Conditions on procurement of telecommunications equipment by intelligence community

(a) Definitions In this section: (1) Baseline configuration The term baseline configuration means a set of specifications, relating to a network device operated by a covered provider, that— (A) has been formally reviewed and agreed upon by the covered provider or by a system owner or operator acting on behalf of the covered provider; (B) can be changed only through change control procedures established by the covered provider or by a system owner or operator acting on behalf of the covered provider; and (C) is used as a basis for future products, deployments, releases, or changes. (2) Configuration management The term configuration management means a collection of activities focused on establishing and maintaining the integrity of products and systems through control of the processes for initializing, changing, and monitoring the configurations of those products and systems to minimize security risks. (3) Configuration management plan The term configuration management plan means a comprehensive description of the roles, responsibilities, policies, and procedures that apply when managing the configuration of products and systems, including scheduled, unscheduled, and unauthorized changes. (4) Covered provider The term covered provider means an entity incorporated in the United States that provides telecommunications equipment, systems, or services to an element of the intelligence community. (5) Director The term Director means the Director of the National Security Agency. (6) Network device The term network device means a physical device used to connect discrete parts of a network, or route network traffic, including a hub, router, gateway, firewall, or switch. (7) Telecommunications The term telecommunications, when used with respect to equipment, systems, or services, includes broadband equipment, systems, or services, respectively. (8) Threat hunting The term threat hunting means a proactive and iterative process of detecting indicators of compromise, tactics, techniques, and procedures, or anomalous behaviors beyond reliance on automated detection systems. (b) Network security contractual clauses Not later than 120 days after the date of the enactment of this Act, the Director shall develop and submit to the heads of the elements of the intelligence community standard contractual clauses relating to network security that mandate— (1) the application of security updates on a timely basis for each network device, including customer-premises equipment, under the control and management of the covered provider; (2) the timely decommissioning of any network device under the control and management of the covered provider that no longer receives updates by the original equipment manufacturer to address identified security vulnerabilities in the network device; (3) the creation and maintenance of configuration management practices for the hardware, software, or firmware, or a combination thereof, of each network device under the control and management of the covered provider, including, at a minimum, a baseline configuration and configuration management plan that align with internal security policies and industry best practices; (4) the implementation of multi-factor authentication, or identity control and access management measures deemed sufficiently equivalent by the Director for any system designated as high risk by the Director under subsection (d)(1); (5) annual threat hunting pursuant to the criteria established by the Director under subsection (d)(2); and (6) notification to the Intelligence Community Chief Information Officer of a compromise of a network device that could reasonably be judged to be novel or implicate a sophisticated adversary. (c) Conditions on procurement (1) In general Except as provided in paragraph (2), the head of an element of the intelligence community may not procure or obtain, or extend or renew a contract to procure or obtain, any telecommunications equipment, system, or service unless the contract includes the clauses required to be circulated by the Director pursuant to subsection (b). (2) Waiver The head of an element of the intelligence community may waive the requirements of paragraph (1), on a case-by-case basis, in order to conduct lawfully authorized intelligence activities upon making a written determination that the inclusion of the contractual clauses required to be circulated by the Director pursuant to subsection (b) would impede the conduct of such lawfully authorized intelligence activities. (d) System security (1) High-risk systems (A) Designation Not later than 270 days after the date of the enactment of this Act, the Director shall, in consultation with the Director of the Cybersecurity and Infrastructure Security Agency, identify and designate systems of covered providers as high risk. (B) Criteria The Director may designate a system as high risk under subparagraph (A) only if access to the system by an unauthorized party would be reasonably likely to result in— (i) compromise of the confidentiality, integrity, or availability of a system used for lawful intercept capabilities; (ii) compromise of the confidentiality, integrity, or availability of a system used for or to support an intelligence purpose; (iii) compromise of customer proprietary network information records that pose significant counterintelligence risks to the United States; (iv) the unauthorized provision of sensitive administrative or network management functions in ways that pose significant counterintelligence risks for the United States; or (v) catastrophic failure of core network functions and services. (2) Minimum suggested criteria for threat hunting Not later than 90 days after the date of the enactment of this Act, the Director shall, in coordination with the Director of the Cybersecurity and Infrastructure Security Agency, publish minimum suggested criteria for threat hunting for purposes of subsection (b)(5). (3) Biennial review Not less frequently than once every 2 years, the Director shall review and validate the high-risk systems desginated pursuant to paragraph (1) and the criteria published pursuant to paragraph (2).