134 Stat. 4086, provided that: ‘‘(a) REORIENTATION OF PROGRAM.— ‘‘(1) IN GENERAL.—Not later than January 1, 2021, the Secretary of Defense shall— ‘‘(A) reorient the Big Data Platform program as specified in this section; and ‘‘(B) align the reorientation effort under an exist- ing line of effort of the Cyber Strategy of the De- partment of Defense. ‘‘(2) OVERSIGHT OF IMPLEMENTATION.—The Secretary shall act through the Principal Cyber Advisor and the supporting Cross Functional Team in the oversight of the implementation of paragraph (1). ‘‘(b) COMMON BASELINE AND SECURITY CLASSIFICATION SCHEME.— ‘‘(1) IN GENERAL.—Not later than January 1, 2021, the Secretary shall establish a common baseline and security classification scheme for the collection, storage, processing, querying, analysis, and accessi- bility of a common and comprehensive set of metadata from sensors, applications, appliances, products, and systems deployed across the Depart- ment of Defense Information Network (DODIN) to en- able the discovery, tracking, and remediation of cybersecurity threats. ‘‘(2) REQUIREMENTS.—In carrying out paragraph (1), the Secretary shall— ‘‘(A) take such actions as the Secretary considers necessary to standardize deployed infrastructure, including the Department of Defense’s perimeter capabilities at the Internet Access Points, the Joint Regional Security Stacks, or other approved solutions, and the routing of data laterally and vertically from Department of Defense Information Network segments and tiers, to enable standard and comprehensive metadata collection; ‘‘(B) take such actions as the Secretary considers necessary to standardize deployed cybersecurity ap- plications, products, and sensors and the routing of data laterally and vertically from Department of Defense Information Network segments and tiers, to enable standard and comprehensive metadata collection; ‘‘(C) develop an enterprise-wide architecture and strategy for— ‘‘(i) where to place sensors or extract data from network information technology, operational technology, and cybersecurity appliances, appli- cations, products, and systems for cybersecurity purposes; ‘‘(ii) which metadata data records should be universally sent to Big Data Platform instances and which metadata data records, if any, should be locally retained; and ‘‘(iii) expeditiously and efficiently transmitting metadata records to the Big Data Platform in- stances, including the acquisition and installa- tion of further data bandwidth; ‘‘(D) determine the appropriate number, organiza- tion, and functions of separate Big Data Platform instances, and whether the Big Data Platform in- stances that are currently managed by Department of Defense components, including the military serv- ices, should instead be jointly and regionally orga- nized, or terminated; ‘‘(E) determine the appropriate roles of the De- fense Information Systems Agency’s Acropolis, United States Cyber Command’s Scarif, and any similar Big Data Platforms as enterprise-wide real- time cybersecurity situational awareness capabili- ties or as complements or replacements for compo- nent level Big Data Platform instances; ‘‘(F) ensure that all Big Data Platform instances are engineered and approved to enable standard ac- cess and expeditious query capabilities by the Uni- fied Platform, the network defense service pro- viders, and the Cyber Mission Forces, with cen- trally managed authentication and authorization services; ‘‘(G) prohibit and remove barriers to information sharing, distributed query, data analysis, and col- laboration across Big Data Platform instances, such as incompatible interfaces, interconnection service agreements, and the imposition of accredi- tation boundaries; ‘‘(H) transition all Big Data Platform instances to a cloud computing environment in alignment with the cloud strategy of the Chief Information Of- ficer of the Department of Defense; ‘‘(I) consider whether packet capture databases should continue to be maintained separately from the Big Data Platform instances, managed at the secret level of classification, and treated as malware-infected when the packet data are copies of packets extant in the Department of Defense In- formation Network; ‘‘(J) in the case that the Secretary decides to sus- tain the status quo on packet capture databases, ensure that analysts operating on or from the Uni- fied Platform, the Big Data Platform instances, the network defense services providers, and the Cyber Mission Forces can directly access packets and query the database; and ‘‘(K) consider whether the Joint Artificial Intel- ligence Center’s cybersecurity artificial intel- ligence national mission initiative, and any other similar initiatives, should include an application for the metadata residing in the Big Data Platform instances. ‘‘(c) LIMIT ON DATA AND DATA INDEXING SCHEMA.—The Secretary shall ensure that the Unified Platform and the Big Data Platform programs achieve data and data indexing schema standardization and integration to en- sure interoperability, access, and sharing by and be- tween Big Data Platform and other data sources and stores. ‘‘(d) ANALYTICS AND APPLICATION SOURCING AND COL- LABORATION.