Source: https://www.law.cornell.edu/uscode/text/10/2223a
Timestamp: 2017-06-25 00:35:20
Document Index: 65433877

Matched Legal Cases: ['§ 2223', '§\u202f2223', '§\u202f805', '§\u202f883', '§\u202f1645', '§\u202f801', '§\u202f854', '§\u202f938', '§\u202f934', '§\u202f931', '§\u202f2867', '§\u202f2853', '§\u202f215', '§\u202f804', '§\u202f881']

10 U.S. Code § 2223a - Information technology acquisition planning and oversight requirements | US Law | LII / Legal Information Institute
§ 2223a.
(b)Program Components.—The program established under subsection (a) shall include—
(2) the development of appropriate metrics that can be implemented and monitored on a real-time basis for performance measurement of—
(Added Pub. L. 111–383, div. A, title VIII, § 805(a)(1), Jan. 7, 2011, 124 Stat. 4259.)
Pub. L. 114–92, div. A, title VIII, § 883(e), Nov. 25, 2015, 129 Stat. 947, provided that: “The Secretary of Defense shall issue guidance for major automated information systems acquisition programs to promote the use of best acquisition, contracting, requirement development, systems engineering, program management, and sustainment practices, including—
ensuring that an acquisition program baseline has been established within two years after program initiation;
ensuring that program requirements have not changed in a manner that increases acquisition costs or delays the schedule, without sufficient cause and only after maximum efforts to reengineer business processes prior to changing requirements;
policies to evaluate commercial off-the-shelf business systems for security, resilience, reliability, interoperability, and integration with existing interrelated systems where such system integration and interoperability are essential to Department of Defense operations;
policies to work with commercial off-the-shelf business system developers and owners in adapting systems for Department of Defense use;
policies to perform Department of Defense legacy system audits to determine which systems are related to or rely upon the system to be replaced or integrated with commercial off-the-shelf business systems;
policies to perform full backup of systems that will be changed or replaced by the installation of commercial off-the-shelf business systems prior to installation and deployment to ensure reconstitution of the system to a functioning state should it become necessary;
policies to engage the research and development activities and laboratories of the Department of Defense to improve acquisition outcomes; and
policies to refine and improve developmental and operational testing of business processes that are supported by the major automated information systems.”
Pub. L. 114–92, div. A, title XVI, § 1645, Nov. 25, 2015, 129 Stat. 1117, provided that:
Not later than 90 days after the date of the enactment of this Act [Nov. 25, 2015], the Secretary of Defense shall designate an entity within a military department to be responsible for the acquisition of each critical cyber capability described in paragraph (2).
“(2)Critical cyber capabilities described.—The critical cyber capabilities described in this paragraph are the cyber capabilities that the Secretary considers critical to the mission of the Department of Defense, including the following:
The Unified Platform described in the Department of Defense document titled ‘The Department of Defense Cyber Strategy’ dated April 15, 2015.
A persistent cyber training environment.
A cyber situational awareness and battle management system.
Not later than 90 days after the date of the enactment of this Act, the Secretary shall submit to the congressional defense committees [Committees on Armed Services and Appropriations of the Senate and the House of Representatives] a report containing the information described in paragraph (2).
“(2)Contents.—The report under paragraph (1) shall include the following with respect to the critical cyber capabilities described in subsection (a)(2):
Identification of each critical cyber capability and the entity of a military department responsible for the acquisition of the capability.
Estimates of the funding requirements and acquisition timelines for each critical cyber capability.
An explanation of whether critical cyber capabilities could be acquired more quickly with changes to acquisition authorities.
Such recommendations as the Secretary may have for legislation or administrative action to improve the acquisition of, or to acquire more quickly, the critical cyber capabilities for which designations are made under subsection (a).”
