FY2021 NDAA, Division A, Title VIII, Section 801 ("Report on acquisition risk assessment and mitigation as part of Adaptive Acquisition Framework implementation")

Summary

Requires each Department of Defense service acquisition executive to submit to the Secretary of Defense, the Under Secretary of Defense for Acquisition and Sustainment, the Under Secretary of Defense for Research and Engineering, and the Chief Information Officer a report on how they are assessing, mitigating, and reporting risks in acquisition programs.

Requires the reports described above to cover, among other risk categories, technical risks in engineering, software, manufacturing and testing; integration and interoperability risks posed by changes to Department systems created by artificial intelligence; and supply chain risks, including those related to cybersecurity and the defense industrial base's potential inability to produce technology and systems as needed.

Requires the Under Secretary of Defense for Acquisition and Sustainment to submit to the congressional defense committees a report on their own views, and the views of the service acquisition executives, with regard to the risk mitigation measures covered herein.

Requires service acquisition executives to assess, mitigate, and report acquisition risks to Defense Department and Congress.

SEC. 801. REPORT ON ACQUISITION RISK ASSESSMENT AND MITIGATION AS PART OF ADAPTIVE ACQUISITION FRAMEWORK IMPLEMENTATION.

(a) IN GENERAL.—Each service acquisition executive shall submit to the Secretary of Defense, the Under Secretary of Defense for Acquisition and Sustainment, the Under Secretary of Defense for Research and Engineering, and the Chief Information Officer of the Department of Defense a report on how such service acquisition executive is, with respect to the risks in acquisition programs described in subsection (b)— (1) assessing such risks; (2) mitigating such risks; and (3) reporting within the Department of Defense and to Congress on such risks.

Identifies acquisition program risks in technical, integration, operations, workforce, and supply chain aspects.

(b) ACQUISITION PROGRAM RISKS.—The risks in acquisition programs described in this subsection are the following: (1) Technical risks in engineering, software, manufacturing and testing. (2) Integration and interoperability risks, including complications related to systems working across multiple domains while using machine learning and artificial intelligence capabilities to continuously change and optimize system performance. (3) Operations and sustainment risks, including as mitigated by appropriate sustainment planning earlier in the lifecycle of a program, access to technical data, and intellectual property rights. (4) Workforce and training risks, including consideration of the role of contractors as part of the total workforce. (5) Supply chain risks, including cybersecurity, foreign control and ownership of key elements of supply chains, and the consequences that a fragile and weakening defense industrial base, combined with barriers to industrial cooperation with allies and partners, pose for delivering systems and technologies in a trusted and assured manner.

Requires the Under Secretary to submit a report to congressional defense committees by March 31, 2021.

(c) REPORT TO CONGRESS.—Not later than March 31, 2021, the Under Secretary of Defense for Acquisition and Sustainment shall submit to the congressional defense committees a report including— (1) the input received from the service acquisition executives pursuant to subsection (a); and (2) the views of the Under Secretary with respect to the matters described in paragraphs (1) through (5) of subsection (b).