Internal base hardening assessments and logistics-node threat mitigation

(a) Definitions In this section: (1) Covered installation The term covered installation means a military installation, as defined in section 2801 of title 10, United States Code, that the Secretary of Defense designates as having significant logistics, port, intermodal, or contractor-operated interfaces with commercial transportation, warehousing, or supply chain infrastructure. (2) Covered logistics node The term covered logistics node means any of the following that is located on, adjacent to, or used in support of operations at a covered installation: (A) A strategic seaport, as defined in section 54301(a)(12)(E) of title 46, United States Code. (B) A defense access road, as described in section 210 of title 23, United States Code. (C) A node of the Defense Transportation System, as that term is defined in Department of Defense Directive 4500.09E and Joint Publication 4-01. (D) Any other logistics facility that the Secretary of Defense designates as a covered logistics node for purposes of this section. (b) Internal base hardening assessments (1) Assessment Not later than 180 days after the date of the enactment of this section, and annually thereafter for a period not to exceed three years, the Secretary of Defense shall conduct a comprehensive internal base hardening assessment of each covered installation. (2) Scope Each assessment under paragraph (1) shall examine vulnerabilities arising from— (A) commercial shipping, drayage, and trucking activity on, adjacent to, or in support of the covered installation; (B) covered logistics nodes; (C) contractor and vendor access to the covered installation, including subcontractor and vendor supply chains; (D) the pre-positioning of materiel by foreign adversaries of the United States, hostile state services, transnational organized crime groups, or terrorist organizations on or adjacent to the covered installation; and (E) opportunities for reconnaissance, sabotage, or rapid attack from within or adjacent to the perimeter of the covered installation. (3) Mitigation plans For each vulnerability identified in an assessment under paragraph (1), the Secretary of Defense shall develop and implement a risk-based mitigation plan that includes defined milestones, timelines, and performance measures. (4) Report (A) In General—Not later than 18 months after the date of the enactment of this Act, and annually thereafter for four years, the Secretary of Defense shall submit to the congressional defense committees a report describing— (i) the assessments completed under paragraph (2); (ii) the mitigation plans developed, including timelines, milestones, and performance measures, and the status of implementation of each plan; and (iii) any additional authorities or resources required. (B) Form Each report required under this section shall be submitted in unclassified form and may contain a classified annex. (5) Government accountability office review (A) In General Not later than 180 days after the date of submission of the first report described in paragraph (4), the Comptroller General of the United States shall submit a report to the congressional defense committees reviewing the assessments and mitigation plans required in paragraphs (1) and (3) of this subsection. (B) Form This report may be submitted in classified form.