—The Secretary shall ensure that the serv- ices, U.S. Cyber Command, and Defense Information Systems Agency— ‘‘(1) seek advanced analytics and applications from Government and commercial sources that can be exe- cuted on the deployed Big Data Platform architec- ture; and ‘‘(2) collaborate with vendors offering commercial analytics and applications, including support to re- factoring commercial capabilities to the Government platform where industry can still own the intellec- tual property embedded in the analytics and applica- tions. ‘‘(e) BRIEFING REQUIRED.—Not later than 180 days after the date of the enactment of this Act [Dec. 20, 2019] and not less frequently than once every 180 days thereafter until the activities required by subsection (a)(1) are completed, the Secretary shall brief the con- gressional defense committees [Committees on Armed Services and Appropriations of the Senate and the House of Representatives] on the activities of the Sec- retary in carrying out subsection (b). ‘‘(f) APPLICABILITY.—The requirements of this section shall apply in full to the Department of the Navy, in- cluding the Sharkcage and associated programs.’’ Page 2797 TITLE 10—ARMED FORCES § 4571 [Reference to Joint Artificial Intelligence Center, re- ferred to in subsec. (b)(2)(K) of section 1651 of Pub. L. 116–92, set out above, deemed to refer to the office of the official designated under section 238(b) of Pub. L. 115–232, see section 212(m) of Pub. L. 117–263, set out as a note preceding section 4061 of this title (in a brack- eted note following section 238 of Pub. L. 115–232).] POLICY REGARDING THE TRANSITION OF DATA AND APPLICATIONS TO THE CLOUD Pub. L. 116–92, div. A, title XVII, § 1755, Dec. 20, 2019, 133 Stat. 1854, provided that: ‘‘(a) POLICY REQUIRED.—Not later than 180 days after the date of the enactment of this Act [Dec. 20, 2019], the Chief Information Officer of the Department of Defense and the Chief Data Officer of the Department shall, in consultation with the J6 of the Joint Staff and the Chief Management Officer, develop and issue enter- prise-wide policy and implementing instructions re- garding the transition of data and applications to the cloud under the Department cloud strategy in accord- ance with subsection (b). ‘‘(b) DESIGN.—The policy required by subsection (a) shall be designed to dramatically improve support to operational missions and management processes, in- cluding by the use of artificial intelligence and ma- chine learning technologies, by— ‘‘(1) making the data of the Department available to support new types of analyses; ‘‘(2) preventing, to the maximum extent prac- ticable, the replication in the cloud of data stores that cannot readily be accessed by applications for which the data stores were not originally engineered; ‘‘(3) ensuring that data sets can be readily discov- ered and combined with others to enable new insights and capabilities; and ‘‘(4) ensuring that data and applications are readily portable and not tightly coupled to a specific cloud infrastructure or platform.’’ IMPLEMENTATION OF RECOMMENDATIONS OF THE FINAL REPORT OF THE DEFENSE SCIENCE BOARD TASK FORCE ON THE DESIGN AND ACQUISITION OF SOFTWARE FOR DEFENSE SYSTEMS Pub. L. 115–232, div. A, title VIII, § 868, Aug. 13, 2018, 132 Stat. 1902, provided that: ‘‘(a) IMPLEMENTATION REQUIRED.—Not later than 18 months after the date of the enactment of this Act [Aug. 13, 2018], the Secretary of Defense shall, except as provided under subsection (b), commence implementa- tion of each recommendation submitted as part of the final report of the Defense Science Board Task Force on the Design and Acquisition of Software for Defense Systems. ‘‘(b) EXCEPTIONS.— ‘‘(1) DELAYED IMPLEMENTATION.—The Secretary of Defense may commence implementation of a rec- ommendation described under subsection (a) later than the date required under such subsection if the Secretary provides the congressional defense commit- tees [Committees on Armed Services and Appropria- tions of the Senate and the House of Representatives] with a specific justification for the delay in imple- mentation of such recommendation. ‘‘(2) NONIMPLEMENTATION.—The Secretary of De- fense may opt not to implement a recommendation described under subsection (a) if the Secretary pro- vides to the congressional defense committees— ‘‘(A) the reasons for the decision not to imple- ment the recommendation; and ‘‘(B) a summary of the alternative actions the Secretary plans to take to address the purposes un- derlying the recommendation. ‘‘(c) IMPLEMENTATION PLANS.—For each recommenda- tion that the Secretary is implementing, or that the Secretary plans to implement, the Secretary shall sub- mit to the congressional defense committees— ‘‘(1) a summary of actions that have been taken to implement the recommendation; and ‘‘(2) a schedule, with specific milestones, for com- pleting the implementation of the recommendation.’’ ACTIVITIES AND REPORTING RELATING TO DEPARTMENT OF DEFENSE’S CLOUD INITIATIVE Pub. L. 115–232, div. A, title X, § 1064, Aug. 13, 2018, 132 Stat. 1971, provided that: ‘‘(a) ACTIVITIES REQUIRED.