Sec. 1502. Enterprise-wide procurement of commercial cyber threat information products
375 words·~2 min read·
/bill/117/hr/4350/rh/section-1502A research copy — for the controlling text, always check the official state or federal source. Not legal advice.
No later than one year after the date of the enactment of this Act, the Secretary of Defense, acting through the Commander of Joint Force Headquarters-Department of Defense information products Network, shall establish a program management office for the enterprise-wide procurement of commercial cyber threat information products. The program manager of such program shall be responsible for the following: Surveying components of the Department for the commercial cyber threat information product needs of such components.
Conducting market research of commercial cyber threat information products. Developing requirements, both independently and through consultation with components, for the acquisition of commercial cyber threat information products. Developing and instituting model contract language for the acquisition of commercial cyber threat information products, including contract language that facilitates Department of Defense components’ requirements for ingesting, sharing, using and reusing, structuring, and analyzing data derived from such products.
Conducting procurement of commercial cyber threat information products on behalf of the Department of Defense, including negotiating contracts with a fixed number of licenses based on aggregate component demand and negotiation of extensible contracts. In implementing this section, each component of the Department of Defense shall coordinate the commercial cyber threat information product requirements and potential procurement plans relating to such products of each such component with the program management office established pursuant to subsection
(a)so as to enable the program management office to determine if satisfying such requirements or such procurement of such products on an enterprise-wide basis would serve the best interests of the Department. Beginning not later than 540 days after the date of the enactment of this Act, no component of the Department of Defense may independently procure a commercial cyber threat information product that has been procured by the program management office established pursuant to subsection (a), unless— such component is able to procure such product at a lower per-unit price than that available through the program management office; or the program management office has approved such independent purchase. The requirements of subsections
(b)and
(c)shall not apply to the National Security Agency. In this section, the term commercial cyber threat information products refers to commercially-available data and indicators that facilitate discovery and understanding of the targets, infrastructure, tools, and tactics, techniques, and procedures of cyber threats.