House cyber panel’s NDAA draft prioritizes commercial tech, expert engagement

A key House cybersecurity panel on Monday released its legislative proposals for the fiscal year 2024 National Defense Authorization Act, laying out a series of steps for the Department of Defense to enhance its cyber capabilities and reorient its internal strategies and management to help drive the development and use of innovative technologies. 

The draft bill from the House Armed Services Subcommittee on Cyber, Information Technologies and Innovation — released ahead of the panel’s planned markup on Tuesday — emphasizes the development of new pilot programs, strategies and studies to drive DOD’s acceptance of next-generation products and weaponry, while also promoting a more comprehensive review of the Pentagon’s cybersecurity initiatives. 

Organizational changes, efforts to scale innovation

Among the panel’s legislative proposals are several efforts to restructure the Pentagon’s management and internal reporting structure to better engage with the commercial technology sector. 

The bill, in part, proposed codifying the director of the Defense Innovation Unit’s elevation to report directly to Defense Secretary Lloyd Austin. Austin previously announced in an April 4 memo that the DIU director would be “under the authority, direction and control of the Secretary of Defense,” rather than reporting to the undersecretary of defense for research and engineering. 

Under the legislative proposal, Austin would also be required to evaluate the DIU’s workforce “to determine if the unit is sufficiently staffed to achieve its objectives,” and then submit a report to Congress within 180 days of the NDAA’s enactment outlining a plan to remediate any identified funding or staffing shortfalls. 

The position of undersecretary of defense for research and engineering would, in turn, be changed to undersecretary of defense for technology integration and innovation, with a new focus on “integrating commercial technology” across the Pentagon. 

The panel’s proposed NDAA provisions would also create and expand innovative programs to help the Pentagon more readily embrace the use of emerging technologies.

The bill would, in part, establish a “near-term quantum computing applications pilot program” at DOD, to be launched in coordination with the quantum industry and a to-be-named federally funded research and development center, or FFRDC. The provision would require lawmakers to receive a briefing “on the selection of an FFRDC and the methodology and plan for establishing this pilot program” by March 1, 2024, as well as annual reports detailing “the status of the pilot program, problem sets explored and an analysis of the findings of pilot program engagements.”

Additionally, the proposal called for a roughly four-year extension of DOD’s domestic investment pilot program under the Small Business Innovation Research program “to allow contracts to expand the pool of potential investors.”

DOD officials would also be directed to report to the full House Armed Services Committee on the implementation status of the Pentagon’s artificial intelligence education strategy, as well as the department’s requirements for data services used to support its AI and machine learning capabilities.

Additional scrutiny, manpower for cyber initiatives

The panel’s legislation also emphasized more engagement between DOD and private sector cybersecurity experts, while also prioritizing work to identify potential cyber vulnerabilities across the department and ensure that the Pentagon is transparent about its ongoing threat mitigation initiatives by requiring briefings from department officials. 

One provision would establish an “Academic Engagement Office for Cyber” — under the authority of DOD’s chief information officer — that would be tasked with establishing and maintaining the Pentagon’s “relationship with academia, to include those entities involved in primary, secondary and post-secondary education.”

The bill would also give the Pentagon and the department’s military services the legal authority “to accept voluntary and uncompensated services from civilian cybersecurity experts to train service members on technical matters.” The provision noted that it would “solidify the legal basis” for the Marine Corps Cyber Auxiliary program — which provides a formal process for such voluntary services — while also enabling other branches to establish similar cyber auxiliary programs. 

Additionally, the legislation would also require DOD officials to provide the full House Armed Services Committee and Congress with briefings and reports on a variety of cyber-specific issues. 

This includes requiring DOD’s CIO to brief the full panel on “existing gaps” in the Pentagon’s bring your own device — or BYOD — policies. While the legislation noted that the department’s BYOD programs “bring secure communications to a broader section” of its workforce, it expressed concern that limitations in the current policy “will continue to impact personnel’s ability to connect to critical back-end systems up to Impact Level 5/Controlled Unclassified Information.”

The bill also noted that DOD uses so-called cyber red teams to help “identify critical problems and improve defenders’ capabilities and decision making for operational-level cyber operations.” To address lawmakers’ concerns that these teams face challenges that include a lack of resources, personnel and “a need for automation capabilities to ease workload,” DOD’s CIO would be required to submit a report to the full committee by the end of the year detailing, in part, gaps in the teams and modernization efforts that focus “on utilizing cyber threat intelligence, threat modeling, automation, artificial intelligence/machine learning capabilities and data collection and correlation.”

The Pentagon’s CIO would also be required to brief the House committee on cybersecurity efforts designed to support the defense industrial base, with a breakdown of efforts that are “performing in an exemplary or satisfactory manner, as well as those efforts being underutilized or which are underperforming.”

DOD officials would be required to provide a briefing to the House and Senate Armed Services committees about the department’s zero trust implementation efforts, including “deployment milestones and associated timelines,” as well as how the department can better use “National Guard and Reserve forces for cyberspace activities.”