National Defense Data Resilience Act

This bill would require the Secretary of Defense to sort Department of Defense data into three types: critical, important, and necessary. The Secretary would set required time limits for restoring each type of data after a cyberattack, within 180 days for critical data and 270 days for the other types, and report to Congress each year on those limits. The Department would have to put in place recovery tools such as backups that cannot be altered and are kept separate from outside networks, constant monitoring of backups, yearly drills that simulate nation-state cyberattacks, and simulated-attack audits. The bill limits which technologies can be used for this, and it requires a data recovery strategy, including cost, to be sent to Congress within 90 days.

Full text and official record on Congress.gov

Sponsors

• Suhas Subramanyam Democrat sponsor
• 1 cosponsors