,,ii #aaith ,,congress #b;d ,session ,s4 #dicj ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,june #bd1 #bjbf,mr4 ,mc,cormick 7for himself and ,ms4 ,rosen7 introduced the following bill2 which was read twice and referred to the ,committee on ,armed ,services ,a ,,bill ,to require the ,secretary of ,defense to assess and report on the feasibility of incorporating open-architecture1 unmanned system command and control frameworks into ,department of ,defense unmanned system operations across all unmanned system tiers and domains1 drawing on lessons from allied and partner country systems1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,unmanned ,system ,command and ,control ,integration ,assessment ,act of #bjbf4 #b4 ,assessment of unmanned system command and control frameworks 7a7 ,assessment required ,not later than #ahj days after the date of the enactment of this ,act1 the ,secretary shall1 in coordination with the ,chairman of the ,joint ,chiefs of ,staff1 the ,under ,secretary of ,defense for ,acquisition and ,sustainment1 the ,secretary of ,defense for ,research and ,engineering1 the ,chief ,information ,officer1 ,joint ,interagency ,task ,force #dja1 the ,director of the ,defense ,information ,systems ,agency1 the ,commander of ,joint ,interoperability ,test ,command1 and the ,secretaries of the military departments1 commence a comprehensive assessment of open-architecture1 unmanned system command and control frameworks with demonstrated operational effectiveness4 7b7 ,scope of allied and partner system review ,the assessment commenced under subsection 7a7 shall review each of the following allied and partner country unmanned systems command and control frameworks and may include such additional frameworks as the ,secretary determines appropriate3 7#a7 ,ukraine's ,delta battlefield management and unmanned aircraft systems coordination system1 including an analysis of its technical architecture1 its operational effectiveness in contested environments1 the interoperability and integration lessons learned from its deployment that are applicable to ,united ,states ,armed ,forces unmanned aircraft systems command and control operations1 and its cybersecurity resilience under active electronic warfare and cyber attack4 7#b7 ,israel's ,multiple ,drone ,operating ,system1 including an analysis of its technical architecture1 its demonstrated operational effectiveness in managing simultaneous civilian1 commercial1 and military unmanned aircraft systems operations1 the interoperability and integration lessons learned from its deployment that are applicable to ,united ,states ,armed ,forces unmanned aircraft systems command and control operations1 and its cybersecurity and emergency prioritization mechanisms4 7c7 ,elements of assessment ,the assessment commenced under subsection 7a7 shall address1 at a minimum1 each of the following elements3 7#a7 ,architectural analysis1 including-- 7,a7 a comparative analysis of the technical architectures of the unmanned systems command and control frameworks reviewed1 including data formats1 communication protocols1 interface standards1 and software design approaches2 7,b7 an evaluation of the degree to which each framework employs open-architecture and modular open-systems architecture principles2 and 7,c7 an identification of the architectural characteristics most associated with operational effectiveness1 adaptability1 and resilience in contested environments4 7#b7 ,unmanned systems tier compatibility1 including-- 7,a7 an evaluation of each framework's capacity to manage all unmanned systems within a single integrated command and control environment2 7,b7 an identification of the technical and doctrinal barriers to command and control interoperability across unmanned systems s within a single framework2 and 7,c7 a recommendation for the minimum capability requirements a ,department unmanned systems command and control framework must meet to support effective employment of unmanned systems across all in a joint operational environment4 7#c7 ,interoperability with existing ,department systems1 including-- 7,a7 a detailed assessment of the compatibility and interoperability requirements for integrating an open-architecture unmanned system command and control framework with current and future ,department command and control modernization1 as designated by the ,secretary at the time of the assessment2 7,b7 an identification of the interface standards1 data translation requirements1 and technical integration pathways that would be necessary to achieve such interoperability2 and 7,c7 an assessment of the risks associated with integration1 including cybersecurity risks arising from connecting an open-architecture system to existing classified networks4 7#d7 ,cybersecurity and future-proofing1 including-- 7,a7 an assessment of the cybersecurity posture of each framework reviewed1 including its resilience to electronic warfare1 ,global ,positioning ,system denial1 communications jamming1 and software-based cyber attack in active contested environments2 7,b7 a recommendation for a cybersecurity standards framework or updates to the ,risk ,management ,framework of the ,national ,institute of ,standards and ,technology applicable to a ,department unmanned system command and control system that-- 7i7 is based on the ,cybersecurity ,framework #b4j1 published by the ,national ,institute of ,standards and ,technology1 and applicable special publications of the ,institute1 and is designed to incorporate updated guidance from the ,institute without requiring legislative action2 7ii7 incorporates a comprehensive supply chain risk management strategy2 7iii7 implements robust data-centric security controls1 including end-to-end data encryption1 data tagging for automated policy enforcement1 and accredited cross-domain solutions to prevent compromise between classification levels and to enable secure data interoperability with mission partners2 