10 U.S.C. § 189 — Communications Security Review and Advisory Board

(a) Establishment: The Department of Defense must have a Communications Security Review and Advisory Board ("the Board") to review and assess the Department's communications security, cryptographic modernization, and related key-management work, and to advise the Secretary about it. (b) Members: (1) The Secretary decides how many members the Board has. (2) The Department's Chief Information Officer chairs the Board. (3) The Secretary appoints officers in the grade of general or admiral, and senior civilian employees, to serve as members. (c) Responsibilities: The Board must — (1) monitor the Department's overall communications security, cryptographic modernization, and key-management work, including on major defense acquisition programs (as defined in 10 U.S.C. § 4201), by (A) requiring each military department's Chief Information Officer to report their communications security work to the Board, (B) tracking each military department's compliance with communications security modernization, and (C) validating lifecycle communications security modernization plans for major defense acquisition programs; (2) confirm the need to replace cryptographic equipment based on its expiration date, and weigh the risks of using it past that date; (3) hold in-depth program reviews for specific cryptographic modernization projects, to check requirements and spot risks; (4) build a long-term communications security roadmap to catch potential issues early and keep it in sync with major planning documents; and (5) advise the Secretary on the Department's cryptographic posture, including budget recommendations. (d) Exclusion of Certain Programs: The Board does not review programs funded under the National Intelligence Program, as defined in the National Security Act of 1947 (50 U.S.C. § 3003(6)).