§3099 Vulnerability Assessments of Major Systems

Summary

The Director of National Intelligence must do an initial vulnerability assessment for every major system and its important supply items. The assessment must happen before Milestone B (the decision to start major system development) unless Milestone B already occurred; for systems with Milestone B done before or shortly after October 7, 2010, the assessment is due by 1 year after October 7, 2010. The Director can delay that deadline up to 180 days only if the congressional intelligence committees are told and given a reason. Each assessment must use analysis (and testing when useful) to find weaknesses, show how the system could be exploited, check how well it would work, rate overall risk, and suggest ways to reduce risk. If the required initial assessment is not sent to the congressional intelligence committees, money for major contracts for that system cannot be obligated until the committees receive the assessment. The Director must do follow-up assessments during procurement or when circumstances change, may recertify or do a new assessment if a committee asks, must give each completed assessment to the congressional intelligence committees within 10 days, and must include a proposed schedule for future periodic assessments when sending the initial assessment. Definitions: item of supply — as defined in the Office of Federal Procurement Policy Act; major contract — one of the 6 largest prime, associate, or government-furnished equipment contracts over $40,000,000 that is not a firm, fixed-price contract; major system — as defined in section 3097(e); Milestone B — the decision to enter major system development and demonstration; vulnerability assessment — the process of identifying and measuring vulnerabilities in a major system and its key supply items.