Pub. L. 113–291, div. A, title VIII, § 801, Dec. 19, 2014, 128 Stat. 3425, provided that:
“(a)Plan for Modular Open Systems Approach Through Development and Adoption of Standards and Architectures.—
Not later than January 1, 2016, the Under Secretary of Defense for Acquisition, Technology, and Logistics shall submit a report to the Committees on Armed Services of the Senate and the House of Representatives detailing a plan to develop standards and define architectures necessary to enable open systems approaches in the key mission areas of the Department of Defense with respect to which the Under Secretary determines that such standards and architectures would be feasible and cost effective.
“(b) Consideration of Modular Open Systems Approaches.—
“(1) Review of acquisition guidance.—The Under Secretary of Defense for Acquisition, Technology, and Logistics shall review current acquisition guidance, and modify such guidance as necessary, to—
ensure that acquisition programs include open systems approaches in the product design and acquisition of information technology systems to the maximum extent practicable; and
for any information technology system not using an open systems approach, ensure that written justification is provided in the contract file for the system detailing why an open systems approach was not used.
“(2)Elements.—The review required in paragraph (1) shall—
“(A) consider whether the guidance includes appropriate exceptions for the acquisition of—
solutions addressing urgent operational needs;
determine the extent to which open systems approaches should be addressed in analysis of alternatives, acquisition strategies, system engineering plans, and life cycle sustainment plans; and
ensure that increments of acquisition programs consider the extent to which the increment will implement open systems approaches as a whole.
“(3)Deadline for review.—
The review required in this subsection shall be completed no later than 180 days after the date of the enactment of this Act [Dec. 19, 2014].
“(c) Treatment of Ongoing and Legacy Programs.—
“(1)Report requirement.—
Not later than one year after the date of the enactment of this Act, the Under Secretary of Defense for Acquisition, Technology, and Logistics shall submit to the Committees on Armed Services of the Senate and the House of Representatives a report covering the matters specified in paragraph (2).
“(2)Matters covered.—Subject to paragraph (3), the report required in this subsection shall—
identify all information technology systems that are in development, production, or deployed status as of the date of the enactment of this Act, that are or were major defense acquisition programs or major automated information systems, and that are not using an open systems approach;
identify gaps in standards and architectures necessary to enable open systems approaches in the key mission areas of the Department of Defense, as determined pursuant to the plan submitted under subsection (a); and
outline a process for potential conversion to an open systems approach for each information technology system identified under subparagraph (A).
“(3)Limitations.—The report required in this subsection shall not include information technology systems—
having a planned increment before fiscal year 2021 that will result in conversion to an open systems approach; and
that will be in operation for fewer than 15 years after the date of the enactment of this Act.
“(1)Information technology.—
The term ‘information technology’ has the meaning given the term in section 11101(6) of title 40, United States Code.
“(2)Open systems approach.—The term ‘open systems approach’ means, with respect to an information technology system, an integrated business and technical strategy that—
employs a modular design and uses widely supported and consensus-based standards for key interfaces;
is subjected to successful validation and verification tests to ensure key interfaces comply with widely supported and consensus-based standards; and
“(C) uses a system architecture that allows components to be added, modified, replaced, removed, or supported by different vendors throughout the lifecycle of the system to afford opportunities for enhanced competition and innovation while yielding—
significant cost and schedule savings; and
Pub. L. 113–291, div. A, title VIII, § 854, Dec. 19, 2014, 128 Stat. 3459, provided that:
Not later than 180 days after the date of the enactment of this Act [Dec. 19, 2014], the Secretary of Defense, acting through the Chief Information Officer of the Department of Defense, shall issue guidance for measuring the operational effectiveness and efficiency of the Joint Information Environment within the military departments, Defense Agencies, and combatant commands. The guidance shall include a definition of specific metrics for data collection, and a requirement for each military department, Defense Agency, and combatant command to regularly collect and assess data on such operational effectiveness and efficiency and report the results to such Chief Information Officer on a regular basis.
“(b)Baseline Architecture.—
The Chief Information Officer of the Department of Defense shall identify a baseline architecture for the Joint Information Environment by identifying and reporting to the Secretary of Defense any information technology programs or other investments that support that architecture.