—Commencing not later than 90 days after the date of the enactment of this Act [Aug. 13, 2018], the Chief Information Officer of the De- partment of Defense, acting through the Cloud Execu- tive Steering Group established by the Deputy Sec- retary of Defense in a directive memorandum dated September 13, 2017, in order to support its Joint Enter- prise Defense Infrastructure initiative to procure com- mercial cloud services, shall conduct certain key ena- bling activities as follows: ‘‘(1) Develop an approach to rapidly acquire ad- vanced commercial network capabilities, including software-defined networking, on-demand bandwidth, and aggregated cloud access gateways, through com- mercial service providers in order— ‘‘(A) to support the migration of applications and systems to commercial cloud platforms; ‘‘(B) to increase visibility of end-to-end perform- ance to enable and enforce service level agreements for cloud services; ‘‘(C) to ensure efficient and common cloud access; ‘‘(D) to facilitate shifting data and applications from one cloud platform to another; ‘‘(E) to improve cybersecurity; and ‘‘(F) to consolidate networks and achieve effi- ciencies and improved performance; ‘‘(2) Conduct an analysis of existing workloads that would be migrated to the Joint Enterprise Defense Infrastructure, including— ‘‘(A) identifying all of the cloud initiatives across the Department of Defense, and determining the ob- jectives of such initiatives in connection with the intended scope of the Infrastructure; ‘‘(B) identifying all the systems and applications that the Department would intend to migrate to the Infrastructure; ‘‘(C) conducting rationalization of applications to identify applications and systems that may dupli- cate the processing of workloads in connection with the Infrastructure; and ‘‘(D) as result of such actions, arriving at disposi- tions about migration or termination of systems and applications in connection with the Infrastruc- ture. ‘‘(b) REPORT REQUIRED.—The Chief Information Offi- cer shall submit to the congressional defense commit- tees [Committees on Armed Services and Appropria- tions of the Senate and the House of Representatives] a report on the Department of Defense’s Cloud Initia- tive to manage networks, data centers, and clouds at the enterprise level. Such report shall include each of the following: ‘‘(1) A description [of] the status of completion of the activities required under subsection (a). ‘‘(2) Information relating to the current composi- tion of the Cloud Executive Steering Group and the stakeholders relating to the Department of Defense’s Cloud Initiative and associated mission, objectives, goals, and strategy. ‘‘(3) A description of the characteristics and consid- erations for accelerating the cloud architecture and services required for a global, resilient, and secure in- formation environment. ‘‘(4) Information relating to acquisition strategies and timeline for efforts associated with the Depart- ment of Defense’s Cloud Initiative, including the Joint Enterprise Defense Infrastructure. ‘‘(5) A description of how the acquisition strategies referred to in paragraph (4) provides [sic] for a full and open competition, enable the Department of De- fense to continuously leverage and acquire new cloud computing capabilities, maintain the ability of the Department to leverage other cloud computing ven- Page 2798 TITLE 10—ARMED FORCES § 4571 dor products and services, incorporate elements to maintain security, and provide for the best perform- ance, cost, and schedule to meet the cloud architec- ture and services requirements of the Department for the duration of such contract. ‘‘(6) A detailed description of existing workloads that will be migrated to enterprise-wide cloud infra- structure or platforms as a result of the Department of Defense’s Cloud Initiative, including estimated mi- gration costs and timelines, based on the analysis re- quired under subsection (a)(2). ‘‘(7) A description of the program management and program office of the Department of Defense’s Cloud Initiative, including the number of personnel, over- head costs, and organizational structure. ‘‘(8) A description of the effect of the Joint Enter- prise Defense Infrastructure on and the relationship of such Infrastructure to existing cloud computing infrastructure, platform, and service contracts across the Department of Defense, specifically the effect and relationship to the private cloud infrastructure of the Department, MilCloud 2.0 run by the Defense Infor- mation Systems Agency based on the analysis re- quired under subsection (a)(2). ‘‘(9) Information relating to the most recent De- partment of Defense Cloud Computing Strategy and description of any initiatives to update such Strat- egy. ‘‘(10) Information relating to Department of De- fense guidance pertaining to cloud computing capa- bility or platform acquisition and standards, and a description of any initiatives to update such guid- ance. ‘‘(11) Any other matters the Secretary of Defense determines relevant. ‘‘(c) LIMITATION ON USE OF FUNDS.—Of the amounts authorized to be appropriated or otherwise made avail- able by this Act [see Tables for classification] for fiscal year 2019 for the Department of Defense’s Cloud Initia- tive, not more than 85 percent may be obligated or ex- pended until the Secretary of Defense submits to the congressional defense committees the report required by subsection (b). ‘‘(d) LIMITATION ON NEW SYSTEMS AND APPLICA- TIONS.— ‘‘(1) IN GENERAL.