Security standards and framework for Department of Defense agents

(a) Development and issuance (1) In general Not later than December 15, 2027, the Secretary of Defense shall, acting through the Chief Information Officer of the Department of Defense and in coordination with the officials specified in subsection (c), develop and issue authoritative security standards and guidance for agents across the Department. (2) Elements The standards and guidance developed and issued under paragraph (1) shall address the following: (A) A risk management framework consistent with applicable standards of the National Institute of Standards and Technology. (B) Deployment and operation of agents across multi-cloud and multi-level security environments. (C) Permissions governing the actions agents are authorized to take, the data and systems they may access, and the conditions under which permissions may be modified or revoked. (D) Continuous monitoring of the security posture and operational behavior of deployed agents, including reporting, assessment, and remediation of observed anomalous behaviors. (E) Integration of agents into the Zero Trust Architecture and Identity, Credential, and Access Management framework of the Department. (F) Security boundaries governing agent operation at and beyond Department network boundaries. (G) Incident response, including procedures for detecting, containing, and recovering from compromise, anomalous behavior, or unauthorized action by an agent. (b) Implementation (1) Department standards The standards developed and issued under subsection (a) shall be binding on the Department and shall include a transition timeline for achieving compliance. (2) Military department implementation Not later than March 15, 2028, the Secretary of each military department shall issue implementing guidance for the standards and guidance issued under subsection (a), including a transition timeline for achieving compliance that is consistent with the timeline included under paragraph (1). (c) Coordination In carrying out this section, the Secretary shall, acting through the Chief Information Officer, coordinate with— (1) the Chief Information Officers of the military departments and the Joint Staff; (2) the Chief Artificial Intelligence and Data Officers of the military departments and the Joint Staff; (3) the Defense Intelligence Enterprise; and (4) such other officials and organizations as the Secretary determines appropriate. (d) Briefings (1) Standards Not later than January 15, 2028, the Secretary shall provide the congressional defense committees a briefing on the standards and guidance developed and issued under subsection (a). (2) Status Not later than April 15, 2028, the Secretary shall provide the congressional defense committees a briefing on the status of the implementation of the standards and guidance issued under this section as they pertain to all elements of the Department, including the military departments. (e) Definitions In this section: (1) The term agent means an artificial intelligence system capable of autonomously planning, deciding, and executing multi-step tasks, including using tools, automated protocols, or other systems, with limited human intervention to achieve a specified goal. (2) The term artificial intelligence has the meaning given that term in section 238(g) of the John S. McCain National Defense Authorization Act for Fiscal Year 2019 (Public Law 115–232; 10 U.S.C. note prec. 4061). (3) The term military departments has the meaning given that term in section 101(a) of title 10, United States Code.