“(c)Joint Information Environment Defined.—
In this section, the term ‘Joint Information Environment’ means the initiative of the Department of Defense to modernize the information technology networks and systems within the Department.”
Pub. L. 113–66, div. A, title IX, § 938, Dec. 26, 2013, 127 Stat. 835, provided that:
“(1)In general.—The Secretary of Defense shall, acting through the Under Secretary of Defense for Acquisition, Technology, and Logistics, the Under Secretary of Defense for Intelligence, the Chief Information Officer of the Department of Defense, and the Chairman of the Joint Requirements Oversight Council, supervise the following:
Review, development, modification, and approval of requirements for cloud computing solutions for data analysis and storage by the Armed Forces and the Defense Agencies, including requirements for cross-domain, enterprise-wide discovery and correlation of data stored in cloud and non-cloud computing databases, relational and non-relational databases, and hybrid databases.
Review, development, modification, approval, and implementation of plans for the competitive acquisition of cloud computing systems or services to meet requirements described in subparagraph (A), including plans for the transition from current computing systems to systems or services acquired.
Development and implementation of plans to ensure that the cloud systems or services acquired pursuant to subparagraph (B) are interoperable and universally accessible and usable through attribute-based access controls.
Integration of plans under subparagraphs (B) and (C) with enterprise-wide plans of the Armed Forces and the Department of Defense for the Joint Information Environment and the Defense Intelligence Information Environment.
“(2)Direction.—
The Secretary shall provide direction to the Armed Forces and the Defense Agencies on the matters covered by paragraph (1) by not later than March 15, 2014.
“(b)Integration With Intelligence Community Efforts.—
The Secretary shall coordinate with the Director of National Intelligence to ensure that activities under this section are integrated with the Intelligence Community Information Technology Enterprise in order to achieve interoperability, information sharing, and other efficiencies.
The requirements of subparagraphs (B), (C), and (D) of subsection (a)(1) shall not apply to a contract for the acquisition of cloud computing capabilities in an amount less than $1,000,000.
Nothing in this section shall be construed to alter or affect the authorities or responsibilities of the Director of National Intelligence under section 102A of the National Security Act of 1947 (50 U.S.C. 3024).”
Pub. L. 112–239, div. A, title IX, § 934, Jan. 2, 2013, 126 Stat. 1885, as amended by Pub. L. 113–66, div. A, title IX, § 931, Dec. 26, 2013, 127 Stat. 829, provided that:
“(a)Competition in Connection With Tactical Data Link Systems.—Not later than December 1, 2013, the Under Secretary of Defense for Acquisition, Technology, and Logistics shall—
develop an inventory of all tactical data link systems in use and in development in the Department of Defense, including interfaces and waveforms and an assessment of vulnerabilities to such systems in anti-access or area-denial environments;
the upgrade, new deployment, or replacement of such system should be open to competition; or
the data link should be converted to an open architecture, or a different data link standard should be adopted to enable such competition;
for each data link system for which competition is determined advisable under subparagraph (A) or (B) of paragraph (2), develop a plan to achieve such competition, including a plan to address any policy, legal, programmatic, or technical barriers to such competition; and
for each data link system for which competition is determined not advisable under paragraph (2), prepare an explanation for such determination.
“(b)Earlier Actions.—
If the Under Secretary completes any portion of the plan described in subsection (a)(3) before December 1, 2013, the Secretary may commence action on such portion of the plan upon completion of such portion, including publication of such portion of the plan.
At the same time the budget of the President for fiscal year 2015 is submitted to Congress pursuant to section 1105(a) of title 31, United States Code, the Under Secretary shall submit to the congressional defense committees [Committees on Armed Services and Appropriations of the Senate and the House of Representatives] a report on the plans described in paragraph (3) of subsection (a), including any explanation prepared under paragraph (4) of such subsection.”