—Except as provided in paragraph (2), the Deputy Secretary shall require that no new system or application will be approved for develop- ment or modernization without an assessment that such system or application is already, or can and would be, cloud-hosted. ‘‘(2) WAIVER.—The Deputy Secretary may issue a national waiver to the requirement under paragraph (1) if the Deputy Secretary determines, pursuant to the assessment described in such paragraph, that the requirement would adversely affect the national se- curity of the United States. If the Deputy Secretary issues a waiver under this paragraph, the Deputy Sec- retary shall provide to the congressional defense committees a written notification of such waiver, justification for the waiver, and identification of the system or application to which the waiver applies by not later than 15 days after the date on which the waiver is issued. ‘‘(e) TRANSPARENCY AND COMPETITION.—The Deputy Secretary shall ensure that the acquisition approach of the Department continues to follow the Federal Acqui- sition Regulation with respect to competition.’’ PILOT PROGRAM TO USE AGILE OR ITERATIVE DEVELOP- MENT METHODS TO TAILOR MAJOR SOFTWARE-INTEN- SIVE WARFIGHTING SYSTEMS AND DEFENSE BUSINESS SYSTEMS Pub. L. 115–232, div. A, title VIII, § 869(a)–(d), Aug. 13, 2018, 132 Stat. 1902, 1903, provided that the Secretary of Defense was to include certain systems in the pilot pro- gram to use agile or iterative development methods pursuant to section 873 of Pub. L. 115–91, formerly set out below. Pub. L. 115–91, div. A, title VIII, § 873, Dec. 12, 2017, 131 Stat. 1498, as amended by Pub. L. 115–232, div. A, title VIII, § 869(e), Aug. 13, 2018, 132 Stat. 1903, provided that the Secretary of Defense was to establish a pilot pro- gram to tailor and simplify software development re- quirements and methods for major software-intensive warfighting systems and defense business systems, and that such pilot program would terminate on Sept. 30, 2023. GLOBAL THEATER SECURITY COOPERATION MANAGEMENT INFORMATION SYSTEM Pub. L. 115–91, div. A, title XII, § 1272, Dec. 12, 2017, 131 Stat. 1695, provided that: ‘‘(a) UPDATE OF GUIDANCE.— ‘‘(1) IN GENERAL.—Not later than 180 days after the date of the enactment of this Act [Dec. 12, 2017], the Secretary of Defense shall— ‘‘(A) update relevant security cooperation guid- ance issued by the Secretary for use of the Global Theater Security Cooperation Management Infor- mation System (in this section referred to as ‘G- TSCMIS’), including guidance relating to the mat- ters described in paragraph (3); and ‘‘(B) submit to the congressional defense commit- tees [Committees on Armed Services and Appro- priations of the Senate and the House of Represent- atives] a report that contains such guidance. ‘‘(2) SUCCESSOR SYSTEM.—Not later than 180 days after the date of the adoption of any security co- operation information system that is a successor to G-TSCMIS, the Secretary of Defense shall— ‘‘(A) update relevant security cooperation guid- ance issued by the Secretary for use of such system, including guidance relating to the matters de- scribed in paragraph (3); and ‘‘(B) submit to the congressional defense commit- tees a report that contains such guidance. ‘‘(3) MATTERS DESCRIBED.—The matters described in this paragraph are the following: ‘‘(A) Designation of an authoritative data reposi- tory for security cooperation information, with en- forceable data standards and data controls. ‘‘(B) Responsibilities for entry of data relating to programs and activities into the system. ‘‘(C) Oversight and accountability measures to ensure the full scope of activities are entered into the system consistently and in a timely manner. ‘‘(D) Such other matters as the Secretary con- siders appropriate. ‘‘(b) REPORT.— ‘‘(1) IN GENERAL.—Not later than 270 days after the adoption of any security cooperation information system that is the successor to G-TSCMIS, the Sec- retary of Defense shall submit to the congressional defense committees [Committees on Armed Services and Appropriations of the Senate and the House of Representatives] a report setting forth a review of measures for evaluating the system in order to com- ply with guidance required by subsection (a). ‘‘(2) ELEMENTS.—The review required by paragraph (1) shall include the following: ‘‘(A) An evaluation of the impacts of inconsistent information on the system’s functionality as a tool for planning, resource allocation, and adjustment. ‘‘(B) An evaluation of the effectiveness of over- sight and accountability measures. ‘‘(C) An evaluation of feedback from the oper- ational community to inform future requirements. ‘‘(D) Such other matters as the Secretary con- siders appropriate. ‘‘(3) FORM.—The report required under paragraph (1) shall be submitted in unclassified form, but may in- clude a classified annex.’’ OPERATIONAL METRICS FOR JOINT INFORMATION ENVIRONMENT AND SUPPORTING ACTIVITIES Pub. L. 113–291, div. A, title VIII, § 854, Dec. 19, 2014, 128 Stat. 3459, provided that: ‘‘(a) GUIDANCE.