7iv7 establishes vulnerability disclosure and patch management standards enabling timely response to newly identified threats without requiring system-wide redesign2 7v7 specifies a recurring review cycle of not less than once every #ah months to update cybersecurity standards as the ,national ,institute of ,standards and ,technology and other relevant standards bodies publish new guidance1 without requiring legislative action2 and 7vi7 mandates alignment with ,zero ,trust ,architecture 7,,zta71 ensuring all data1 applications1 assets1 and services are managed with the assumption that the network is already compromised2 7,c7 an assessment of how the architecture of the framework can accommodate future unmanned systems technologies1 including autonomous systems1 artificial intelligence-enabled targeting and deconfliction1 swarming capabilities1 and beyond-visual-line-of-sight operations1 without requiring full system replacement2 and 7,d7 a recommended technology refresh cycle and associated governance process for keeping a ,department unmanned system command and control framework current with advancing technology and evolving threats4 7#e7 ,tactical adaptability and field-level flexibility1 including-- 7,a7 an assessment of the mechanisms within each framework reviewed that enable tactical-level operators and commanders to modify1 adapt1 or extend command and control functionality without depending on centralized software updates or acquisition processes1 drawing on documented examples from the conflict in ,ukraine where unmanned aircraft systems tactics evolved within weeks in response to adversary countermeasures2 7,b7 a recommended design approach for a ,department framework that preserves appropriate security and safety controls while enabling tactical-level customization1 including through the use of application programming interfaces1 modular software components1 and operator-accessible configuration tools2 and 7,c7 an assessment of the doctrinal1 training1 and organizational changes required to enable and sustain field-level innovation within a structured command and control architecture4 7#f7 ,classification and technology transfer1 including-- 7,a7 an assessment of the classification implications of a ,department unmanned system command and control framework1 including recommendations for which components may operate at unclassified levels to maximize interoperability with allied and commercial systems1 and which must be classified2 7,b7 an assessment of the technology transfer and foreign military sales implications of the frameworks reviewed1 including intellectual property and national security considerations associated with adopting or adapting systems developed by or with foreign partners2 and 7,c7 recommendations for information-sharing arrangements with other ,united ,states ,government organizations1 allies1 and partner nations that would facilitate ongoing exchange of unmanned systems command and control lessons learned and technical standards4 7#g7 ,implementation roadmap1 including-- 7,a7 a recommended phased implementation approach for developing and fielding a ,department unmanned system command and control framework1 including recommended near-term pilot programs or exercises that could demonstrate technical feasibility and operational utility2 7,b7 an estimate of the resources1 including funding1 personnel1 and acquisition authorities1 required to develop and field the recommended framework2 and 7,c7 an identification of existing ,department programs1 platforms1 and acquisition vehicles that could serve as the basis for or be accelerated by an unmanned system command and control capability4 #c4 ,independent ,advisory ,panel 7a7 ,establishment ,not later than #fj days after the date of the enactment of this ,act1 the ,secretary shall establish an independent advisory panel 7in this section referred to as the ,panel7 to provide independent review and technical guidance to the assessment required under section #b4 7b7 ,composition ,the ,panel shall consist of not fewer than #aj and not more than #ae members appointed by the ,secretary1 including-- 7#a7 not fewer than two individuals who have direct operational experience in unmanned aircraft systems employment in a joint or combined military environment2 7#b7 not fewer than two individuals who have technical expertise in open-architecture software systems1 modular systems design1 or command and control software architecture2 7#c7 not fewer than two individuals who have expertise in cybersecurity1 including experience with operational technology cybersecurity in contested environments2 7#d7 at least three individuals who have expertise in unmanned aircraft systems command and control operations1 doctrine1 or command and control from an allied or partner country with significant unmanned aircraft systems operational experience1 appointed in coordination with relevant allied or partner country authorities2 7#e7 at least one individual with experience in unmanned aircraft system 7,,uas7 traffic management in the ,national ,airspace ,system2 and 7#f7 such additional members as the ,secretary determines appropriate1 which may include representatives from the defense industrial base1 federally funded research and development centers1 academic institutions with relevant expertise1 and the ,department of ,defense test and evaluation community to ensure early consideration to interoperability1 testability1 and certification requirements4 7c7 ,limit on active ,government employees ,not more than two-thirds of the members of the ,panel may be a full-time officer or employee of the ,united ,states ,government4 7d7 ,duties ,the ,panel shall provide written assessments and recommendations on each element of the assessment described in section #b7;c7 and shall have the opportunity to review and comment on draft findings before finalization4 7e7 ,termination ,the ,panel shall terminate on the date that is #ij