The bill directs the Secretary of Defense to start an audit within 180 days to find covered cellular modules in Department of Defense systems and infrastructure. The audit must assess cybersecurity risks and, where practicable, identify each module’s manufacturer, model, firmware version, and host product. Covered modules include those from certain entities identified under existing law, entities owned or controlled by or subject to the direction of China, and other entities the Secretary finds pose an unacceptable supply-chain risk.
Within one year, and every two years for up to six years, the Secretary must report audit findings and planned or ongoing mitigation measures to congressional defense committees. Measures may include replacing modules, retiring older equipment, network controls, software or firmware fixes, and using trusted alternatives. Reports must include cost estimates and timelines. The Comptroller General must review implementation and effectiveness after the first report.
The bill focuses on Department of Defense systems, including contractor-operated systems connected to its networks or accessing its information. It does not set requirements for the general public.
The bill requires reports to include cost estimates and resource needs for mitigation measures, but it provides no actual cost figures.
No publicly available information.
No publicly available information.