Harmonization of Department of Defense security boundaries to enable reciprocity

(a) Standardization of security boundaries (1) In general The Secretary of Defense shall standardize security boundaries across the Department of Defense to maximize the potential for security control inheritance and reduce duplicative security assessments through the application of reciprocity. (2) Updated Department guidance Not later than October 1, 2027, the Chief Information Officer of the Department of Defense shall update all applicable Department of Defense policy and guidance governing security boundaries— (A) to establish consistent and uniform standards for security boundary determinations across the Department and the military departments; and (B) to define the conditions under which systems sharing common boundaries or infrastructure are eligible for security control inheritance. (3) Updated military department guidance Not later than December 1, 2027, the Chief Information Officer of each military department shall publish implementing guidance subordinate to and consistent with the guidance updated under subsection (a)(2). (4) Program compliance Not later than October 1, 2030, each Secretary of a military department shall bring all programs and systems within their respective portfolios into compliance with the guidance updated under subsection (a)(2), using authority to operate renewal events as the primary mechanism for transitioning systems to updated security boundary constructs. (b) Notification of guidance updates Not later than 30 days after the publication of guidance under subsection (a), the Chief Information Officer of the Department of Defense and the Chief Information Officer of the military department, as applicable, shall notify the congressional defense committees of the following: (1) The specific changes made to applicable policy and guidance. (2) The directives, instructions, guidance documents, and handbooks that were updated or issued. (c) Annual briefing to Congress Not later than April 1, 2027, and not less frequently than once each year thereafter until April 1, 2031, the Chief Information Officer of the Department of Defense and the Chief Information Officer of each military department shall jointly provide to the congressional defense committees a briefing on the following: (1) The status of implementation of subsections (a) and (b) by the Department of Defense and each military department. (2) The extent to which updated security boundary constructs have expanded opportunities for security control inheritance. (3) Such recommendations as the Chief Information Officers may have for legislative or administrative action to further enable security control inheritance or reduce duplicative security assessments. (d) Definitions In this section: (1) The term authorizing official has the meaning given that term in Department of Defense Instruction 8510.01 (relating to Risk Management Framework for DoD Systems), or successor instruction. (2) The term security control inheritance has the meaning given that term in such instruction, or successor.