10 U.S.C. § 4129 — Joint Federated Assurance Center

(a) Establishment. The Office of the Under Secretary of Defense for Research and Engineering has a Joint Federated Assurance Center, called the “Center.” (b) Purpose. The Center is a Department-wide federation of organizations and capabilities that supports the Department of Defense's assurance needs. Under policies about hardware and software assurance and supply-chain risk management, the Center must help ensure that software and hardware developed, acquired, maintained, and used by the Department are free from intentional and unintentional vulnerability during the development life cycle and the deployment of assured, trustworthy defense systems. (c) Governance. (1) An Executive Steering Group governs the Center. It must continually evaluate the Center's capabilities to support the Department's hardware and software assurance needs. (2) The Executive Steering Group must include one or more representatives from each organization that makes up the Center. (3) The Under Secretary of Defense for Research and Engineering and the Under Secretary of Defense for Acquisition^* and Sustainment serve as the Executive Steering Group's co-chairpersons. (d) Duties. The Center's duties are: (1) Provide knowledge-management capabilities for hardware and software assurance for the Department. (2) Provide Department-wide visibility into strategy, use cases, procurement, investment, and other relevant activities, so that, as far as practicable, the Department can combine its purchases of assurance tools. (3) Develop and standardize policies, procedures, competencies, risk-assessment methods, and independent validation and verification testing capabilities—(A) to support the timely and cost-effective fielding of current and future technologies to the Department; (B) to ensure that enduring capability needs are sustained throughout the life cycle of Department of Defense programs and to determine the sustainment factors related to assuring future hardware and software systems; (C) to increase efficiency across Department of Defense programs through emerging assurance technologies; and (D) to use economies of scale through the coordinated acquisition and use of hardware and software assurance technologies. (4) Promote hardware and software assurance capabilities—(A) to mature assessment criteria and enable scalable deployment of commercial best practices, including by fostering and maturing evidence-based assurance for trusted defense microelectronics system needs, with emphasis on commercial security protocols that can be transferred to defense applications; (B) to scale the Center for Department-wide access by providing enough personnel to address standardization and automation of data collection and analysis; (C) to use data from commercial assurance processes to support the development of Department hardware and software that meet standards, applications, and requirements, including through comparative analysis and data modeling; (D) to seek and apply commercial best practices, where practicable, through collaboration with industry; and (E) to develop and align Department policy, investments, and activities with commercial best practices, to the extent practicable. (5) For contracts for application-specific integrated circuits designed by defense industrial base contractors, develop guidance for—(A) considering evidence-based assurance processes and techniques included in the contract data requirements list, to the extent practicable; (B) using commercial best practices, as applicable, for confidentiality, integrity, and availability; and (C) developing a library of certified third-party intellectual property for reuse, including streamlining legal mechanisms for data collection and sharing and increasing the use of automation technology to achieve efficiency. (6) Assess, create, prototype, mature, and maintain relevant assurance practices, including validating and maturing evidence-based assurance methods, for developing, procuring, and deploying hardware and software assurance tools and processes, including—(A) developing and assessing validation methods for those processes and techniques, in coordination with the developmental and operational test and evaluation community, as the Executive Steering Group determines necessary; (B) developing and assessing threat models that comprehensively describe the threats to microelectronics confidentiality, integrity, and availability across the entire supply chain and throughout the design, production, packaging, and deployment cycle, to support risk management and risk mitigation; and (C) supporting the development of guides to inform use and decision-making by program evaluators, program offices, and industry so they can meet software and hardware assurance requirements. (e) Revised charter. No later than 180 days after this section is enacted, the Secretary of Defense must issue a revised charter for the Center. The charter must state—(1) the Center's and the Executive Steering Group's roles and authorities; (2) that the Center must establish guidelines for developing improved software-code vulnerability analysis and testing tools; (3) that the Center must establish guidelines for developing improved hardware vulnerability testing and protection tools; and (4) how the Center will connect to the Department's major governance and resourcing processes to ensure that the Center's duties continue.