,,ii  #aaith ,,congress  #b;d ,session  
,s4 #eeih  ,,in ,,the ,,senate ,,of     
,,the ,,united ,,states  ,september #bi1
 #bjbf,mr4 ,banks introduced the        
following bill2 which was read twice and
 referred to the ,committee on ,armed   
,services  ,a ,,bill  ,to provide for an
 audit and mitigation of covered        
cellular modules in the ,department of  
,defense systems and infrastructure4    
#a4 ,short title ,this ,act may be cited
 as the ,blocking ,foreign ,cellular    
,modules in ,defense ,systems ,act of   
#bjbf4  #b4 ,audit and mitigation of    
covered cellular modules in the         
,department of ,defense systems and     
infrastructure  7a7 ,department of      
,defense audit  7#a7 ,in general ,not   
later than #ahj days after the date of  
the enactment of this ,act1 the         
,secretary of ,defense shall initiate a 
,department-wide audit to identify the  
presence of covered cellular modules    
within covered systems4  7#b7 ,scope    
,the audit required under paragraph 7#a7

 shall-- 7,a7 cover all military        
departments1 combatant commands1 defense
 agencies1 and ,department of ,defense  
activities or programs2  7,b7 prioritize
 covered systems critical to military   
mobility1 logistics1 and installation   
security2  7,c7 include both            
government-owned and contractor-operated
 covered systems connected to           
,department of ,defense networks or     
accessing ,department of ,defense       
information2  7,d7 identify to the      
maximum extent practicable1 the         
manufacturer1 model1 firmware version1  
and host product for each covered       
cellular module identified2 and  7,e7   
assess the cybersecurity risk posed by  
each identified covered cellular module1
 including data flows1 network exposure1
 and potential for remote access4  7b7  
,mitigation and ,reporting  7#a7 ,report
 required ,not later than #a year after 
the date of the enactment of this ,act1 
and biennially thereafter for a period  
not to exceed #f years1 the ,secretary  

shall submit to the congressional       
defense committees a report on the audit
 and mitigation activities carried out  
under this section4  7#b7 ,contents     
,each report submitted under paragraph  
7#a7 shall include the following3 7,a7  
,the preliminary or updated findings of 
the audit required under subsection 7b74
  7,b7 ,a description of ongoing and    
planned mitigation measures1 including--
 7i7 rip-and-replace programs2  7ii7    
accelerated divestiture or retirement of
 legacy assets2  7iii7 network          
segmentation1 isolation1 or compensating
 cybersecurity or engineering controls2 
7iv7 firmware or software remediation2  
and  7v7 supply-chain substitution with 
trusted alternatives4  7,c7 ,cost       
estimates1 timelines1 and resource      
requirements for each category of       
mitigation measure described in         
subparagraph 7,b74  7,d7 ,an            
identification of any statutory1        
regulatory1 or acquisition barriers to  
completing mitigation4  7,e7            

,recommendations for additional         
legislative authorities1 if any1 needed 
to complete mitigation4  7#c7 ,form     
,each report submitted under paragraph  
7#a7 shall be submitted in unclassified 
form1 but may include a classified      
annex4  7c7 ,comptroller ,general report
 ,not later than #ahj days after the    
submission of the report required in    
subsection 7b71 the ,comptroller        
,general of the ,united ,states shall   
submit to the congressional defense     
committees a report on the              
implementation and effectiveness of the 
activities described in subsection 7b74 
7d7 ,definitions ,in this section3 7#a7 
,cellular module ,the term cellular     
module means a modular transmitter1 as  
described in section #ae4bab of title   
#dg1 ,code of ,federal ,regulations1    
that provides cellular connectivity to a
 host product1 including an ,internet of
 things device4  7#b7 ,congressional    
defense committees ,the term            
congressional defense committees has the

 meaning given the term in section      
#aja7;a77#af7 of title #aj1 ,united     
,states ,code4  7#c7 ,covered cellular  
module ,the term covered cellular module
 means any cellular module produced1    
manufactured1 or provided by-- 7,a7 an  
entity identified under section #hhi of 
the ,john ,s4 ,mc,cain ,national        
,defense ,authorization ,act for ,fiscal
 ,year #bjai 7,public ,law #aae-bcb2 #da
 ,u4,s4,c4 #cija note prec472  7,b7 an  
entity that is owned by1 controlled by1 
or subject to the jurisdiction or       
direction of the ,people's ,republic of 
,china2 or  7,c7 any other entity       
determined by the ,secretary of ,defense
 to present an unacceptable supply-chain
 risk4  7#d7 ,covered system ,the term  
covered system means any item of        
infrastructure owned1 leased1 operated1 
or controlled by the ,department of     
,defense4  7#e7 ,internet of things     
device ,the term ,internet of things    
device has the meaning given to such    
term in ,,nist ,special ,publication    

#ahjj-af4