I 
116TH CONGRESS 
2D SESSION 
H. R. 7257 
To direct the Secretary of Defense to carry out activities to develop, secure, 
and effectively implement fifth generation information and communica-
tions technology within the Department of Defense. 
IN THE HOUSE OF REPRESENTATIVES 
JUNE 18, 2020 
Mr. LARSEN of Washington (for himself and Mr. GALLAGHER) introduced the 
following bill; which was referred to the Committee on Armed Services 
A BILL 
To direct the Secretary of Defense to carry out activities 
to develop, secure, and effectively implement fifth genera-
tion information and communications technology within 
the Department of Defense. 
Be it enacted by the Senate and House of Representa-
tives of the United States of America in Congress assembled, 
SECTION 1. TELECOMMUNICATIONS SECURITY PROGRAM. 
(a) PROGRAM REQUIRED.—The Secretary of Defense 
shall carry out a program to identify and mitigate 
vulnerabilities in the telecommunications infrastructure of 
the Department of Defense. 
VerDate Sep 11 2014 
03:15 Jul 11, 2020
Jkt 099200
PO 00000
Frm 00001
Fmt 6652
Sfmt 6201
E:\BILLS\H7257.IH
H7257
kjohnson on DSK79L0C42PROD with BILLS
(b) ELEMENTS.—In carrying out the program under 
subsection (a), the Secretary shall— 
(1) develop a capability to communicate clearly 
and authoritatively about threats by foreign actors; 
(2) conduct independent red-team security anal-
ysis of Department of Defense systems, subsystems, 
devices, and components including no-knowledge 
testing and testing with limited or full knowledge of 
expected functionalities; 
(3) verify the integrity of personnel who are 
tasked with design fabrication, integration, configu-
ration, storage, test, and documentation of non-
commercial 5G technology to be used by the Depart-
ment of Defense; 
(4) verify the efficacy of the physical security 
measures used at Department of Defense locations 
where system design, fabrication, integration, con-
figuration, storage, test, and documentation of 5G 
technology occurs; 
(5) direct the Chief Information Officer of the 
Department of Defense to use the Federal Risk and 
Authorization Management Program (commonly 
known as ‘‘FedRAMP’’) moderate or high cloud 
standard baselines, supplemented with the Depart-
ment’s FedRAMP cloud standard controls and con-
VerDate Sep 11 2014 
03:15 Jul 11, 2020
Jkt 099200
PO 00000
Frm 00002
Fmt 6652
Sfmt 6201
E:\BILLS\H7257.IH
H7257
kjohnson on DSK79L0C42PROD with BILLS
trol enhancements, to assess 5G core service pro-
viders whose services will be used by the Department 
of Defense through the Department’s provisional au-
thorization process; and 
(6) direct the Defense Information Systems 
Agency and the United States Cyber Command to 
Develop a capability for continuous, independent 
monitoring of packet streams for 5G data on fre-
quencies assigned to the Department of Defense to 
validate availability, confidentiality, and integrity of 
Department of Defense communications systems. 
(c) IMPLEMENTATION PLAN.—Not later than 90 
days after the date of the enactment of this Act, the Sec-
retary of Defense shall submit to Congress a plan for the 
implementation of the program under subsection (a). 
(d) REPORT REQUIRED.—Not later than 180 days 
after submitting the plan under subsection (c), the Sec-
retary of Defense shall submit to Congress a report that 
includes— 
(1) a comprehensive assessment of the findings 
and conclusions of the program under subsection 
(a); 
(2) recommendations on how to mitigate 
vulnerabilities in the Department of Defense tele-
communications infrastructure; and 
VerDate Sep 11 2014 
03:15 Jul 11, 2020
Jkt 099200
PO 00000
Frm 00003
Fmt 6652
Sfmt 6201
E:\BILLS\H7257.IH
H7257
kjohnson on DSK79L0C42PROD with BILLS
(3) an explanation of how the Department of 
Defense plans to implement such recommendations. 
Æ 
VerDate Sep 11 2014 
03:15 Jul 11, 2020
Jkt 099200
PO 00000
Frm 00004
Fmt 6652
Sfmt 6301
E:\BILLS\H7257.IH
H7257
kjohnson on DSK79L0C42PROD with BILLS