days after the date of the submittal of the final report required under section #d7;b74 7f7 ,compensation ,members of the ,panel who are not full-time officers or employees of the ,united ,states ,government shall be compensated at a daily rate equal to the daily equivalent of the annual rate of basic pay for level ,,iv of the ,executive ,schedule under section #ecae of title #e1 ,united ,states ,code1 for each day they are engaged in the performance of ,panel duties and shall be allowed travel expenses as authorized under section #egjc of title #e1 ,united ,states ,code4 #d4 ,reports to ,congress 7a7 ,interim report ,not later than #ahj days after the date of the enactment of this ,act1 the ,secretary shall submit to the congressional defense committees an interim report on the status of the assessment required under section #b1 which shall include-- 7#a7 an identification of any additional allied and partner country frameworks selected for review and analysis beyond those specified in section #b7;b72 7#b7 a summary of findings from the architectural analysis required under section #b7;c77#a72 7#c7 a preliminary assessment of interoperability requirements under section #b7;c77#c72 and 7#d7 any significant findings or challenges identified to date4 7b7 ,final report ,not later than one year after the date of the enactment of this ,act1 the ,secretary shall submit to the congressional defense committees a final report containing the complete findings and recommendations of the ,secretary with respect to the assessment required under section #b4 ,the final report shall include-- 7#a7 a determination as to whether the development of a ,department unmanned system command and control framework based on open-architecture principles is feasible1 operationally necessary1 and cost-effective2 7#b7 if the determination under paragraph 7#a7 is affirmative1 a recommended framework architecture1 phased implementation roadmap1 and legislative or regulatory actions required to proceed2 7#c7 if the determination under paragraph 7#a7 is negative or qualified1 a description of the specific barriers identified and recommendations for addressing them2 and 7#d7 a classified annex1 as appropriate1 containing any elements that the ,secretary determines must be protected from public disclosure for national security reasons4 7c7 ,form ,reports required under this section shall be submitted in unclassified form1 but may include a classified annex4 ,unclassified portions shall be made publicly available on the ,department public website not later than #cj days after submission4 7d7 ,annual update ,for a period of five years following submission of the final report under subsection 7b71 the ,secretary shall submit to the congressional defense committees1 as part of the annual budget justification materials submitted to ,congress in support of the budget of the ,department 7as submitted with the budget of the ,president under section #aaje7;a7 of title #ca1 ,united ,states ,code71 an update describing-- 7#a7 actions taken by the ,department in response to the recommendations of the ,secretary contained in the final report2 7#b7 material changes in allied or partner country unmanned systems command and control frameworks or practices relevant to the assessment's conclusions2 7#c7 emerging unmanned systems technologies or cybersecurity threats that would materially affect the recommended framework architecture2 and 7#d7 the status of any pilot programs1 exercises1 or acquisition activities initiated pursuant to the recommendations of the ,secretary contained in the final report4 #e4 ,cybersecurity standards for any recommended framework 7a7 ,requirements ,any unmanned system command and control framework recommended in the final report required under section #d7;b71 and any system developed or procured pursuant to such a recommendation1 shall-- 7#a7 employ a modular open systems architecture that permits individual software and hardware components to be updated1 replaced1 or patched in response to identified cybersecurity vulnerabilities without requiring redesign of the system as a whole2 7#b7 apply a supply chain risk management framework throughout the asset's and component's lifecycles2 7#c7 comply with the most current version of the ,cybersecurity ,framework #b4j published by the ,national ,institute of ,standards and ,technology and applicable special publications of the ,institute1 as updated from time to time1 without requiring amendment of this ,act to conform to new guidance2 7#d7 include a documented vulnerability disclosure policy and a process for receiving1 triaging1 and patching reported vulnerabilities within defined response time standards established by the ,secretary2 and 7#e7 undergo penetration testing by a ,national ,security ,agency-certified red team not less frequently than once every two years following initial fielding1 with findings reported to the ,principal ,cyber ,advisor and1 in summary form1 to the congressional defense committees4 7b7 ,exclusion of covered foreign entities ,no software1 hardware1 or service produced1 provided1 or operated by an entity on the ,federal ,communications ,commission ,covered ,list established under section #b of the ,secure and ,trusted ,communications ,networks ,act of #bjai 7#dg ,u4,s4,c4 #afja71 or on the ,department of ,defense ,covered ,foreign ,entity list maintained pursuant to section #dhgb of title #aj1 ,united ,states ,code1 may be incorporated into any unmanned system command and control framework developed1 procured1 or fielded pursuant to this ,act4 7c7 ,living standards process ,the ,secretary shall1 in coordination with the ,director of the ,national ,security ,agency1 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 and the ,chief ,information ,officer of the ,department1 establish a process for reviewing and updating the cybersecurity standards applicable to a framework developed pursuant to this ,act on a