Sec. 9. Government-wide policy for procurement of unmanned aircraft systems
570 words·~3 min read·
/bill/117/hr/5640/ih/section-9·A research copy — for the controlling text, always check the official state or federal source. Not legal advice.
Not later than 180 days after the date of the enactment of this Act, the Director of the Office of Management and Budget, in coordination with the Department of Homeland Security, Department of Transportation, the Department of Justice, and other Departments as determined by the Director of the Office of Management and Budget, and in consultation with the National Institute of Standards and Technology, shall establish a government-wide policy for the procurement of UAS— for non-Department of Defense and non-intelligence community operations; and through grants and cooperative agreements entered into with non-Federal entities. The policy developed under subsection
(a)shall include the following specifications, which to the extent practicable, shall be based on industry standards and technical guidance from the National Institute of Standards and Technology, to address the risks associated with processing, storing and transmitting Federal information in a UAS: Protections to ensure controlled access of UAS. Protecting software, firmware, and hardware by ensuring changes to UAS are properly managed, including by ensuring UAS can be updated using a secure, controlled, and configurable mechanism. Cryptographically securing sensitive collected, stored, and transmitted data, including proper handling of privacy data and other controlled unclassified information. Appropriate safeguards necessary to protect sensitive information, including during and after use of UAS. Appropriate data security to ensure that data is not transmitted to or stored in non-approved locations. The ability to opt out of the uploading, downloading, or transmitting of data that is not required by law or regulation and an ability to choose with whom and where information is shared when it is required. The policy developed under subsection
(a)shall reflect an appropriate risk-based approach to information security related to use of UAS. Not later than 180 days after the date on which the policy required under subsection
(a)is issued— the Federal Acquisition Regulatory Council shall revise the Federal Acquisition Regulation, as necessary, to implement the policy; and any Federal department or agency or other Federal entity not subject to, or not subject solely to, the Federal Acquisition Regulation shall revise applicable policy, guidance, or regulations, as necessary, to implement the policy. In developing the policy required under subsection (a), the Director of the Office of Management and Budget shall incorporate an exemption to the policy for the following reasons: In the case of procurement for the purposes of training, testing, or analysis for— electronic warfare; or information warfare operations. In the case of researching UAS technology, including testing, evaluation, research, or development of technology to counter UAS. In the case of a head of the procuring department or agency determining, in writing, that no product that complies with the information security requirements described in subsection
(b)is capable of fulfilling mission critical performance requirements, and such determination— may not be delegated below the level of the Deputy Secretary of the procuring department or agency; shall specify— the quantity of end items to which the waiver applies, the procurement value of which may not exceed $50,000 per waiver; and the time period over which the waiver applies, which shall not exceed 3 years; shall be reported to the Office of Management and Budget following issuance of such a determination; and not later than 30 days after the date on which the determination is made, shall be provided to the Committee on Homeland Security and Governmental Affairs of the Senate and the Committee on Oversight and Reform of the House of Representatives.