Cybersecurity regulatory plan

(a) In general Not later than June 1, 2026, the Chief Information Officer of the Department of Defense, in coordination with the Chief Information Officer of each military department, shall submit to the congressional defense committees a plan to reduce the cybersecurity regulatory burden on the Defense Industrial Base. (b) Requirements The plan required by subsection (a) shall include— (1) a process for assessing future proposed cybersecurity contractual requirements for duplication; (2) a process for coordinating and centralizing approved cybersecurity requirements; and (3) a coordination mechanism with industry to characterize the industry position on any new cybersecurity contractual requirements, to include a cost-estimate, a cost-benefit analysis, and an assessment as to whether the control is considered duplicative to existing security controls.