Science, Technology, and Innovation Board study on software-as-a-service in classified networks

(a) Study required Not later than February 1, 2027, the Secretary of Defense shall direct the Science, Technology, and Innovation Board to conduct a study on enabling commercial software-as-a-service offerings on classified networks of the Department of Defense. (b) Elements The study required under subsection (a) shall include the following: (1) An assessment of the strategic and operational benefits of commercial software-as-a-service offerings on classified networks, including the extent to which such offerings could advance the innovation objectives of the Department. (2) An evaluation of the existing framework by which commercial vendors seek, are authorized, and subsequently given appropriate network and account access to build, certify, procure, and sustain software-as-a-service capabilities on classified networks, including the following: (A) Technical requirements, including physical facility requirements, compute and networking infrastructure, and mechanisms for vendor access to customer data across classified network enclaves. (B) Security requirements applicable to offerings serving multiple military departments or components as well as Defense Intelligence Enterprise organizations simultaneously, including authority to operate processes and the feasibility of a reciprocal or common authorization framework. (C) Contractual and regulatory requirements, including whether the Defense Federal Acquisition Regulation Supplement and the Department of Defense Financial Management Regulation adequately support such procurements. (D) Barriers to entry for small businesses and nontraditional defense contractors, and constructs that would enable such entities to effectively compete their offerings. (3) Recommendations for resolving the barriers identified under paragraph (2)(D), including the organizational roles and responsibilities, resources, authorities, and legislative or administrative action required to establish and sustain the growth of commercial software-as-a-service offerings. (c) Consultation In conducting the study required under subsection (a), the Science, Technology, and Innovation Board shall— (1) consult with appropriate officials of the Department of Defense and the Defense Intelligence Enterprise; and (2) to the extent practicable, seek input from representatives of the commercial software industry, including small businesses and nontraditional defense contractors. (d) Interim briefing Not later than August 1, 2027, the Science, Technology, and Innovation Board shall provide to the congressional defense committees a briefing on the status of the study required under subsection (a), including any preliminary findings or recommendations. (e) Report (1) Submission Not later than January 15, 2028, the Science, Technology, and Innovation Board shall submit to the congressional defense committees a report containing the findings and recommendations of the Science, Technology, and Innovation Board with respect to the study required under subsection (a). (2) Form The report required under paragraph (1) shall be submitted in unclassified form, but may include a classified annex. (f) Briefing on report Not later than January 31, 2028, the Chair of the Science, Technology, and Innovation Board shall provide to the congressional defense committees a briefing on the findings and recommendations contained in the report submitted under subsection (e). (g) Definitions In this section: (1) The term classified networks means a national security system, as defined in section 3552(b) of title 44, United States Code, that is authorized to process, store, or transmit classified national security information. (2) The term nontraditional defense contractor has the meaning given that term in section 3014 of title 10, United States Code. (3) The term software-as-a-service means a cloud computing service model in which the capability provided to the consumer is to use the provider’s applications running on a cloud infrastructure, accessible from various client devices through a thin client interface such as a web browser or a program interface, in which the consumer does not manage or control the underlying cloud infrastructure, including network, servers, operating systems, storage, or individual application capabilities.