Streamlining Department of Defense governance process for cross-domain solution approvals

(a) Streamlining required The Chief Information Officer of the Department of Defense shall, in consultation with the Chief Information Officers of the military departments, reduce approval timelines and expand secured capabilities for cross-domain solutions through the elimination of unnecessary procedural steps and governance body involvement that does not contribute a priority security benefit. (b) Report required Not later than December 15, 2027, the Chief Information Officer of the Department of Defense shall, in consultation with the Chief Information Officers of the military departments, submit to the congressional defense committees a report that includes the following: (1) An assessment of current approval timelines, organizational constructs, resource requirements, and operational limitations imposed by current cross-domain solution governance processes, including the frequency, structure, and consensus-based decision requirements of each governance body in the approval chain and whether full governance body review is required for every modification regardless of risk level. (2) A comparison of Department of Defense cross-domain solution approval timelines, approved file types, file sizes, and bulk and streaming data capabilities with those of other Federal departments and agencies. (3) An assessment of barriers to full utilization of reciprocity authorities under Department of Defense Instruction 8540.01 (relating to Cross Domain Policy), or successor instruction, and recommendations to remove such barriers. (4) A plan to carry out subsection (a) that— (A) reduces approval timelines to be commensurate with the risk level of the requested modification and achieves parity with comparable Federal department and agency processes; (B) identifies and eliminates governance body involvement that does not contribute a distinct security benefit, including evaluation of whether full board review is warranted for every modification request regardless of risk level; (C) fully employs available reciprocity authorities to achieve parity of approved capabilities across all enterprise cross-domain solutions; (D) establishes a risk-tiered review framework that distinguishes high-risk changes requiring full governance body review from lower-risk modifications eligible for expedited technical review; (E) evaluates a model where the approval of a cross-domain solutions includes a set of pre-authorized parameters, such that any modifications to that cross-domain solution that are within those parameters do not require full re-approval; and (F) assesses the feasibility of a common tracking and workflow tool to enable asynchronous and continuous review of modification requests in lieu of periodic consensus-based governance meetings, including proposed metrics to measure implementation effectiveness. (c) Implementation briefing Not later than March 1, 2028, the Chief Information Officer of the Department of Defense shall provide the congressional defense committees a briefing on the status of the implementation of subsection (a) and an assessment of performance with respect to each of subparagraphs (A) through (F) of subsection (b)(4). (d) Definition of cross-domain solution In this section, the term cross-domain solution has the meaning given such term in Department of Defense Instruction 8540.01 (relating to Cross Domain Policy), or successor instruction.