National Defense Data Resilience Act
- Sponsor
- Rep. Subramanyam, Suhas [D-VA-10]
- Committees
- Armed Services Committee (primary)
- Last action
- May 7, 2026
Bottom line
The National Defense Data Resilience Act establishes a comprehensive and auditable framework for the Department of Defense to enhance its data resilience and recovery capabilities against sophisticated cyberattacks, focusing on the timely restoration of critical national security data.
What it actually does
This bill amends title 10, United States Code, to mandate that the Secretary of Defense implement resilient capabilities for recovering critical Department of Defense (DoD) data. It requires the DoD to classify data, establish mandatory recovery time objectives for each data type, and field specific data recovery capabilities such as immutable backups, continuous monitoring, annual recovery exercises, and independent audits. The bill also requires the Secretary to submit a comprehensive data recovery strategy to Congress.
Proponents argue
Proponents argue that this bill is a critical and necessary step to safeguard national security in an era of escalating and sophisticated cyber threats from state and non-state actors. They contend that it provides a structured, proactive, and auditable approach to ensure the DoD can rapidly recover essential operations and data following a destructive cyberattack, thereby maintaining military readiness and protecting vital national assets.
Opponents contend
Opponents might raise concerns regarding the aggressive timelines stipulated for implementation, particularly the 180-day and 270-day deadlines for fielding complex technical capabilities across a vast organization like the DoD. They may also point to the potential for significant unfunded mandates on various DoD elements, the prescriptive nature of the technology standards which could limit flexibility or innovation, and the risk of creating unforeseen compatibility or integration challenges with existing systems.
The bill is concise and clearly structured, making it accessible for an informed reader to understand its core provisions within a short timeframe.
Section 2(a), adding new section 391c(a) to title 10, United States Code
Mandatory Recovery Time Objectives (RTOs) for DoD Data
This provision requires the Secretary of Defense to classify all Department of Defense data into three types: critical, important, or necessary. Within 180 days of enactment, mandatory recovery time objectives (RTOs) must be established for critical data, and within 270 days for important and necessary data. These RTOs must be based on data type and threat exposure, and updated in response to evolving intelligence on threats, including from the People's Republic of China. Annually, the Secretary must submit an auditable recovery certification report to Congress.
Supporters argue
Supporters argue that establishing clear, mandatory RTOs is fundamental to ensuring the DoD can rapidly restore essential functions and data after a cyberattack, thereby maintaining operational continuity and national security. The requirement for regular updates based on threat intelligence ensures adaptability.
Critics contend
Critics might contend that the aggressive timelines for establishing RTOs across the entire DoD, especially for critical data, could be challenging to meet effectively given the vastness and complexity of DoD's data landscape. This could lead to rushed or inadequate classifications and objectives.
Tradeoffs
This provision balances the urgent need for data recovery preparedness with the practical challenges of implementing such a comprehensive classification and objective-setting process across a global organization.
Section 2(a), adding new section 391c(b) to title 10, United States Code
Mandatory Data Recovery Capability Requirements
This section mandates that the Secretary of Defense field specific data recovery capabilities. For critical data, these capabilities must be in place within 180 days, and for important/necessary data within 270 days. These capabilities include immutable backups (logically separated, isolated from external networks), continuous monitoring of backup environments, annual recovery exercises simulating sophisticated nation-state cyberattacks, and independent audits mimicking cyberattack tactics to validate recovery abilities.
Section 2(a), adding new section 391c(c) to title 10, United States Code
Approved Technology Standards for Data Recovery
This provision restricts the Secretary of Defense from adopting any technology for data recovery capabilities unless it is listed in a Department of Defense inventory of certified cybersecurity and data protection technology. Furthermore, if the technology is for recovering or repairing damaged data, it must specifically provide for immutable storage, robust recovery capabilities, full audit trails, and continuous monitoring for data integrity and anomalous activity.
Section 2(c)
DoD Data Recovery Strategy Requirement
This section requires the Secretary of Defense to submit a comprehensive data recovery strategy for the Department of Defense to the congressional defense committees within 90 days of the Act's enactment. The strategy must include details on recovery time objectives, necessary technology, oversight processes, and the funds required to carry out the strategy. The strategy is to be submitted in unclassified form, with the option for a classified annex.
This subsection defines 'critical data,' 'important data,' and 'necessary data' based on the debilitating, significant, or measurable impact their incapacity or destruction would have on security, national economic security, or national public health or safety. It also defines 'data recovery capability' and 'recovery time objective.'
Section 2(a), adding new section 391c(d) to title 10, United States Code
Why it matters:This is standard legislative practice for defining terms. It is not intended to be evasive but requires careful reading to understand the full scope of the bill's impact.
Case for: Supporters would argue that precise definitions are crucial for consistent and effective implementation across the diverse elements of the Department of Defense. Clear definitions prevent ambiguity and ensure that the most vital data receives the highest level of protection.
Case against: Critics might suggest that while definitions are necessary, the subjective nature of 'debilitating,' 'significant,' or 'measurable' impact could lead to inconsistencies in data classification across different DoD components, potentially creating vulnerabilities if data is miscategorized.
Estimated impact: These definitions directly determine the scope and prioritization of data recovery efforts across the entire Department of Defense, influencing billions in future spending and national security posture.
This provision mandates that data recovery capabilities must include 'immutable backups' that preserve logically separated copies of data and are selectively segmented or isolated from external networks by means of software, firewalls, or other controls.
Section 2(a), adding new section 391c(b)(1)(B)(i) to title 10, United States Code
Why it matters:This is a technical specification necessary for the operational effectiveness of the bill. It is not evasive but requires domain-specific knowledge to fully appreciate.
Case for: Proponents emphasize that immutable backups are a cornerstone of modern cyber resilience, preventing attackers from tampering with or destroying backup copies, which is often a key objective in sophisticated cyberattacks. Logical separation and network isolation add critical layers of defense.
Case against: Opponents might point out that implementing truly immutable and isolated backup systems across a vast, complex, and often legacy-laden DoD IT environment is an extremely costly and technically challenging endeavor, potentially requiring significant infrastructure overhaul and specialized expertise.
Estimated impact: This requirement will necessitate substantial investment in new storage technologies, network architecture, and cybersecurity expertise across the DoD, potentially costing billions over several years.