§3099 Vulnerability Assessments of Major Systems

Summary

Requires the Director of National Intelligence to do and send to the congressional intelligence committees an initial vulnerability assessment for each major system and its important supplies. The assessment must be done before Milestone B (the decision to begin major development) unless the system already passed Milestone B before October 7, 2010 or did so within the next 180 days; for those, the assessment must be done by October 7, 2011. The Director may delay submission up to 180 days if he tells the committees and explains why. The assessment must use analysis to find weaknesses, show how the system might be exploited, check how well the system would work, rate overall vulnerability, and recommend ways to lower risk. If the assessment is not sent when required, money for major contracts related to the system cannot be obligated until the committees receive it. The Director must also do follow-up assessments during procurement or if conditions change, and may recertify an earlier assessment if a committee asks. Follow-up work must use analysis and, when needed, testing to watch exploitation risk and recheck the same factors. The Director must consider these assessments when planning the National Intelligence Program budget. Copies of each assessment must go to the congressional intelligence committees within 10 days of completion, and the Director must give a proposed schedule for future assessments when sending the initial one. Definitions (one line each): item of supply, major contract (the 6 largest contracts over $40,000,000 that are not firm fixed price), major system, Milestone B, and vulnerability assessment.