BALANCING SECURITY AND INNOVATION IN SOFTWARE DEVELOPMENT AND ACQUISITION.

SEC. 835. [10 U.S.C. 4571 note] BALANCING SECURITY AND INNOVATION IN SOFTWARE DEVELOPMENT AND ACQUISITION. (a) Requirements for Solicitations of Commercial and Developmental Solutions.—The Under Secretary of Defense for Acquisition and Sustainment, in coordination with the Chief Information Officer of the Department of Defense, shall develop requirements for appropriate software security criteria to be included in solicitations for commercial and developmental solutions and the evaluation of bids submitted in response to such solicitations, including a delineation of what processes were or will be used for a secure software development life cycle. Such requirements shall include— (1) establishment and enforcement of secure coding practices; (2) management of supply chain risks and third-party software sources and component risks; (3) security of the software development environment; (4) secure deployment, configuration, and installation processes; and (5) an associated vulnerability management plan and identification of tools that will be applied to achieve an appropriate level of security. (b) Security Review of Code.—The Under Secretary of Defense for Acquisition and Sustainment, in coordination with the Chief Information Officer of the Department of Defense, shall develop— (1) procedures for the security review of code; and (2) other procedures necessary to fully implement the pilot program required under section 875 of the National Defense Authorization Act for Fiscal Year 2018 (Public Law 115-91; 10 U.S.C. 2223 note). (c) Coordination With Cybersecurity Acquisition Policy Efforts.—The Under Secretary of Defense for Acquisition and Sustainment shall develop the requirements and procedures described under subsections (a) and (b) in coordination with the efforts of the Department of Defense to develop new cybersecurity and program protection policies and guidance that are focused on cybersecurity in the context of acquisition and program management and on safeguarding information.