Cybersecurity standards for any recommended framework

(a) Requirements Any unmanned system command and control framework recommended in the final report required under section 4(b), and any system developed or procured pursuant to such a recommendation, shall— (1) employ a modular open systems architecture that permits individual software and hardware components to be updated, replaced, or patched in response to identified cybersecurity vulnerabilities without requiring redesign of the system as a whole; (2) apply a supply chain risk management framework throughout the asset’s and component’s lifecycles; (3) comply with the most current version of the Cybersecurity Framework 2.0 published by the National Institute of Standards and Technology and applicable special publications of the Institute, as updated from time to time, without requiring amendment of this Act to conform to new guidance; (4) include a documented vulnerability disclosure policy and a process for receiving, triaging, and patching reported vulnerabilities within defined response time standards established by the Secretary; and (5) undergo penetration testing by a National Security Agency-certified red team not less frequently than once every two years following initial fielding, with findings reported to the Principal Cyber Advisor and, in summary form, to the congressional defense committees. (b) Exclusion of covered foreign entities No software, hardware, or service produced, provided, or operated by an entity on the Federal Communications Commission Covered List established under section 2 of the Secure and Trusted Communications Networks Act of 2019 (47 U.S.C. 1601), or on the Department of Defense Covered Foreign Entity list maintained pursuant to section 4872 of title 10, United States Code, may be incorporated into any unmanned system command and control framework developed, procured, or fielded pursuant to this Act. (c) Living standards process The Secretary shall, in coordination with the Director of the National Security Agency, the Director of the Cybersecurity and Infrastructure Security Agency, and the Chief Information Officer of the Department, establish a process for reviewing and updating the cybersecurity standards applicable to a framework developed pursuant to this Act on a recurring basis of not less than once every 18 months, to ensure such standards remain current with the evolving threat environment and applicable Federal standards without requiring legislative action.