—Not later than 180 days after the date of the enactment of this Act [Dec. 19, 2014], the Sec- Page 2799 TITLE 10—ARMED FORCES § 4571 retary of Defense, acting through the Chief Information Officer of the Department of Defense, shall issue guid- ance for measuring the operational effectiveness and efficiency of the Joint Information Environment with- in the military departments, Defense Agencies, and combatant commands. The guidance shall include a definition of specific metrics for data collection, and a requirement for each military department, Defense Agency, and combatant command to regularly collect and assess data on such operational effectiveness and efficiency and report the results to such Chief Informa- tion Officer on a regular basis. ‘‘(b) BASELINE ARCHITECTURE.—The Chief Information Officer of the Department of Defense shall identify a baseline architecture for the Joint Information Envi- ronment by identifying and reporting to the Secretary of Defense any information technology programs or other investments that support that architecture. ‘‘(c) JOINT INFORMATION ENVIRONMENT DEFINED.—In this section, the term ‘Joint Information Environment’ means the initiative of the Department of Defense to modernize the information technology networks and systems within the Department.’’ DATA SERVERS AND CENTERS Pub. L. 112–81, div. B, title XXVIII, § 2867, Dec. 31, 2011, 125 Stat. 1704, as amended by Pub. L. 112–239, div. B, title XXVIII, § 2853, Jan. 2, 2013, 126 Stat. 2161; Pub. L. 115–91, div. A, title X, § 1051(q)(3), Dec. 12, 2017, 131 Stat. 1565, provided that: ‘‘(a) LIMITATIONS ON OBLIGATION OF FUNDS.— ‘‘(1) LIMITATIONS.— ‘‘(A) BEFORE PERFORMANCE PLAN.—During the pe- riod beginning on the date of the enactment of this Act [Dec. 31, 2011] and ending on May 1, 2012, a de- partment, agency, or component of the Department of Defense may not obligate funds for a data server farm or data center unless approved by the Chief Information Officer of the Department of Defense or the Chief Information Officer of a component of the Department to whom the Chief Information Of- ficer of the Department has specifically delegated such approval authority. ‘‘(B) UNDER PERFORMANCE PLAN.—After May 1, 2012, a department, agency, or component of the De- partment may not obligate funds for a data center, or any information systems technology used there- in, unless that obligation is in accordance with the performance plan required by subsection (b) and is approved as described in subparagraph (A). ‘‘(2) REQUIREMENTS FOR APPROVALS.— ‘‘(A) BEFORE PERFORMANCE PLAN.—An approval of the obligation of funds may not be granted under paragraph (1)(A) unless the official granting the ap- proval determines, in writing, that existing re- sources of the agency, component, or element con- cerned cannot affordably or practically be used or modified to meet the requirements to be met through the obligation of funds. ‘‘(B) UNDER PERFORMANCE PLAN.—An approval of the obligation of funds may not be granted under paragraph (1)(B) unless the official granting the ap- proval determines that— ‘‘(i) existing resources of the Department do not meet the operation requirements to be met through the obligation of funds; and ‘‘(ii) the proposed obligation is in accordance with the performance standards and measures es- tablished by the Chief Information Officer of the Department under subsection (b). ‘‘(3) REPORTS.—Not later than 30 days after the end of each calendar quarter, each Chief Information Offi- cer of a component of the Department who grants an approval under paragraph (1) during such calendar quarter shall submit to the Chief Information Officer of the Department a report on the approval or ap- provals so granted during such calendar quarter. ‘‘(b) PERFORMANCE PLAN FOR REDUCTION OF RE- SOURCES REQUIRED FOR DATA SERVERS AND CENTERS.— ‘‘(1) COMPONENT PLANS.— ‘‘(A) IN GENERAL.—Not later than January 15, 2012, the Secretaries of the military departments and the heads of the Defense Agencies shall each submit to the Chief Information Officer of the De- partment a plan for the department or agency con- cerned to achieve the following: ‘‘(i) A reduction in the square feet of floor space devoted to information systems technologies, at- tendant support technologies, and operations within data centers. ‘‘(ii) A reduction in the use of all utilities nec- essary to power and cool information systems technologies and data centers. ‘‘(iii) An increase in multi-organizational utili- zation of data centers, information systems tech- nologies, and associated resources. ‘‘(iv) A reduction in the investment for capital infrastructure or equipment required to support data centers as measured in cost per megawatt of data storage. ‘‘(v) A reduction in the number of commercial and government developed applications running on data servers and within data centers. ‘‘(vi) A reduction in the number of government and vendor provided full-time equivalent per- sonnel, and in the cost of labor, associated with the operation of data servers and data centers. ‘‘(B) SPECIFICATION OF REQUIRED ELEMENTS.—The Chief Information Officer of the Department shall specify the particular performance standards and measures and implementation elements to be in- cluded in the plans submitted under this paragraph, including specific goals and schedules for achieving the matters specified in subparagraph (A). ‘‘(2) DEFENSE-WIDE PLAN.— ‘‘(A) IN GENERAL.