Defense officials would audit cellular hardware from specified suppliers

The defense secretary would identify covered hardware that connects products to cellular networks and assess its security risks. The audit would cover infrastructure the department owns, leases, operates, or controls across all defense branches and activities, including contractor-run systems linked to defense networks or information. Covered suppliers include those identified in a 2019 defense law, those under China’s ownership, control, jurisdiction, or direction, and others the secretary finds pose an unacceptable supply-chain risk. The audit would have to begin within 180 days after enactment.

The defense secretary would report audit findings and plans to address risks to congressional defense committees. Reports would describe ongoing and planned fixes, estimated costs and timelines, needed resources, barriers to completing fixes, and any recommendations for added legal powers. Reports would be unclassified but could include a classified attachment. The first report would be due within one year after enactment, with reports every two years afterward for a period of up to six years.

The Comptroller General would report to congressional defense committees on how the reported work was carried out and how well it worked. The review would examine the activities described in the defense secretary’s report. The review report would be due within 180 days after the defense secretary submits the required report.