Sec. 219. QUANTIFIABLE ASSURANCE CAPABILITY FOR SECURITY OF MICROELECTRONICS

379 words·~2 min read·/statute-compilations/comps-17475/sec-219

A research copy — for the controlling text, always check the official state or federal source. Not legal advice.

## SEC. 219 QUANTIFIABLE ASSURANCE CAPABILITY FOR SECURITY OF MICROELECTRONICS ###

(a)Development and Implementation of Capability The Secretary of Defense shall develop and implement a capability for quantifiable assurance to achieve practical, affordable, and risk-based objectives for security of microelectronics to enable the Department of Defense to access and apply state-of-the-art microelectronics for military purposes. ###

(b)Establishment of Requirements and Schedule of Support for Development, Test, and Assessment ####

(1)In general Not later than 90 days after the date of the enactment of this Act, the Deputy Secretary of Defense shall, in consultation with the Under Secretary of Defense for Research and Engineering, establish requirements and a schedule for support from the National Security Agency to develop, test, assess, implement, and improve the capability required by subsection (a). ####

(2)National security agency The Director of the National Security Agency shall take such actions as may be necessary to satisfy the requirements established under paragraph (1). ####

(3)Briefing Not later than 120 days after the date of the enactment of this Act, the Under Secretary of Defense for Research and Engineering and the Director of the National Security Agency shall jointly provide the congressional defense committees a briefing on the requirements and the schedule for support established under paragraph (1). ###

(c)Assessment ####

(1)In general The Secretary of Defense shall assess whether the Department of Defense, to enable expanded use of unprogrammed application specific integrated circuits or other custom-designed integrated circuits manufactured by a supplier that is not using processes accredited by the Defense Microelectronics Activity for the purpose of enabling the Department to access commercial state-of-the-art microelectronics technology using risk-based quantifiable assurance security methodology, should— #####

(A)seek changes to the International Traffic in Arms Regulations under subchapter M of chapter I of title 22, Code of Federal Regulations, and Department of Defense Instruction 5200.44 (relating to protection of mission critical functions to achieve trusted systems and networks); and #####

(B)expand the use of unprogrammed custom-designed integrated circuits that are not controlled by such regulations. ####

(2)Briefing Not later than April 1, 2023, the Secretary of Defense shall provide the congressional defense committees a briefing on the findings of the Secretary with respect to the assessment conducted under paragraph (1).