Reducing administrative burden in the Department of Defense risk management framework implementation

(a) Guidance for standardized risk management framework process (1) In general Not later than October 1, 2027, the Chief Information Officer of the Department of Defense shall issue or update Department of Defense-wide policy guidance relating to standardized risk management framework procedures applicable to all programs and systems of the Department. (2) Contents The policy required under paragraph (1) shall include the following: (A) A unified, standardized set of procedures with clearly defined steps by which all programs and systems of the Department shall progress through the risk management framework process. (B) A mandatory, enumerated list of documentation required from vendors and system owners at each step of the risk management framework process as defined in subparagraph (A), which— (i) shall be submitted in machine-readable formats; and (ii) may be submitted in a format other than machine-readable only if the vendor provides written justification that machine-readable delivery is not technically feasible, and such justification is approved in writing by the authorizing official prior to the initiation of any risk management framework activity. (3) Military department implementing guidance (A) Issuance Not later than December 1, 2027, the Chief Information Officer of each military department shall publish implementing guidance subordinate to and consistent with the guidance issued under paragraph (1). (B) Limitations The Chief Information Officer of a military department may not impose requirements beyond those in the guidance issued under paragraph (1) without written approval of the Chief Information Officer of the Department of Defense. (b) Unified digital platform Not later than October 1, 2028, the Chief Information Officer of the Department of Defense shall modernize or replace the current enterprise application for hosting approvals and documentation for programs and systems of the Department, and ensure that this Department-wide platform used to support the risk management framework process— (1) is capable of ingesting, assessing, and retrieving machine-readable security data submitted in accordance with subsection (a); (2) supports real-time progress tracking for all programs and systems engaged in or that have completed the risk management framework process as established in updated or new guidance required under subsection (a); (3) serves as the authoritative repository for all risk management framework documentation required under subsection (a); and (4) is accessible to authorizing officials, program offices, and mission owners across the Department and the military departments, including to support reciprocity determinations under section 1522 of the Servicemember Quality of Life Improvement and National Defense Authorization Act for Fiscal Year 2025 (Public Law 118–159; 10 U.S.C. 2223 note). (c) Control inheritance as the default approach (1) Policy It shall be the policy of the Department that use of available inherited controls shall be required as the default for all programs and systems of the Department, with exceptions to such policy to be approved by the Chief Information Officer of the Department of Defense. (2) Update to directives (A) Not later than October 1, 2027, the Chief Information Officer of the Department of Defense shall update all applicable Department of Defense directives, instructions, guidance, and associated handbooks to establish the inheritance of applicable security controls from authoritative providers as the default approach for all programs and systems of the Department. (B) The directives, instructions, guidance, and handbooks updated under subparagraph (A) shall— (i) establish the inheritance of applicable security controls from authoritative providers as the default approach for all programs and systems of the Department of Defense; and (ii) require that an authorizing official who declines to use available inherited controls document in writing the specific technical or mission justification for that decision prior to initiating an independent assessment of those controls. (d) Annual briefing to Congress Not later than April 1, 2027, and annually thereafter through April 1, 2032, the Chief Information Officer of the Department of Defense shall provide to the congressional defense committees a briefing on the following: (1) The status of administration of subsections (a) through (c). (2) Measurable changes in average risk management framework cycle times before and after implementation of the directive required under subsection (a). (3) Such recommendations as the Chief Information Officer may have for legislative or administrative action to further reduce administrative burden without reducing security outcomes. (e) Definitions In this section: (1) The term authorizing official has the meaning given that term in Department of Defense Instruction 8510.01 (relating to Risk Management Framework for DoD Systems), or successor instruction. (2) The term machine-readable has the meaning given that term in section 3502 of title 44, United States Code. (3) The term risk management framework means the cybersecurity risk management framework established by the National Institute of Standards and Technology and implemented by the Department of Defense pursuant to Department of Defense Instruction 8510.01 (relating to Risk Management Framework for DoD Systems) for the assessment and authorization of information systems.