Pub. L. 112–81, div. B, title XXVIII, § 2867, Dec. 31, 2011, 125 Stat. 1704, as amended by Pub. L. 112–239, div. B, title XXVIII, § 2853, Jan. 2, 2013, 126 Stat. 2161, provided that:
“(A)Before performance plan.—
During the period beginning on the date of the enactment of this Act [Dec. 31, 2011] and ending on May 1, 2012, a department, agency, or component of the Department of Defense may not obligate funds for a data server farm or data center unless approved by the Chief Information Officer of the Department of Defense or the Chief Information Officer of a component of the Department to whom the Chief Information Officer of the Department has specifically delegated such approval authority.
“(B)Under performance plan.—
After May 1, 2012, a department, agency, or component of the Department may not obligate funds for a data center, or any information systems technology used therein, unless that obligation is in accordance with the performance plan required by subsection (b) and is approved as described in subparagraph (A).
An approval of the obligation of funds may not be granted under paragraph (1)(A) unless the official granting the approval determines, in writing, that existing resources of the agency, component, or element concerned cannot affordably or practically be used or modified to meet the requirements to be met through the obligation of funds.
“(B)Under performance plan.—An approval of the obligation of funds may not be granted under paragraph (1)(B) unless the official granting the approval determines that—
existing resources of the Department do not meet the operation requirements to be met through the obligation of funds; and
the proposed obligation is in accordance with the performance standards and measures established by the Chief Information Officer of the Department under subsection (b).
Not later than 30 days after the end of each calendar quarter, each Chief Information Officer of a component of the Department who grants an approval under paragraph (1) during such calendar quarter shall submit to the Chief Information Officer of the Department a report on the approval or approvals so granted during such calendar quarter.
“(A)In general.—Not later than January 15, 2012, the Secretaries of the military departments and the heads of the Defense Agencies shall each submit to the Chief Information Officer of the Department a plan for the department or agency concerned to achieve the following:
A reduction in the square feet of floor space devoted to information systems technologies, attendant support technologies, and operations within data centers.
A reduction in the use of all utilities necessary to power and cool information systems technologies and data centers.
An increase in multi-organizational utilization of data centers, information systems technologies, and associated resources.
A reduction in the investment for capital infrastructure or equipment required to support data centers as measured in cost per megawatt of data storage.
A reduction in the number of commercial and government developed applications running on data servers and within data centers.
A reduction in the number of government and vendor provided full-time equivalent personnel, and in the cost of labor, associated with the operation of data servers and data centers.
“(B)Specification of required elements.—
The Chief Information Officer of the Department shall specify the particular performance standards and measures and implementation elements to be included in the plans submitted under this paragraph, including specific goals and schedules for achieving the matters specified in subparagraph (A).
Not later than April 1, 2012, the Chief Information Officer of the Department shall submit to the congressional defense committees [Committees on Armed Services and Appropriations of the Senate and the House of Representatives] a performance plan for a reduction in the resources required for data centers and information systems technologies Department-wide. The plan shall be based upon and incorporate appropriate elements of the plans submitted under paragraph (1).
“(B)Elements.—The performance plan required under this paragraph shall include the following:
A Department-wide performance plan for achieving the matters specified in paragraph (1)(A), including performance standards and measures for data centers and information systems technologies, goals and schedules for achieving such matters, and an estimate of cost savings anticipated through implementation of the plan.
Desktop, laptop, and mobile device virtualization.
Transitioning to cloud computing.
Migration of Defense data and government-provided services from Department-owned and operated data centers to cloud computing services generally available within the private sector that provide a better capability at a lower cost with the same or greater degree of security.
Utilization of private sector-managed security services for data centers and cloud computing services.
A finite set of metrics to accurately and transparently report on data center infrastructure (space, power and cooling): age, cost, capacity, usage, energy efficiency and utilization, accompanied with the aggregate data for each data center site in use by the Department in excess of 100 kilowatts of information technology power demand.
