PRIA, Government Policy, Made Personal

Summary

Requires the Secretary of Defense to set up special pathways to speed up how the Department gets, builds, and puts into use software and related hardware. The Secretary must create at least two pathways — one for fast-building apps and related items, and one for upgrades to software inside weapons and other unique systems — and may create more as needed. These pathways must use proven tools and allow quick work so new software can be started fast, shown to work in operations within one year after money is first used, and be updated at least annually. The pathways must use a risk-based approach and a fast, coordinated requirements, budget, and buying process so fielding can happen in not more than one year. They must collect data, keep talking with users, and avoid some normal long acquisition rules unless specific senior leaders say otherwise. The Secretary must set rules for things like user-driven, iterative planning; early definition of warfighter needs; simple initial contract requirements; quick contracting; lifecycle cost and interoperability checks; plans if a developer stops support; testing and program reporting; and cybersecurity metrics (for example, vulnerability counts and patch times) that are shared with the Department and Congress. Definitions: covered hardware — commercial or nondevelopmental hardware that holds the software; nondevelopmental item — an item already defined in law as not newly developed.

Title 10, §3603

Armed Forces, Source: USLM XML via OLRC

(a)Software Acquisition and Development Pathways.—

The Secretary of Defense shall establish pathways as described under subsection (b) to provide for the efficient and effective acquisition, development, integration, and timely delivery of software and covered hardware.

(b)Pathways.—

The Secretary of Defense may establish as many pathways under this section as the Secretary determines appropriate and shall establish the following pathways:

(1)Applications.—

The applications pathway shall provide for the use of rapid development and implementation of applications and other software or software improvements operated by the Department of Defense, which may include applications and associated procurement of covered hardware (including modifications of a type not customarily available in the commercial marketplace to meet Department requirements), commercially available cloud computing platforms, and other nondevelopmental items.

(2)Embedded systems.—

The embedded systems pathway shall provide for the rapid development and insertion of upgrades and improvements for software and covered hardware embedded in weapon systems and other hardware systems unique to the Department of Defense.

(c)Requirements for Pathways.—

A pathway established under this section shall provide for the use of proven technologies and solutions to continuously engineer and deliver capabilities for software and covered hardware.

(d)Considerations for Use of Authority.—

In using the authority under this section, the Secretary shall consider how such use will—

(1)initiate the engineering of new software capabilities quickly and, if applicable, the integration of such capabilities into covered hardware;

(2)demonstrate the viability and effectiveness of such capabilities for operational use not later than one year after the date on which funds are first obligated to acquire or develop software; and

(3)allow for the continuous updating and delivery of new capabilities not less frequently than annually to iteratively meet a requirement.

(e)Treatment Not as Major Defense Acquisition Program.—

Software and covered hardware acquired or developed using the authority under this section shall not be treated as a major defense acquisition program for purposes of section 4201 of title 10, United States Code, or Department of Defense Directive 5000.01 without the specific designation of such software and covered hardware by the Under Secretary of Defense for Acquisition and Sustainment or a service acquisition executive.

(f)Risk-based Approach.—

The Secretary of Defense shall use a risk-based approach for the consideration of innovative technologies and new capabilities for software and covered hardware to be acquired or developed under this authority to meet needs communicated by the Joint Chiefs of Staff and the combatant commanders.

(g)Expedited Process.—

(1)In general.—

A pathway established under this section shall provide for— (A)

(B)the collection of data on software and covered hardware fielded; and

(C)continuous engagement with the users of software and covered hardware to support—

(i)engineering activities of the Department of Defense; and

(ii)delivery of software and covered hardware for operational use in periods of not more than one year.

(2)Expedited software requirements process.—

(A)Inapplicability of joint capabilities integration and development system manual.—

Software and covered hardware acquisition or development conducted under the authority of this section shall not be subject to the Joint Capabilities Integration and Development System Manual, except pursuant to a modified process specifically provided for the acquisition or development of software by the Vice Chairman of the Joint Chiefs of Staff, in consultation with Under Secretary of Defense for Acquisition and Sustainment and each service acquisition executive.

(B)Inapplicability of defense acquisition system directive.—

Software and covered hardware acquisition or development conducted under the authority of this section shall not be subject to Department of Defense Directive 5000.01, except when specifically provided for the acquisition or development of software by the Under Secretary of Defense for Acquisition and Sustainment, in consultation with the Vice Chairman of the Joint Chiefs of Staff and each service acquisition executive.

