AUTHORITY FOR CONTINUOUS INTEGRATION AND DELIVERY OF SOFTWARE APPLICATIONS AND UPGRADES TO EMBEDDED SYSTEMS.

SEC. 800. AUTHORITY FOR CONTINUOUS INTEGRATION AND DELIVERY OF SOFTWARE APPLICATIONS AND UPGRADES TO EMBEDDED SYSTEMS.(a) Software Acquisition and Development Pathways.—The Secretary of Defense shall establish pathways as described under subsection (b) to provide for the efficient and effective acquisition, development, integration, and timely delivery of secure software. Such a pathway shall include the following:(1) Use of proven technologies and solutions.—A pathway established under this section shall provide for the use of proven technologies and solutions to continuously engineer and deliver capabilities in software.(2) Use of authority.—In using the authority under this section, the Secretary shall consider how such use will—(A) initiate the engineering of new software capabilities quickly;(B) demonstrate the viability and effectiveness of such capabilities for operational use not later than one year after the date on which funds are first obligated to acquire or develop software; and(C) allow for the continuous updating and delivery of new capabilities not less frequently than annually to iteratively meet a requirement.(3) Treatment not as major defense acquisition program.—Software acquired or developed using the authority under this section shall not be treated as a major defense acquisition program for purposes of section 2430 of title 10, United States Code, or Department of Defense Directive 5000.01 without the specific direction of the Under Secretary of Defense for Acquisition and Sustainment or a Senior Acquisition Executive.(4) Risk-based approach.—The Secretary of Defense shall use a risk-based approach for the consideration of innovative technologies and new capabilities for software to be acquired or developed under this authority to meet needs communicated by the Joint Chiefs of Staff and the combatant commanders.(b) Pathways.—The Secretary of Defense may establish as many pathways as the Secretary determines appropriate and shall establish the following pathways:(1) Applications.—The applications software acquisition pathway shall provide for the use of rapid development and implementation of applications and other software or software improvements operated by the Department of Defense, which may include applications running on commercial commodity hardware (including modified hardware) and commercially available cloud computing platforms.(2) Embedded systems.—The embedded systems software acquisition pathway shall provide for the rapid development and insertion of upgrades and improvements for software embedded in weapon systems and other military-unique hardware systems.(c) Expedited Process.—133 STAT. 1479(1) In general.—A pathway established under subsection (a) shall provide for—(A) a streamlined and coordinated requirements, budget, and acquisition process to support rapid fielding of software applications and of software upgrades to embedded systems for operational use in a period of not more than one year from the time that the process is initiated;(B) the collection of data on software fielded; and(C) continuous engagement with the users of software to support engineering activities, and to support delivery of software for operational use in periods of not more than one year.(2) Expedited software requirements process.—(A) Inapplicability of joint capabilities integration and development system (jcids) manual.—Software acquisition or development conducted under the authority of this section shall not be subject to the Joint Capabilities Integration and Development System Manual, except pursuant to a modified process specifically provided for the acquisition or development of software by the Vice Chairman of the Joint Chiefs of Staff, in consultation with Under Secretary of Defense for Acquisition and Sustainment and each service acquisition executive (as defined in section 101(a)(10) of title 10, United States Code).(B) Inapplicability of defense acquisition system directive.—Software acquisition or development conducted under the authority of this section shall not be subject to Department of Defense Directive 5000.01, except when specifically provided for the acquisition or development of software by the Under Secretary of Defense for Acquisition and Sustainment, in consultation with the Vice Chairman of the Joint Chiefs of Staff and each service acquisition executive.(d) Elements.—In implementing a pathway established under the authority of this section, the Secretary shall tailor requirements relating to—(1) iterative development of requirements for software to be acquired or developed under the authority of this section through engagement with the user community and through the use of operational user feedback, in order to continuously define and update priorities for such requirements;(2) early identification of the warfighter or user need, including the rationale for how software capabilities will support increased lethality and efficiency, and identification of a relevant user community;(3) initial contract requirements and format, including the use of summary-level lists of problems and shortcomings in existing software and desired features or capabilities of new or upgraded software;(4) continuous refinement and prioritization of contract requirements through use of evolutionary processes, informed by continuous engagement with operational users throughout the development and implementation period;(5) continuous consideration of issues related to lifecycle costs, technical data rights, and systems interoperability;133 STAT. 1480(6) planning for support of software capabilities in cases where the software developer may stop supporting the software;(7) rapid contracting procedures, including expedited timeframes for making awards, selecting contract types, defining teaming arrangements, and defining options;(8) program execution processes, including supporting development and test infrastructure, automation and tools, digital engineering, data collection and sharing with Department of Defense oversight organizations and with Congress, the role of developmental and operational testing activities, key decision making and oversight events, and supporting processes and activities (such as independent costing activity, operational demonstration, and performance metrics);(9) assurances that cybersecurity metrics of the software to be acquired or developed, such as metrics relating to the density of vulnerabilities within the code of such software, the time from vulnerability identification to patch availability, the existence of common weaknesses within such code, and other cybersecurity metrics based on widely-recognized standards and industry best practices, are generated and made available to the Department of Defense and the congressional defense committees;(10) administrative procedures, including procedures related to who may initiate and approve an acquisition under this authority, the roles and responsibilities of the implementing project or product teams and supporting activities, team selection and staffing process, governance and oversight roles and responsibilities, and appropriate independent technology assessments, testing, and cost estimation (including relevant thresholds or designation criteria);(11) mechanisms and waivers designed to ensure flexibility in the implementation of a pathway under this section, including the use of other transaction authority, broad agency announcements, and other procedures; and(12) mechanisms the Secretary will use for appropriate reporting to Congress on the use of this authority, including notice of initiation of the use of a pathway and data regarding individual programs or acquisition activities, how acquisition activities are reflected in budget justification materials or requests to reprogram appropriated funds, and compliance with other reporting requirements.(e) Guidance Required.—(1) In general.—Not later than 90 days after the date of the enactment of this Act, the Secretary of Defense shall issue initial guidance to implement the requirements of this section.(2) Limitation.—If the Secretary of Defense has not issued final guidance to implement the requirements of this section before October 1, 2021, the Secretary may not use the authority under this section—(A) to establish a new pathway to acquire or develop software; or(B) to continue activities to acquire or develop software using a pathway established under initial guidance described in paragraph (1).(f) Report.—133 STAT. 1481(1) In general.—Not later than October 15, 2020, the Under Secretary of Defense for Acquisition and Sustainment, in consultation with the secretaries of the military departments and other appropriate officials, shall report on the use of the authority under this section using the initial guidance issued under subsection (d).(2) Elements.—The report required under paragraph (1) shall include the following elements:(A) The final guidance required by subsection (d)(2), including a description of the treatment of use of the authority that was initiated before such final guidance was issued.(B) A summary of how the authority under this section has been used, including a list of the cost estimate, schedule for development, testing and delivery, and key management risks for each initiative conducted pursuant to such authority.(C) Accomplishments from and challenges to using the authority under this section, including organizational, cultural, talent, infrastructure, testing, and training considerations.(D) Recommendations for legislative changes to the authority under this section.(E) Recommendations for regulatory changes to the authority under this section to promote effective development and deployment of software acquired or developed under this section.