10 U.S.C. § 142 — Chief Information Officer

(a) There is a Chief Information Officer of the Department of Defense, appointed by the President with Senate confirmation, chosen from among qualified civilians. (b)(1) The Chief Information Officer: (A) serves as the Department's Chief Information Officer for purposes of sections 3506(a)(2) and 3544(a)(3) of title 44; (B) has the responsibilities and duties in sections 11315 and 11319 of title 40; (C) has the responsibilities specified for the Chief Information Officer in sections 2223(a) and 2224 of this title; (D) exercises authority, direction, and control over the Cybersecurity Directorate (or its successor) at the National Security Agency, funded through the Information Systems Security Program; (E) exercises authority, direction, and control over the Defense Information Systems Agency (or its successor); (F) has responsibility for policy, oversight, guidance, and coordination on all Department matters related to electromagnetic spectrum, including coordination with other federal and industry agencies, coordination on classified programs, and — working with the Under Secretary for Personnel and Readiness — spectrum-management workforce policy; (G) has responsibility for policy, oversight, and guidance on precision navigation and timing; and (H) has responsibility for policy, oversight, and guidance for the architecture and programs behind the Department's information technology, networking, information assurance, cybersecurity, and cyber capability architectures. (2)(A) The Secretary of Defense, acting through the Under Secretary of Defense (Comptroller), must require the military department secretaries and defense agency heads with responsibilities tied to paragraph (1) to send their proposed budgets — for the coming fiscal year and the future-years defense program submitted under section 221 — to the Chief Information Officer for review, before sending them to the Under Secretary (Comptroller). (B) The Chief Information Officer must review each proposed budget and, by January 31 of the year before that fiscal year, submit a report to the Secretary of Defense with comments and a certification of whether each proposed budget is adequate. (C) By March 31 each year, the Secretary of Defense must submit to Congress a report naming each proposed budget from the most recent report that the Chief Information Officer didn't certify as adequate. That report must include: (i) the actions the Secretary proposes to address the inadequacy, plus any recommended legislation; and (ii) any additional comments the Secretary considers appropriate about the inadequacy. (3)(A) A military department secretary or defense agency head may not develop or procure information technology (as defined in section 11101 of title 40) that doesn't fully comply with standards the Chief Information Officer sets. (B) The Chief Information Officer must implement and enforce a process for developing, adopting, or publishing standards for information technology, networking, or cyber capabilities that any military department or defense agency must follow to run those capabilities on defense networks, and for regularly certifying that capabilities being developed or bought meet the standards published at the time of certification. (C) The Chief Information Officer must identify gaps in the standards and plans for mitigating the lack of acceptable standards. (4) The Chief Information Officer also performs whatever additional duties the Secretary of Defense assigns. (c) The Chief Information Officer takes precedence in the Department of Defense over the officials serving in positions listed under section 131(b)(4). Those officials and the Chief Information Officer rank among themselves in whatever order the Secretary of Defense prescribes. (d) The Chief Information Officer of the Department of Defense reports directly to the Secretary of Defense in carrying out the duties under this section.