Transitioning to just-in-time delivery of Department-owned data center infrastructure (space, power and cooling) through use of modular data center technology and integrated data center infrastructure management software.
“(3)Responsibility.—
The Chief Information Officer of the Department shall discharge the responsibility for establishing performance standards and measures for data centers and information systems technologies for purposes of this subsection. Such responsibility may not be delegated.
“(c)Exceptions.—
“(1)Intelligence components.—
The Chief Information Officer of the Department and the Chief Information Officer of the Intelligence Community may jointly exempt from the applicability of this section such intelligence components of the Department of Defense (and the programs and activities thereof) that are funded through the National Intelligence Program (NIP) as the Chief Information Officers consider appropriate.
“(2)Research, development, test, and evaluation programs.—
The Chief Information Officer of the Department may exempt from the applicability of this section research, development, test, and evaluation programs that use authorization of appropriations for the High Performance Computing Modernization Program (Program Element 0603461A) if the Chief Information Officer determines that the exemption is in the best interest of national security.
Not later than March 1 of each fiscal year, and ending in fiscal year 2016, the Chief Information Officer of the Department shall submit to the appropriate committees of Congress a report on the cost savings, cost reductions, cost avoidances, and performance gains achieved, and anticipated to be achieved, as of the date of such report as a result of activities undertaken under this section.
Pub. L. 111–383, div. A, title II, § 215, Jan. 7, 2011, 124 Stat. 4165, provided that:
“(1)Projects required.—
The Secretary of Defense and the Secretaries of the military departments shall jointly carry out demonstration projects to assess the feasibility and advisability of using various business models and processes to rapidly and effectively identify innovative commercial technologies and apply such technologies to Department of Defense and other cybersecurity requirements.
“(2)Scope of projects.—
Any demonstration project under paragraph (1) shall be carried out in such a manner as to contribute to the cyber policy review of the President and the Comprehensive National Cybersecurity Initiative.
“(b)Pilot Programs on Cybersecurity Required.—The Secretary of Defense shall support or conduct pilot programs on cybersecurity with respect to the following areas:
Threat sensing and warning for information networks worldwide.
Managed security services for cybersecurity within the defense industrial base, military departments, and combatant commands.
Use of private processes and infrastructure to address threats, problems, vulnerabilities, or opportunities in cybersecurity.
Processes for securing the global supply chain.
Processes for threat sensing and security of cloud computing infrastructure.
“(1)Reports required.—
Not later than 240 days after the date of the enactment of this Act [Jan. 7, 2011], and annually thereafter at or about the time of the submittal to Congress of the budget of the President for a fiscal year (as submitted pursuant to section 1105(a) of title 31, United States Code), the Secretary of Defense shall, in coordination with the Secretary of Homeland Security, submit to Congress a report on any demonstration projects carried out under subsection (a), and on the pilot projects carried out under subsection (b), during the preceding year.
“(2)Elements.—Each report under this subsection shall include the following:
A description and assessment of any activities under the demonstration projects and pilot projects referred to in paragraph (1) during the preceding year.
a quantitative and qualitative assessment of the extent to which managed security services covered by the pilot project could provide effective and affordable cybersecurity capabilities for components of the Department of Defense and for entities in the defense industrial base, and an assessment whether such services could be expanded rapidly to a large scale without exceeding the ability of the Federal Government to manage such expansion; and
an assessment of whether managed security services are compatible with the cybersecurity strategy of the Department of Defense with respect to conducting an active, in-depth defense under the direction of United States Cyber Command.
a description of any performance metrics established for purposes of the pilot project, and a description of any processes developed for purposes of accountability and governance under any partnership under the pilot project; and
an assessment of the role a partnership such as a partnership under the pilot project would play in the acquisition of cyberspace capabilities by the Department of Defense, including a role with respect to the development and approval of requirements, approval and oversight of acquiring capabilities, test and evaluation of new capabilities, and budgeting for new capabilities.
a framework and taxonomy for evaluating practices that secure the global supply chain, as well as practices for securely operating in an uncertain or compromised supply chain;
an assessment of the viability of applying commercial practices for securing the global supply chain; and
an assessment of the viability of applying commercial practices for securely operating in an uncertain or compromised supply chain.
an assessment of the capabilities of Federal Government providers to offer secure cloud computing environments; and
an assessment of the capabilities of commercial providers to offer secure cloud computing environments to the Federal Government.
