,i #aaith ,,congress #b;d ,session ,h4 ,r4 #hgaj ,,in ,,the ,,house ,,of ,,representatives ,may #g1 #bjbf,mr4 ,subramanyam 7for himself and ,mr4 ,mc,cormick7 introduced the following bill2 which was referred to the ,committee on ,armed ,services ,a ,,bill ,to amend title #aj1 ,united ,states ,code1 to require the ,secretary of ,defense to implement resilient capabilities to recover critical ,department of ,defense data in the event such data is lost1 degraded1 or destroyed1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,national ,defense ,data ,resilience ,act4 #b4 ,data recovery requirements and strategy 7a7 ,data recovery requirements ,chapter #ai of title #aj1 ,united ,states ,code1 is amended by inserting after section #cia;b the following new section3 #cia;c4 ,data recovery requirements 7a7 ,mandatory recovery time objectives 7#a7 ,the ,secretary of ,defense shall1 with respect to each element of the ,department of ,defense1 carry out the following3 7,a7 ,designate data as one of the following types1 as applicable3 7i7 ,critical data4 7ii7 ,important data4 7iii7 ,necessary data4 7,b7 ,not later than #ahj days after the date of the enactment of this section1 establish mandatory recovery time objectives for data so designated as critical data4 7,c7 ,not later than #bgj days after the date of the enactment of this section1 establish mandatory recovery time objectives for data so designated as important data or necessary data4 7#b7 ,each recovery time objective established under paragraph 7#a7 shall satisfy the following requirements3 7,a7 ,be based upon the type of data to which such objective applies1 including with respect to threat exposure4 7,b7 ,be updated in response to intelligence on evolving threats from state and non-state actors1 including the ,people's ,republic of ,china4 7#c7 ,not later than one year after the date of the enactment of this section and annually thereafter1 the ,secretary of ,defense shall1 for each element of the ,department of ,defense1 submit to the congressional defense committees an auditable recovery certification report that includes information relating to the following3 7,a7 ,each recovery time objective that is established under paragraph 7#a7 and applies to such element4 7,b7 ,whether such objective satisfies the requirements listed in paragraph 7#b74 7b7 ,data recovery capability requirements 7#a7 ,not later than #ahj days after the date of the enactment of this section1 the ,secretary of ,defense shall1 for data designated as critical data pursuant to subparagraph 7,a7 of subsection 7a77#a71 field data recovery capabilities that satisfy the following requirements3 7,a7 ,prioritize providing critical services in support of national defense4 7,b7 ,include the following3 7i7 ,immutable backups that satisfy the following requirements3 7,i7 ,preserve logically separated copies of data4 7,,ii7 ,are selectively segmented or isolated from external networks by means of software1 firewalls1 or other controls4 7ii7 ,continuous monitoring of backup environments to detect tampering1 insider threats1 and malicious corruption4 7iii7 ,annual recovery exercises that simulate sophisticated nation-state cyberattacks designed to cripple data systems4 7iv7 ,audits in which external or internal independent groups mimic tactics1 techniques1 and procedures of cyberattacks to assess and validate the ability of each element of the ,department of ,defense to carry out the objectives established under such subsection with respect to realistic threat conditions4 7#b7 ,not later than #bgj days after the date of the enactment of this section1 the ,secretary of ,defense shall1 for data designated as important data or necessary data pursuant to subsection 7a77#a77;,a71 field data recovery capabilities described in paragraph 7#a74 7c7 ,approved technology standards ,in fielding a data recovery capability under subsection 7b71 the ,secretary of ,defense may not adopt technology unless the following requirements are satisfied3 7#a7 ,such technology is listed in an inventory of the ,department of ,defense for certified cybersecurity and data protection technology4 7#b7 ,if such technology is technology for recovering or repairing damaged or lost data1 such technology provides for the following3 7,a7 ,immutable storage4 7,b7 ,robust recovery capabilities4 7,c7 ,full audit trails4 7,d7 ,continuous monitoring for data integrity and anomalous activity4 7d7 ,definitions ,in this section3 7#a7 ,the term critical data means data1 so vital to the ,united ,states1 that the incapacity or destruction of such data would have a debilitating impact on security1 national economic security1 national public health or safety1 or any combination thereof4 7#b7 ,the term data recovery capability means a technology1 process1 or governance framework to ensure rapid1 secure1 and verifiable recovery after a destructive cyberattack4 7#c7 ,the term important data means data that is important to the ,united ,states and the incapacity or destruction of such data would have a significant impact on security1 national economic security1 national public health or safety1 or any combination thereof4 7#d7 ,the term necessary data means data1 the incapacity or destruction of which would have a measurable impact on security1 national economic security1 national public health or safety1 or any combination thereof4 7#e7 ,the term recovery time objective means the maximum allowable time the ,secretary of ,defense determines necessary to restore critical functions and data following a cyberattack4 4 7b7 ,clerical amendment ,the table of sections for chapter #ai of title #aj1 ,united ,states ,code1 is amended by inserting after the item relating to section #cia;b the following new item3 #cia;c4 ,data recovery requirements4 4 7c7 ,data recovery strategy 7#a7 ,not later than #ij days after the date of the enactment of this ,act1 the ,secretary of ,defense shall submit to the congressional defense committees a data recovery strategy for the ,department of ,defense that includes information relating to the following3 7,a7 ,recovery time objectives for such strategy4 7,b7 ,the technology necessary for such objectives4 7,c7 ,oversight processes with respect to such strategy4 7,d7 ,the funds necessary to carry out such strategy4 7#b7 ,the strategy under paragraph 7#a7 shall be submitted in unclassified form1 but may contain a classified annex4 7#c7 ,in this subsection1 the term recovery time objective means the maximum allowable time the ,secretary of ,defense determines necessary to restore critical functions and data following a cyberattack4