§3099 Vulnerability assessments of major systems

Summary

The Director of National Intelligence must test and report weaknesses in every major system and its important supply parts. The first report must be done before the system moves past the Milestone B decision. For systems that reached Milestone B before or soon after October 7, 2010, the first report must be finished by the date that is 1 year after October 7, 2010. The Director may delay that deadline for up to 180 days if Congress is told and given a reason. Each first report must use an analysis approach to find weaknesses, describe how the system might be attacked, check how well the system would work, judge overall weakness, and recommend ways to cut risk. If the required initial report is not sent, money for major contracts on that system cannot be spent until Congress gets the report. The Director must also do follow-up reports during development or when circumstances change, and may recheck a report if a congressional committee asks. Follow-up checks must use analysis and, when useful, actual testing to watch for exploitation and reexamine the same factors. The Director must send each report to the congressional intelligence committees within 10 days of finishing it and must include a schedule for future checks when sending the first report. The Director must consider these reports when planning the National Intelligence Program budget. Definitions (one line each): item of supply — the supply-item meaning from the Office of Federal Procurement Policy Act (41 U.S.C. 403(10)); major contract — one of the six largest prime, associate, or Government‑furnished equipment contracts for a major system that is over $40,000,000 and is not a firm, fixed‑price contract; major system — the term as defined in section 3097(e); Milestone B — the decision to begin major system development and demonstration under DNI guidance; vulnerability assessment — the process of finding and measuring weaknesses in a major system and its key supply items.