Each report under this subsection shall be submitted in unclassified form, but may include a classified annex.”
Pub. L. 111–84, div. A, title VIII, § 804, Oct. 28, 2009, 123 Stat. 2402, provided that:
“(a)New Acquisition Process Required.—The Secretary of Defense shall develop and implement a new acquisition process for information technology systems. The acquisition process developed and implemented pursuant to this subsection shall, to the extent determined appropriate by the Secretary—
“(b)Report to Congress.—Not later than 270 days after the date of the enactment of this Act [Oct. 28, 2009], the Secretary of Defense shall submit to the Committees on Armed Services of the Senate and the House of Representatives a report on the new acquisition process developed pursuant to subsection (a). The report required by this subsection shall, at a minimum—
describe the new acquisition process;
provide an explanation for any decision by the Secretary to deviate from the criteria established for such process in paragraphs (1) and (2) of subsection (a);
provide a schedule for the implementation of the new acquisition process;
identify the categories of information technology acquisitions to which such process will apply; and
include the Secretary’s recommendations for any legislation that may be required to implement the new acquisition process.”
Pub. L. 110–181, div. A, title VIII, § 881, Jan. 28, 2008, 122 Stat. 262, provided that:
“(a)Requirement to Establish Clearinghouse.—
Not later than 180 days after the date of the enactment of this Act [Jan. 28, 2008], the Secretary of Defense, acting through the Assistant Secretary of Defense for Networks and Information Integration, shall establish a clearinghouse for identifying, assessing, and disseminating knowledge about readily available information technologies (with an emphasis on commercial off-the-shelf information technologies) that could support the warfighting mission of the Department of Defense.
“(b)Responsibilities.—The clearinghouse established pursuant to subsection (a) shall be responsible for the following:
aligning priorities and needs with the requirements of the commanders of the combatant command; and
proposing recommendations to the commanders of the combatant command of feasible technical solutions for further evaluation.
Identifying and assessing emerging commercial technologies (including commercial off-the-shelf technologies) that could support the warfighting mission of the Department of Defense, including the priorities and needs identified pursuant to paragraph (1).
Disseminating information about commercial technologies identified pursuant to paragraph (2) to commanders of combatant commands and other potential users of such technologies.
Identifying gaps in commercial technologies and working to stimulate investment in research and development in the public and private sectors to address those gaps.
Enhancing internal data and communications systems of the Department of Defense for sharing and retaining information regarding commercial technology priorities and needs, technologies available to meet such priorities and needs, and ongoing research and development directed toward gaps in such technologies.
Developing mechanisms, including web-based mechanisms, to facilitate communications with industry regarding the priorities and needs of the Department of Defense identified pursuant to paragraph (1) and commercial technologies available to address such priorities and needs.
Assisting in the development of guides to help small information technology companies with promising technologies to understand and navigate the funding and acquisition processes of the Department of Defense.
Developing methods to measure how well processes developed by the clearinghouse are being utilized and to collect data on an ongoing basis to assess the benefits of commercial technologies that are procured on the recommendation of the clearinghouse.
The Secretary of Defense, acting through the Assistant Secretary of Defense for Networks and Information Integration, shall provide for the hiring and support of employees (including detailees from other components of the Department of Defense and from other Federal departments or agencies) to assist in identifying, assessing, and disseminating information regarding commercial technologies under this section.
Not later than one year after the date of the enactment of this Act [Jan. 28, 2008], the Secretary of Defense shall submit to the congressional defense committees [Committees on Armed Services and Appropriations of the Senate and the House of Representatives] a report on the implementation of this section.”