Identification, assessment, and mitigation of critical defense sites

(a) Designation of responsible office Not later than 90 days after the date of the enactment of this Act, the Secretary of Defense shall— (1) designate an existing or new office or official within the Department of Defense to serve as the lead for the identification, assessment, prioritization, and mitigation of risks to critical defense sites, including privately owned or commercially operated, in the defense industrial base, including physical and airspace protection against unmanned aircraft systems incursions and other emerging threats; and (2) notify the congressional defense committees of the office or official designated under paragraph (1) and the specific authorities and resources assigned to it. (b) Comprehensive list and risk ranking Not later than 180 days after the designation made under subsection (a), the designated office or official shall, in consultation with the Secretaries of the military services, the heads of relevant defense agencies, and appropriate private sector representatives— (1) compile and maintain a classified list of the critical defense sites in the defense industrial base, including privately owned or commercially operated sites; and (2) rank such sites by the potential devastating effect on national security if disrupted or compromised, taking into account— (A) the criticality of the capability to current and future military operations; (B) the absence or limited availability of alternative sources; (C) the vulnerability to physical threats, including unmanned aircraft systems incursions, sabotage, or natural disasters; and (D) any other factors the Secretary determines appropriate. (c) Report required Not later than one year after the date of the enactment of this Act, the Secretary of Defense shall submit to the congressional defense committees a report that includes the following elements: (1) The list of critical defense sites and prioritization of those sites compiled under subsection (b). (2) A formal, unclassified definition of the term single point of failure, as a subset of the critical defense sites identified in subsection (b), which shall be used to refer to facilities, sites, production lines, suppliers, or capabilities, whether privately owned or commercially operated, that, if disrupted, would halt or cause undue harm to United States military production, sustainment, or operational readiness due to the lack of viable near-term substitute sources. (3) A detailed assessment of current protection levels at each identified critical defense site, including any gaps in physical security, airspace protection, or counter-unmanned aircraft systems capabilities. (4) A description of the risks to national security of failing to protect such sites, including potential impacts on military readiness, supply chain resilience, and strategic deterrence. (5) A path forward that includes— (A) options for the Department of Defense to assume or share responsibility with industry for protecting these sites; (B) estimated costs and recommended funding mechanisms; (C) proposed legislative or regulatory changes necessary to close the identified gaps; and (D) a timeline and milestones for implementation of mitigation measures for the highest-ranked single points of failure. (6) Any other recommendations the Secretary considers appropriate. (d) Annual updates The Secretary of Defense shall provide annual updates to the report required under subsection (c) for each of the five years following the initial report, including any changes to the definition, list, or ranking and progress on the path forward.