To direct the Secretary of Defense to establish a framework relating to risks to the defense supply chain, and for other purposes.

To direct the Secretary of Defense to establish a framework relating to risks to the defense supply chain, and for other purposes. 1. Defense supply chain risk assessment framework (a) In general Not later than one year after the date of the enactment of this Act, the Secretary of Defense shall establish a framework, which may be included as part of a framework developed under section 2509 of title 10, United States Code, and pursuant to recommendations provided under section 5 of Executive Order 14017 (86 Fed. Reg. 11849, relating to America’s supply chains), to consolidate the information relating to risks to the defense supply chain that is collected by the elements of the Department of Defense to— (1) enable Department-wide risk assessments of the defense supply chain; and (2) support the development of strategies to mitigate risks to the defense supply chain. (b) Framework requirements The framework established under subsection (a) shall— (1) provide for the collection, management, and storage of data from the supply chain risk management processes of the Department of Defense; (2) provide for the collection of reports on supply chain risk management from the military departments and Defense Agencies, and the dissemination of such reports to the components of the military departments and Defense Agencies involved in the management of supply chain risk; (3) enable all elements of the Department to analyze the information collected by such framework to identify risks to the defense supply chain; (4) enable the Department to— (A) assess the capabilities of foreign adversaries (as defined in section 8(c) of the Secure and Trusted Communications Networks Act of 2019 ( 47 U.S.C. 1607(c) (B) analyze the ability of the industrial base of the United States to meet the needs of the defense supply chain; (C) track global technology trends that could affect the defense supply chain, as determined by the Secretary of Defense; and (D) assess the risks posed by emerging threats to the defense supply chain; (5) support the identification of technology in which the Department may invest to reduce risks to the defense supply chain, including by improving the resilience of the defense supply; and (6) provide for— (A) a map of the supply chains for major end items that supports analysis, monitoring, and reporting with respect to high-risk subcontractors and risks to such supply chain; and (B) the use of a covered application described in subsection (c) in the creation of such map to assess risks to the supply chain for major end items by business sector, vendor, program, part, or technology. (c) Covered application described The covered application described in this subsection is a covered application that includes the following elements: (1) A centralized database that consolidates multiple disparate data sources into a single repository to ensure the consistent availability of data. (2) Centralized reporting to allow for efficient mitigation and remediation of identified supply chain vulnerabilities. (3) Broad interoperability with other software and systems to ensure support for the analytical capabilities of users across the Department. (4) Scalable technology to support multiple users, access controls for security, and functionality designed for information-sharing and collaboration. (d) Guidance Not later than 180 days after the framework required under subsection (a) is established, and regularly thereafter, the Secretary of Defense shall issue guidance on mitigating risks to the defense supply chain. (e) Reports (1) Progress report Not later than 180 days after the date of the enactment of this Act, the Secretary of Defense shall submit to the congressional defense committees a report on the progress of establishing the framework as required under subsection (a). (2) Final report Not later than one year after the date of the enactment of this Act, the Secretary of Defense shall submit to the congressional defense committees a report describing the framework established under subsection (a) and the organizational structure to manage and oversee the framework. (f) Definitions In this section: (1) Covered application The term covered application (2) Defense Agency; military department The terms Defense Agency military department (3) High-risk subcontractors The term high-risk subcontractor (4) Major end item The term major end item Item Unique Identification (IUID) Standards for Tangible Personal Property

Summary: This bill requires the Department of Defense (DOD) to establish a framework to consolidate the information regarding risks to the defense supply chain to enable department-wide risk assessments and support the development of strategies to mitigate such risks. The framework required by the bill may be included as a part of the framework developed pursuant to recommendations provided under section five of Executive Order 14017 (86 Fed. Reg. 11849), which relates to U.S. supply chains. After the framework is established, DOD must regularly issue guidance on mitigating risks to the defense supply chain.