Defense Supply Chain Intelligence and Risk Response Program

(a) Establishment Not later than 180 days after the date of the enactment of this Act, the Secretary of Defense, acting through the Assistant Secretary of Defense for Industrial Base Policy, shall establish a Department of Defense-wide program to be known as the Defense Supply Chain Intelligence and Risk Response Program (in this section referred to as the Program) to enhance the Department’s ability to illuminate, assess, anticipate, and respond to risks across the defense industrial base supply chain. (b) Purpose The purpose of the Program shall be to provide a coordinated, holistic framework for the Department of Defense to effectively identify and manage the risks within and across the broader defense supply chain, including risks associated with microelectronics, semiconductors, counterfeit items, diminishing manufacturing sources and material shortages, obsolescence, supply chain disruptions, cyber vulnerabilities, foreign sourced components, foreign investments, financial distress, and sourcing of critical technologies from entities within or associated with covered nations. (c) Activities The Program shall— (1) identify and characterize supplier concentration, single-point dependencies, structural vulnerabilities, and risks arising from foreign ownership, control, or influence; (2) inform Department of Defense policy and funding decisions intended to enable rapid, scalable response to supply chain vulnerabilities, including creation of stockpiles and identification of alternative domestic suppliers and surge capacity; and (3) support and inform Department of Defense efforts to reduce reliance on covered nations for supply chains essential to the national defense. (d) Implementation In implementing this section, the Assistant Secretary of Defense for Industrial Base Policy shall, in consultation with the Assistant Secretary of Defense for Sustainment and not later than 365 days after the date of the enactment of this Act— (1) perform an identification and assessment of the supply chain illumination efforts, supply chain risk management activities, and policies of the Department of Defense, along with annual funding profiles associated with such efforts, activities and policies; (2) develop a common framework across the Department of Defense and with contractors of the Department to enable a holistic and coordinated approach for identifying managing risks within defense supply chains; and (3) provide the Secretary of Defense the following: (A) Findings and recommendations based on the assessment performed under paragraph (1), including recommendations related to expansion, consolidation, or cancellation of identified supply chain illumination efforts and supply chain risk management activities. (B) A plan of action for successful implementation of the framework developed under paragraph (2). (C) Recommendations for employment of advanced data analytics and artificial intelligence capabilities or tools to support and enable Program activities, including capabilities such as— (i) mapping of multi-tier supply chains across the defense industrial base, including domestic and international supplier networks; (ii) identifying and linking entities across public records, corporate registries, trade data, and other commercial datasets to identify foreign ownership, control, or influence; (iii) highlighting supplier concentration, single-point dependencies, and other structural risk indicators; and (iv) modeling and forecasting of supply chain disruptions and economic security risks. (e) Commercial technology utilization The Secretary shall ensure that any advanced data analytics and artificial intelligence capabilities or tools to support the Program are procured— (1) in accordance with the preference for commercial products and commercial services under section 3453 of title 10, United States Code; (2) in accordance with the requirements to use competitive procedures under applicable law and the Department of Defense Supplement to the Federal Acquisition Regulation; and (3) in a manner that provides the Department with flexibility to adapt procurement strategies to Program needs, evolving market conditions, and advances in technology throughout the life of the Program. (f) Hardware and firmware assurance pilot program (1) Establishment Not later than 90 days after the date of enactment of this section, the Secretary of Defense, acting through the Assistant Secretary of Defense for Industrial Base Policy, shall carry out a pilot program in partnership with relevant private entities to conduct a third-party hardware evaluation and an independent analysis of emerging technologies capable of independently verifying the composition and integrity of commercial electronic devices procured through defense supply chains without reliance on hardware bills of materials, software bills of materials, or similar records. (2) Elements In carrying out the pilot program established under this section, the Secretary shall— (A) identify such technologies for inclusion in the pilot program that perform non-destructive chipset-level interrogation to identify counterfeit, substituted, or compromised components within commercially-sourced equipment; (B) identify military installations where such technologies can assess equipment— (i) in use; and (ii) that has been acquired but not yet deployed; and (C) ensure, to the extent feasible, that a variety of types of commercially-sourced equipment are included in the pilot program. (3) Report Not later than 180 days after the date on which the pilot program commences, the Secretary shall submit to the congressional defense committees a report on the results of the pilot program, including recommendations for broader implementation and an assessment of costs and benefits. (g) Reporting requirements (1) Initial report Not later than April 1, 2027, the Secretary shall submit to the congressional defense committees a report describing— (A) progress made in implementing the Program; (B) integration of Program activities with existing Industrial Base Analysis and Sustainment activities and supply chain risk management activities; and (C) resource requirements, including funding, personnel, data access, and technical infrastructure. (2) Annual report Not later than one year after the date on which the Program is established, and annually thereafter for five years, the Secretary shall submit to the congressional defense committees a report that includes— (A) an assessment of the effectiveness of the Program in improving the Department’s ability to illuminate, assess, anticipate, and respond to risks across the defense industrial base supply chain; and (B) any additional legislative, regulatory, or policy recommendations necessary to strengthen defense industrial base resilience. (g) (h) Definitions In this section: (1) The term covered nation has the meaning given such term in section 4872 of title 10, United States Code. (2) The term foreign ownership, control, or influence refers to ownership structures, governance arrangements, financial relationships, or other mechanisms through which a foreign person or entity may direct, materially influence, or control a supplier or sub-tier entity within the defense industrial base. (3) The term economic security risks means risks arising from supply chain fragility, economic coercion by a covered nation including financing by a covered nation, or other vulnerabilities in a commercial supply chain that may adversely affect national security.