—Not later than April 1, 2012, the Chief Information Officer of the Department shall submit to the congressional defense committees [Committees on Armed Services and Appropriations of the Senate and the House of Representatives] a performance plan for a reduction in the resources required for data centers and information systems technologies Department-wide. The plan shall be based upon and incorporate appropriate elements of the plans submitted under paragraph (1). ‘‘(B) ELEMENTS.—The performance plan required under this paragraph shall include the following: ‘‘(i) A Department-wide performance plan for achieving the matters specified in paragraph (1)(A), including performance standards and measures for data centers and information sys- tems technologies, goals and schedules for achiev- ing such matters, and an estimate of cost savings anticipated through implementation of the plan. ‘‘(ii) A Department-wide strategy for each of the following: ‘‘(I) Desktop, laptop, and mobile device virtualization. ‘‘(II) Transitioning to cloud computing. ‘‘(III) Migration of Defense data and govern- ment-provided services from Department-owned and operated data centers to cloud computing services generally available within the private sector that provide a better capability at a lower cost with the same or greater degree of security. ‘‘(IV) Utilization of private sector-managed security services for data centers and cloud computing services. ‘‘(V) A finite set of metrics to accurately and transparently report on data center infrastruc- ture (space, power and cooling): age, cost, ca- pacity, usage, energy efficiency and utilization, accompanied with the aggregate data for each data center site in use by the Department in ex- cess of 100 kilowatts of information technology power demand. ‘‘(VI) Transitioning to just-in-time delivery of Department-owned data center infrastructure (space, power and cooling) through use of mod- Page 2800 TITLE 10—ARMED FORCES § 4571 ular data center technology and integrated data center infrastructure management software. ‘‘(3) RESPONSIBILITY.—The Chief Information Officer of the Department shall discharge the responsibility for establishing performance standards and measures for data centers and information systems tech- nologies for purposes of this subsection. Such respon- sibility may not be delegated. ‘‘(c) EXCEPTIONS.— ‘‘(1) INTELLIGENCE COMPONENTS.—The Chief Informa- tion Officer of the Department and the Chief Informa- tion Officer of the Intelligence Community may jointly exempt from the applicability of this section such intelligence components of the Department of Defense (and the programs and activities thereof) that are funded through the National Intelligence Program (NIP) as the Chief Information Officers con- sider appropriate. ‘‘(2) RESEARCH, DEVELOPMENT, TEST, AND EVALUA- TION PROGRAMS.—The Chief Information Officer of the Department may exempt from the applicability of this section research, development, test, and evalua- tion programs that use authorization of appropria- tions for the High Performance Computing Mod- ernization Program (Program Element 0603461A) if the Chief Information Officer determines that the ex- emption is in the best interest of national security.’’ DEMONSTRATION AND PILOT PROJECTS ON CYBERSECURITY Pub. L. 111–383, div. A, title II, § 215, Jan. 7, 2011, 124 Stat. 4165, provided that: ‘‘(a) DEMONSTRATION PROJECTS ON PROCESSES FOR AP- PLICATION OF COMMERCIAL TECHNOLOGIES TO CYBERSECURITY REQUIREMENTS.— ‘‘(1) PROJECTS REQUIRED.—The Secretary of Defense and the Secretaries of the military departments shall jointly carry out demonstration projects to assess the feasibility and advisability of using various busi- ness models and processes to rapidly and effectively identify innovative commercial technologies and apply such technologies to Department of Defense and other cybersecurity requirements. ‘‘(2) SCOPE OF PROJECTS.—Any demonstration project under paragraph (1) shall be carried out in such a manner as to contribute to the cyber policy review of the President and the Comprehensive Na- tional Cybersecurity Initiative. ‘‘(b) PILOT PROGRAMS ON CYBERSECURITY REQUIRED.— The Secretary of Defense shall support or conduct pilot programs on cybersecurity with respect to the fol- lowing areas: ‘‘(1) Threat sensing and warning for information networks worldwide. ‘‘(2) Managed security services for cybersecurity within the defense industrial base, military depart- ments, and combatant commands. ‘‘(3) Use of private processes and infrastructure to address threats, problems, vulnerabilities, or oppor- tunities in cybersecurity. ‘‘(4) Processes for securing the global supply chain. ‘‘(5) Processes for threat sensing and security of cloud computing infrastructure. ‘‘(c) REPORTS.— ‘‘(1) REPORTS REQUIRED.—Not later than 240 days after the date of the enactment of this Act [Jan. 7, 2011], and annually thereafter at or about the time of the submittal to Congress of the budget of the Presi- dent for a fiscal year (as submitted pursuant to sec- tion 1105(a) of title 31, United States Code), the Sec- retary of Defense shall, in coordination with the Sec- retary of Homeland Security, submit to Congress a report on any demonstration projects carried out under subsection (a), and on the pilot projects carried out under subsection (b), during the preceding year. ‘‘(2) ELEMENTS.