§4129 Joint Federated Assurance Center

Summary

Creates a Joint Federated Assurance Center inside the Office of the Under Secretary of Defense for Research and Engineering. The Center must help the Department of Defense make sure the hardware and software it builds, buys, and uses are free from intentional and accidental weaknesses during their whole life cycle. The Center is run by an Executive Steering Group made up of representatives from the Center’s member organizations. The Under Secretary of Defense for Research and Engineering and the Under Secretary of Defense for Acquisition and Sustainment must serve as co-chairs. The Steering Group must keep checking the Center’s capabilities. The Center must do things like collect and share knowledge on hardware and software security, give the Department a Department-wide view of strategy and buying to better coordinate tool purchases, and create common policies, testing methods, and validation practices to speed fielding, sustain capabilities, improve efficiency, and reduce costs. It must promote commercial best practices, scale access across the Department, use commercial data and industry collaboration, and provide guidance for contracts for application-specific integrated circuits (covering evidence-based assurance, commercial security practices, and a library of certified third-party IP). It must also develop, test, and maintain assurance methods and threat models for microelectronics and make guides for program offices and industry. The Secretary of Defense must issue a revised charter for the Center within 180 days after this law is enacted that sets out the Center’s role and authorities, guidelines for better software and hardware vulnerability testing tools, and how the Center will link into the Department’s main governance and funding processes.