(h)Elements.—

In implementing a pathway established under the authority of this section, the Secretary shall tailor requirements relating to—

(1)iterative development of requirements for software and covered hardware to be acquired or developed under the authority of this section through engagement with the user community and through user feedback, in order to continuously define and update priorities for such requirements;

(2)early identification of the warfighter or user needs including the rationale for how software and covered hardware to be acquired or developed under the authority of this section will be tailored to address such needs;

(3)initial contract requirements and format, including the use of summary-level lists of problems in existing software and desired features or capabilities of new or upgraded software;

(4)continuous refinement and prioritization of contract requirements, informed by continuous engagement with users throughout the period of development and implementation of software and covered hardware to be acquired or developed under this section;

(5)continuous consideration of issues related to lifecycle costs, technical data rights, and systems interoperability;

(6)planning for support of capabilities of software to be acquired or developed under this section if the software developer stops supporting the software;

(7)rapid contracting procedures, including expedited timeframes for making awards, selecting contract types, defining teaming arrangements, and defining options;

(8)program execution processes, including supporting development and test infrastructure, automation and tools, digital engineering, data collection and sharing with Department of Defense stakeholders and with Congress, the role of developmental and operational testing activities, key decision-making and oversight events, and supporting processes and activities (such as independent costing activity, operational demonstration, and performance metrics);

(9)assurances that cybersecurity metrics of the software to be acquired or developed, such as metrics relating to the density of vulnerabilities within the code of such software, the time from vulnerability identification to patch availability, the existence of common weaknesses within such code, and other cybersecurity metrics based on widely-recognized standards and industry best practices, are generated and made available to the Department of Defense and the congressional defense committees;

(10)administrative procedures, including procedures relating to who may initiate and approve an acquisition under this authority, the roles and responsibilities of persons implementing or supporting the use of authority under this section, team selection and staffing process, governance and oversight roles and responsibilities, and appropriate independent technology assessments, testing, and cost estimation (including relevant thresholds or designation criteria);

(11)mechanisms and waivers designed to ensure flexibility in the implementation of a pathway under this section, including the use of other transaction authority, broad agency announcements, and other procedures; and

(12)mechanisms the Secretary will use for appropriate reporting to Congress on the use of the authority under this section, including notice of initiation of the use of a pathway and data regarding individual programs or acquisition activities, how acquisition activities are reflected in budget justification materials or requests to reprogram appropriated funds, and compliance with other reporting requirements.

(i)Definitions.—

In this section: (1)

(2)The term “nondevelopmental item” has the meaning given in section 110 of title 41.

Notes & Related Subsidiaries

Editorial Notes

Prior Provisions

Provisions similar to those in this section were contained in Pub. L. 116–92, div. A, title VIII, § 800, Dec. 20, 2019, 133 Stat. 1478, which was set out in a note under section 4571 of this title, prior to repeal by Pub. L. 118–159, div. A, title VIII, § 805(c)(1), Dec. 23, 2024, 138 Stat. 1972.

Amendments

2025—Subsec. (a). Pub. L. 119–60 struck out “Such a pathway shall include the following:” at end.

Statutory Notes and Related Subsidiaries

Guidance Required Pub. L. 118–159, div. A, title VIII, § 805(b), Dec. 23, 2024, 138 Stat. 1972, provided that: “Not later than 90 days after the date of the enactment of this Act [Dec. 23, 2024], the Secretary of Defense shall issue or modify guidance to implement the requirements of this section.” Implementation of Recommendations of the Final Report of the Defense Science Board Task Force on the Design and Acquisition of Software for Defense Systems Pub. L. 115–232, div. A, title VIII, § 868, Aug. 13, 2018, 132 Stat. 1902, provided that: “(a) Implementation Required.—Not later than 18 months after the date of the enactment of this Act [Aug. 13, 2018], the Secretary of Defense shall, except as provided under subsection (b), commence implementation of each recommendation submitted as part of the final report of the Defense Science Board Task Force on the Design and Acquisition of Software for Defense Systems. “(b) Exceptions.—“(1) Delayed implementation.—The Secretary of Defense may commence implementation of a recommendation described under subsection (a) later than the date required under such subsection if the Secretary provides the congressional defense committees [Committees on Armed Services and Appropriations of the Senate and the House of Representatives] with a specific justification for the delay in implementation of such recommendation. “(2) Nonimplementation.—The Secretary of Defense may opt not to implement a recommendation described under subsection (a) if the Secretary provides to the congressional defense committees—“(A) the reasons for the decision not to implement the recommendation; and “(B) a summary of the alternative actions the Secretary plans to take to address the purposes underlying the recommendation. “(c) Implementation Plans.—For each recommendation that the Secretary is implementing, or that the Secretary plans to implement, the Secretary shall submit to the congressional defense committees—“(1) a summary of actions that have been taken to implement the recommendation; and “(2) a schedule, with specific milestones, for completing the implementation of the recommendation.”

§3603 Software Acquisition Pathways