United StatesDefense Department would audit cellular modules for supply-chain risks
The Defense Department would search its systems for certain cellular connection parts, assess their cyber risks, and report ongoing and planned responses to Congress.
What it does
Within 180 days after enactment, the Defense Secretary would start a department-wide search for covered cellular connection parts and assess the cyber risk of each one found.
Starting one year after enactment and then every two years for up to six years, the Defense Secretary would give Congress unclassified reports on findings and risk-reduction plans. A classified annex would be allowed.
Within 180 days after the Defense Secretary submits the required report, the Comptroller General would report on how the audit and risk-reduction activities are being carried out and whether they work.
Argument forFinding risky modules and mapping their network access could help officials target protections before those parts are remotely exploited.
Argument againstThe broad audit and repeated detailed reports could take staff time and resources away from other defense work.
More detail
The Defense Secretary would start a department-wide audit and assess the cyber risk of each covered cellular module found. The audit would cover infrastructure the department owns, leases, operates, or controls across all military departments, commands, agencies, activities, and programs. It would include government-owned and contractor-operated systems connected to department networks or information. The audit would focus first on systems important to military movement, logistics, and base security. Covered modules are cellular connection parts supplied by entities identified under a referenced federal law, entities under China's ownership, control, direction, or jurisdiction, or others the Secretary finds pose an unacceptable supply-chain risk. For each module found, officials would identify details such as its maker, model, software version, and host product as far as practical. The Secretary would have to start the audit no later than 180 days after enactment.
The Defense Secretary would submit recurring reports to Congress's defense committees on the audit and efforts to reduce risk. Reports would cover audit findings and ongoing or planned responses, such as replacing modules, isolating networks, updating software, or using trusted suppliers. They would also include estimated costs, schedules, resource needs, barriers, and any recommended legal authority. Each report would be submitted in unclassified form, but it could include a classified annex. The first report would be due within one year after enactment. Further reports would be due every two years for no longer than six years.
The Comptroller General would report to Congress's defense committees on how the activities are being carried out and whether they work. The review would cover the activities described in the Defense Secretary's audit and mitigation report. The Comptroller General's report would be due no later than 180 days after submission of the required Defense Secretary report.
Where do you stand?
Choose your position
Tell your reps
Take a position to see your representatives and ways to contact them.
Where it stands
- Introduced
- Passed Senate
- Passed House
- To President
- Became Law
Looking ahead
No hearings or votes scheduled.
History
- 2026
- Sep 29Introduced in SenateLatest
- Sep 29Read twice and referred to the Committee on Armed Services.Introduced
National SecurityTechnologyGovernment & Ethics