Lawmakers Call for Check on Software Acquisition Requirements in Defense Bill

The next National Defense Authorization Act should require the department to report on the use of ‘digital twins’—to better continually track software development—during the procurement process, according to the House Armed Services Committee.

Digital twins are described as virtual versions of physical products that can provide more insight into their security throughout their lifecycles. The related provisions align with others seeking to balance agile acquisition and development with security and to clean up old, unsupported, “legacy” technology cluttering—and endangering—the department.

“The committee is concerned that many acquisition programs do not develop digital twins at all, or they develop twins that are not adequate for test and evaluation purposes,” reads a proposal from the committee’s panel on Cyber, Innovative Technologies and Information Systems, which committee aides said is fully included in Chairman Adam Smith’s markup of the legislation. 

Committee aides briefing reporters on the legislation Friday said the chairman’s mark—which will be publicly available on Monday in advance of a full committee markup scheduled for Wednesday—also included additional cybersecurity provisions. They highlighted one that would create a program office within the Joint Force Headquarters of the Department of Defense Information Network to centralize management of cyber threats [and] information products.  

The committee’s plan for the department’s management of information products— leading up from previous NDAAs outlining a Software Acquisitions Pathway—requires more visibility into them and they want to ensure officials are tracking their use from start to finish.

“The determination of a digital twin’s adequacy is a lengthy process often appended to the development of a model later, and at a time when most resources have already been exhausted. When the digital twin evolves from an engineering baseline as the program develops, the adequacy of that twin can evolve in a more iterative and incremental way that builds a body of evidence over time,” reads the subcommittee mark. “The committee believes the use of digital twins must be a more prevalent practice in the Department of Defense.”

As such, their legislation would instruct the defense secretary, consulting with the under secretary of defense for research and engineering and director of operational test and evaluation, to report to Congress by March 1, 2022, on the department’s current use of digital twins and, if they are using them, whether they’re good enough and how they might be improved.

The use of digital twins seems especially applicable to the cybersecurity of weapons programs where the department has failed to use modern software practices, according to the Government Accountability Office. The new NDAA would require that lethality and survivability testing at selected military branches must address non-kinetic threats, specifically including cyber attacks.

And the legislation would require all military branches to identify legacy systems and software for potential discontinuation, with an exemption for those that are already scheduled to go out of use within 180 days. 

“This section would mandate that each military service initiate an effort to account for the legacy information technology systems, applications, and software,” according to the subcommittee mark. “Efforts to discover and inventory legacy IT systems, applications, and software ensure that redundant and unnecessary investments can be better aligned to departmental priorities.”

The lawmakers also call for a hearing by April, 1, 2022 on endpoint monitoring in general, noting that the department's vulnerabilities reside in various endpoint devices, “with each service and component possibly taking unique approaches” toward tracking them. 

Resources saved from moving away from redundant legacy systems may go instead to helping the department make more timely use of emerging technology for specific missions. The committee calls for an evaluation, by March 31, of the Defense Innovation Unit, which would play a role in bridging the often referenced “valley of death” that the acquisition process can represent.  

“As I’ve said before, the strategy behind how the Department spends the money is much more important than how much money is allocated,” Chairman Smith said Friday in response to the department’s budget proposal. “I look forward to thorough bipartisan hearings and discussions with DoD leadership on the budget request to better understand how the interim National Security Strategic Guidance and the Administration’s policies shaped this budget request as we construct this year’s National Defense Authorization Act.”

“The committee is concerned that the Defense Innovation Unit does not have an adequate size and composition of personnel to accomplish its mission,” the lawmakers wrote.

Other provisions in the legislation look to ensure the Joint Artificial Intelligence Center makes effective use of its data and that the office of the chief information officer can execute the data strategy it developed in 2020.