Sponsors (2)
Requires DoD to classify data, set recovery time objectives, deploy certified recovery tech, perform annual audits and certifications, and deliver a department-wide recovery strategy.
Official title: To amend title 10, United States Code, to require the Secretary of Defense to implement resilient capabilities to recover critical Department of Defense data in the event such data is lost, degraded, or destroyed, and for other purposes.
Introduced May 7, 2026 by Suhas Subramanyam · Last progress May 7, 2026
This bill significantly strengthens DoD cyber recovery capabilities and accountability to protect missions and inform Congress, but it does so with tight implementation deadlines and prescriptive standards that will raise costs, constrain procurement flexibility, and risk narrowing threat focus.
Military personnel and DoD civilian staff will get stronger operational resilience because the bill requires immutable backups, formal recovery capabilities, and tested recovery procedures that reduce the risk of data-destroying cyberattacks and improve mission continuity.
Taxpayers and Congress will receive clearer, auditable information because the bill mandates a Department-wide data recovery strategy plus annual recovery certifications and independent audits, improving transparency and helping Congress target and authorize funding.
Federal IT and acquisition teams will operate under specified technology standards and a certified inventory, reducing deployment of insecure or noncompliant tools in critical defense systems and lowering risk from poorly vetted solutions.
Taxpayers and DoD programs will face near-term budgetary and scheduling strain because the bill imposes rapid fielding deadlines and recurring exercises/audits within 180–270 days, which could divert funds and staff time from other priorities.
Federal IT teams and state partners may experience slower procurement and reduced access to some commercial innovations because mandated technical standards and inventory restrictions could limit rapid adoption of novel solutions.
Taxpayers and defense programs could incur additional remediation costs and political pressure because annual reporting to congressional defense committees may expose programmatic gaps that require funding or re-prioritization.
Based on analysis of 2 sections of legislative text.
Requires the Department of Defense to classify its data by importance, set mandatory recovery time objectives (RTOs), field certified data-recovery capabilities, and produce annual auditable recovery certifications and a department-wide data recovery strategy. Sets near-term deadlines for RTOs, capability deployment, and reporting, and requires technology used for recovery to meet specified immutability, auditing, and monitoring standards.