recurring basis of not less than once every #ah months1 to ensure such standards remain current with the evolving threat environment and applicable ,federal standards without requiring legislative action4 #f4 ,coordination with existing ,department of ,defense programs 7a7 ,required coordination ,in conducting the assessment required under section #b1 the ,secretary shall ensure that the unmanned system command and control framework under consideration is assessed for compatibility with all current ,department command and control modernization programs of record1 as designated by the ,secretary at the time of the assessment4 ,the ,secretary shall update this assessment as the portfolio of such programs evolves1 ensuring that recommendations remain current with the ,department's command and control modernization activities regardless of changes in program names1 structures1 or priorities4 7b7 ,avoidance of duplication ,in developing recommendations under section #b1 the ,secretary shall assess whether existing programs of record identified under subsection 7a7 can be extended or adapted to provide the unmanned system command and control capability described in this ,act without developing a wholly new system and shall include in the final report a determination as to whether such extension or adaptation is technically feasible and operationally preferable4 7c7 ,domestic unmanned aircraft systems industrial base compatibility ,the ,secretary shall ensure that the assessment and any recommended framework account for the domestic small unmanned aircraft systems industrial base remediation efforts undertaken pursuant to section #iad of the ,national ,defense ,authorization ,act for ,fiscal ,year #bjbf 7#aj ,u4,s4,c4 #dhaa note71 including ensuring that unmanned aircraft systems platforms produced through those programs are compatible with any recommended command and control framework4 #g4 ,sharing of findings with the ,federal ,aviation ,administration 7a7 ,transmission of findings ,not later than the date that is #cj days after the date of the submittal of the final report under section #d7;b71 the ,secretary shall transmit to the ,administrator of the ,federal ,aviation ,administration an unclassified summary of the findings and recommendations included in the report1 with particular attention to findings regarding-- 7#a7 open architecture and modular design principles applicable to unmanned system command and control systems2 7#b7 cybersecurity standards and frameworks evaluated or recommended for ,department unmanned aircraft systems command and control systems that may have applicability to civil unmanned aircraft systems traffic management infrastructure2 7#c7 technical standards and interface specifications that could support interoperability between military and civil unmanned aircraft systems operations in shared airspace2 and 7#d7 lessons learned from systems of allied and partner countries of the ,united ,states1 regarding the integration of military1 commercial1 and civil unmanned aircraft systems operations within a unified airspace management framework4 7b7 ,purpose ,the purpose of subsection 7a7 is to inform any ,federal ,aviation ,administration planning1 rulemaking1 or feasibility assessment related to civil unmanned aircraft system traffic management1 beyond visual line of sight operations1 or national airspace integration1 including any activities undertaken pursuant to a feasibility assessment directed by ,congress regarding a national unmanned aircraft systems traffic management system4 ,nothing in this section shall be construed to require the ,secretary to disclose any classified information to the ,administrator4 7c7 ,federal ,aviation ,administration response ,not later than the date that is #ahj days after the date on which the ,administrator receives the summary transmitted under subsection 7a71 the ,administrator shall submit to the congressional defense committees1 the ,committee on ,commerce1 ,science1 and ,transportation of the ,senate1 and the ,committee on ,transportation and ,infrastructure of the ,house of ,representatives a written assessment of the relevance of such findings to ,federal ,aviation ,administration civil unmanned aircraft systems airspace integration activities and any actions the ,federal ,aviation ,administration intends to take in response4 #h4 ,funding ,amounts obligated or expended by the ,secretary to carry out this ,act shall be derived from amounts appropriated to the ,department for research1 development1 test1 and evaluation4 #i4 ,definitions ,in this ,act3 7#a7 ,command and control framework ,the term command and control framework means the software architecture1 communications protocols1 data standards1 interface specifications1 and associated hardware that together enable an operator or commander to task1 direct1 monitor1 and receive data from one or more unmanned aircraft systems4 7#b7 ,congressional defense committees ,the term congressional defense committees has the meaning given that term in section #aja7;a7 of title #aj1 ,united ,states ,code4 7#c7 ,department ,the term ,department means the ,department of ,defense4 7#d7 ,modular open systems architecture ,the term modular open systems architecture has the meaning given to that term in section #ddja7;c7 of title #aj1 ,united ,states ,code1 and means a design approach in which key interfaces are defined by widely supported and consensus-based standards1 enabling components to be added1 modified1 replaced1 or removed with minimal impact to the remainder of the system4 7#e7 ,open architecture ,the term open architecture means a system design based on published1 consensus-developed interface standards that permit systems from multiple vendors to interoperate1 and that permits components to be updated1 replaced1 or added without redesign of the system as a whole4 7#f7 ,secretary ,the term ,secretary means the ,secretary of ,defense1 unless otherwise specified4