—Each report under this subsection shall include the following: ‘‘(A) A description and assessment of any activi- ties under the demonstration projects and pilot projects referred to in paragraph (1) during the pre- ceding year. ‘‘(B) For the pilot projects supported or con- ducted under subsection (b)(2)— ‘‘(i) a quantitative and qualitative assessment of the extent to which managed security services covered by the pilot project could provide effec- tive and affordable cybersecurity capabilities for components of the Department of Defense and for entities in the defense industrial base, and an as- sessment whether such services could be expanded rapidly to a large scale without exceeding the ability of the Federal Government to manage such expansion; and ‘‘(ii) an assessment of whether managed secu- rity services are compatible with the cybersecurity strategy of the Department of De- fense with respect to conducting an active, in- depth defense under the direction of United States Cyber Command. ‘‘(C) For the pilot projects supported or conducted under subsection (b)(3)— ‘‘(i) a description of any performance metrics established for purposes of the pilot project, and a description of any processes developed for pur- poses of accountability and governance under any partnership under the pilot project; and ‘‘(ii) an assessment of the role a partnership such as a partnership under the pilot project would play in the acquisition of cyberspace capa- bilities by the Department of Defense, including a role with respect to the development and ap- proval of requirements, approval and oversight of acquiring capabilities, test and evaluation of new capabilities, and budgeting for new capabilities. ‘‘(D) For the pilot projects supported or con- ducted under subsection (b)(4)— ‘‘(i) a framework and taxonomy for evaluating practices that secure the global supply chain, as well as practices for securely operating in an un- certain or compromised supply chain; ‘‘(ii) an assessment of the viability of applying commercial practices for securing the global sup- ply chain; and ‘‘(iii) an assessment of the viability of applying commercial practices for securely operating in an uncertain or compromised supply chain. ‘‘(E) For the pilot projects supported or con- ducted under subsection (b)(5)— ‘‘(i) an assessment of the capabilities of Federal Government providers to offer secure cloud com- puting environments; and ‘‘(ii) an assessment of the capabilities of com- mercial providers to offer secure cloud computing environments to the Federal Government. ‘‘(3) FORM.—Each report under this subsection shall be submitted in unclassified form, but may include a classified annex.’’ IMPLEMENTATION OF NEW ACQUISITION PROCESS FOR INFORMATION TECHNOLOGY SYSTEMS Pub. L. 111–84, div. A, title VIII, § 804, Oct. 28, 2009, 123 Stat. 2402, which provided for development and imple- mentation of a new acquisition process for information technology systems, was repealed by Pub. L. 115–232, div. A, title VIII, § 812(b)(2), Aug. 13, 2018, 132 Stat. 1848. CLEARINGHOUSE FOR RAPID IDENTIFICATION AND DIS- SEMINATION OF COMMERCIAL INFORMATION TECH- NOLOGIES Pub. L. 110–181, div. A, title VIII, § 881, Jan. 28, 2008, 122 Stat. 262, provided that: ‘‘(a) REQUIREMENT TO ESTABLISH CLEARINGHOUSE.— Not later than 180 days after the date of the enactment of this Act [Jan. 28, 2008], the Secretary of Defense, act- ing through the Assistant Secretary of Defense for Net- works and Information Integration, shall establish a clearinghouse for identifying, assessing, and dissemi- nating knowledge about readily available information technologies (with an emphasis on commercial off-the- shelf information technologies) that could support the warfighting mission of the Department of Defense. Page 2801 TITLE 10—ARMED FORCES § 4576 ‘‘(b) RESPONSIBILITIES.—The clearinghouse estab- lished pursuant to subsection (a) shall be responsible for the following: ‘‘(1) Developing a process to rapidly assess and set priorities and needs for significant information tech- nology needs of the Department of Defense that could be met by commercial technologies, including a proc- ess for— ‘‘(A) aligning priorities and needs with the re- quirements of the commanders of the combatant command; and ‘‘(B) proposing recommendations to the com- manders of the combatant command of feasible technical solutions for further evaluation. ‘‘(2) Identifying and assessing emerging commercial technologies (including commercial off-the-shelf technologies) that could support the warfighting mis- sion of the Department of Defense, including the pri- orities and needs identified pursuant to paragraph (1). ‘‘(3) Disseminating information about commercial technologies identified pursuant to paragraph (2) to commanders of combatant commands and other po- tential users of such technologies. ‘‘(4) Identifying gaps in commercial technologies and working to stimulate investment in research and development in the public and private sectors to ad- dress those gaps. ‘‘(5) Enhancing internal data and communications systems of the Department of Defense for sharing and retaining information regarding commercial tech- nology priorities and needs, technologies available to meet such priorities and needs, and ongoing research and development directed toward gaps in such tech- nologies. ‘‘(6) Developing mechanisms, including web-based mechanisms, to facilitate communications with in- dustry regarding the priorities and needs of the De- partment of Defense identified pursuant to paragraph (1) and commercial technologies available to address such priorities and needs. ‘‘(7) Assisting in the development of guides to help small information technology companies with prom- ising technologies to understand and navigate the funding and acquisition processes of the Department of Defense. ‘‘(8) Developing methods to measure how well proc- esses developed by the clearinghouse are being uti- lized and to collect data on an ongoing basis to assess the benefits of commercial technologies that are pro- cured on the recommendation of the clearinghouse. ‘‘(c) PERSONNEL.