Assessing and addressing risk related to adversarial capital

(a) Designation Not later than March 1, 2027, the Secretary of Defense shall designate, within the Assistant Secretary of Defense for Industrial Base Policy, an office with primary responsibility for identifying, assessing, monitoring, and mitigating risks related to adversarial capital in the defense industrial base and broader defense innovation base. The Secretary shall ensure the office assigned is responsible for carrying out the following functions: (1) Collaboration to identify and mitigate risks of adversarial capital The following activities related to collaborating to identify and mitigate risks of adversarial capital: (A) Promoting robust collaboration across the Department of Defense, other Federal agencies, industry, and academia by coordinating, deconflicting, and synchronizing, adversarial capital risk management activities, including mitigations. (B) Promulgating and enforcing Department-wide policy related to the monitoring and assessment of adversarial capital in the defense industrial base ecosystem, including the development of risk matrices to support decision making. (C) Facilitating timely sharing of threat information, vulnerability assessments, and risk indicators with covered defense industrial base entities. (D) Establishing cooperative research and development agreements to support joint supplier mapping and mitigation research. (E) Working through the Office of Strategic Capital and service and component acquisition executives to provide targeted support to small and medium-sized defense industrial base entities in implementing effective supply chain risk management measures. (2) Adversarial capital identification The following activities related adversarial capital identification: (A) Mapping adversarial capital flows for mission-critical weapons systems, technologies, and materials. (B) Identifying and monitoring dependencies on foreign adversaries across the defense industrial base by identifying foreign adversary-controlled nodes, single points of failure, and critical chokepoints and tactics, techniques, and procedures. (C) Providing specific recommendations to Secretary of Defense on actions or policies necessary to reduce adversarial capital flows for mission-critical weapons systems, technologies, and materials. (3) Data sharing and protection pathways The following activities related to data sharing and protection pathways: (A) Working with industry to develop clear legal, contractual, and technical procedures to support and enable contractor disclosures of sub-tier sourcing and beneficial ownership data relevant to national security. (B) Protecting this data ensuring appropriate liability protections for contractors making good-faith disclosures. (C) Implementing a voluntary risk-sharing framework, modeled on the protections provided under section 104 of the Cybersecurity Information Sharing Act of 2015 (6 U.S.C. 1503), under which industry partners may share supplier risk information and receive validated risk assessments in return, with safeguards for proprietary data. (4) Economic security risk assurance capability The establishment, not later than January 1, 2028, and maintenance of a capability to be known as the Economic Security Risk Assurance capability, which shall— (A) consolidate and analyze information related to adversarial capital flows, materials, supplier identifiers, sourcing data, program-supplier linkages, and other information as determined by the office, including the synthesis of commercially available information and, where appropriate, classified information; (B) develop intelligence reporting and collection requirements for the defense intelligence community; (C) support analysis of entities to determine when tactics are used to obfuscate the ownership relationships to hide adversarial capital flows; (D) provide risk visualization; (E) enable federated access by authorized program offices and acquisition decision authorities, and supply chain illumination programs across the Department; and (F) enable the office to better perform the responsibilities outlines in paragraphs (1) through (3) of this section. (5) Automated risk management The following activities related to automated risk management: (A) Implementing and maintaining continuous automated monitoring for changes in corporate control, beneficial ownership, geographic sourcing, and supply chain structure. (B) Issuing automated alerts to contracting authorities, program leadership, and affected industry upon detection of significant risk indicators. (C) Applying corroboration protocols requiring validation of significant risk findings across not fewer than two independent data sources before forming the basis for risk-tier elevation, mitigation action, or referral to appropriate law enforcement or regulatory authorities. (b) Reporting requirements (1) Initial establishment The Secretary shall provide the congressional defense committees notification of the designation of office with primary responsibility in accordance with subsection (a) and the establishment of the Economic Security Risk Assurance tool in accordance with subsection (a)(4). (2) Annual briefing Beginning on December 1, 2027, and each year after for the next three years, the Secretary shall provide the congressional defense committees an annual report on activities, analysis, and findings of the office with primary responsibility for assessing and mitigating risks related to adversarial capital. The report may be provided in classified form and may include any recommendations the Secretary may have to reduce or further mitigate risks related to adversarial capital in the defense industrial base and broader defense innovation base.