This bill requires the Secretary of Defense to set rules and build systems so the Department of Defense (DoD) can recover important data if it is lost, damaged, or destroyed. The bill defines three types of data: critical, important, and necessary. It sets deadlines for recovery time objectives and for fielding recovery capabilities. It also requires reporting, audits, and a written recovery strategy for the Department.
Key deadlines and tasks in the bill:
Required recovery capabilities and checks include immutable backups, logically separated and segmented copies of data, isolation from external networks, continuous monitoring of backup environments, annual recovery exercises simulating nation-state cyberattacks, and audits by independent groups that mimic cyberattack tactics. The bill also requires that DoD only adopt recovery technologies listed in a DoD inventory for certified cybersecurity and data protection technology, and specifies features for recovery technologies (immutable storage, robust recovery, full audit trails, continuous integrity monitoring).
The bill adds these requirements to title 10, chapter 19 of the U.S. Code and defines key terms such as "critical data," "important data," "necessary data," "data recovery capability," and "recovery time objective."
No publicly available information on total costs. The bill requires the Secretary to include the funds necessary to carry out the data recovery strategy in the strategy submission, but it does not specify dollar amounts.
The bill aims to ensure rapid, secure, and verifiable recovery of DoD data after destructive cyberattacks by setting clear recovery time goals, requiring hardened backup systems (including immutable backups), continuous monitoring, realistic exercises, and independent audits. It also creates requirements for approved technology and regular reporting to Congress.
No publicly available information.