—The Secretary of Defense, acting through the Assistant Secretary of Defense for Net- works and Information Integration, shall provide for the hiring and support of employees (including detailees from other components of the Department of Defense and from other Federal departments or agen- cies) to assist in identifying, assessing, and dissemi- nating information regarding commercial technologies under this section. ‘‘(d) REPORT TO CONGRESS.—Not later than one year after the date of the enactment of this Act [Jan. 28, 2008], the Secretary of Defense shall submit to the con- gressional defense committees [Committees on Armed Services and Appropriations of the Senate and the House of Representatives] a report on the implementa- tion of this section.’’ IMPROVEMENT OF SOFTWARE ACQUISITION PROCESSES Pub. L. 107–314, div. A, title VIII, § 804, Dec. 2, 2002, 116 Stat. 2604, provided that: ‘‘(a) ESTABLISHMENT OF PROGRAMS.—(1) The Secretary of each military department shall establish a program to improve the software acquisition processes of that military department. ‘‘(2) The head of each Defense Agency that manages a major defense acquisition program with a substantial software component shall establish a program to im- prove the software acquisition processes of that De- fense Agency. ‘‘(3) The programs required by this subsection shall be established not later than 120 days after the date of the enactment of this Act [Dec. 2, 2002]. ‘‘(b) PROGRAM REQUIREMENTS.—A program to improve software acquisition processes under this section shall, at a minimum, include the following: ‘‘(1) A documented process for software acquisition planning, requirements development and manage- ment, project management and oversight, and risk management. ‘‘(2) Efforts to develop appropriate metrics for per- formance measurement and continual process im- provement. ‘‘(3) A process to ensure that key program per- sonnel have an appropriate level of experience or training in software acquisition. ‘‘(4) A process to ensure that each military depart- ment and Defense Agency implements and adheres to established processes and requirements relating to the acquisition of software. ‘‘(c) DEPARTMENT OF DEFENSE GUIDANCE.—The Assist- ant Secretary of Defense for Command, Control, Com- munications, and Intelligence, in consultation with the Under Secretary of Defense for Acquisition, Tech- nology, and Logistics, shall— ‘‘(1) prescribe uniformly applicable guidance for the administration of all of the programs established under subsection (a) and take such actions as are nec- essary to ensure that the military departments and Defense Agencies comply with the guidance; and ‘‘(2) assist the Secretaries of the military depart- ments and the heads of the Defense Agencies to carry out such programs effectively by— ‘‘(A) ensuring that the criteria applicable to the selection of sources provides added emphasis on past performance of potential sources, as well as on the maturity of the software products offered by the potential sources; and ‘‘(B) identifying, and serving as a clearinghouse for information regarding, best practices in soft- ware development and acquisition in both the pub- lic and private sectors. ‘‘(d) DEFINITIONS.—In this section: ‘‘(1) The term ‘Defense Agency’ has the meaning given the term in section 101(a)(11) of title 10, United States Code. ‘‘(2) The term ‘major defense acquisition program’ has the meaning given such term in section 139(a)(2)(B) of title 10, United States Code.’’ § 4576. Requirement for consideration of certain matters during acquisition of noncommercial computer software (a) CONSIDERATION REQUIRED.—As part of any negotiation for the acquisition of noncommer- cial computer software, the Secretary of Defense shall ensure that such negotiations consider, to the maximum extent practicable, acquisition, at the appropriate time in the life cycle of the non- commercial computer software, of all software and related materials necessary— (1) to reproduce, build, or recompile the soft- ware from original source code and required li- braries; (2) to conduct required computer software testing; and (3) to deploy working computer software sys- tem binary files on relevant system hardware. (b) DELIVERY OF SOFTWARE AND RELATED MA- TERIALS.—Any noncommercial computer soft- ware or related materials required to be deliv- ered as a result of considerations in subsection (a) shall, to the extent appropriate as deter- mined by the Secretary— (1) include computer software delivered in a useable, digital format; (2) not rely on external or additional soft- ware code or data, unless such software code