National Defense Data Resilience Act

Key Points

• The bill requires the Department of Defense to classify all of its data into three tiers: critical, important, and necessary. This helps the military prioritize which information needs the fastest recovery after a cyberattack.
• The Secretary of Defense must set strict deadlines for how quickly data must be restored after an attack. Recovery time objectives for critical data must be established within 180 days, and objectives for important and necessary data within 270 days.
• The military must use immutable backups that are separated from main networks. These backups must include continuous monitoring to detect tampering, insider threats, and malicious corruption, ensuring clean copies survive even if primary systems are wiped out.
• Annual recovery exercises simulating nation-state cyberattacks are required, along with independent audits that mimic real attack tactics to test whether each part of the Department of Defense can actually meet its recovery goals.
• The Secretary of Defense must submit a data recovery strategy to Congress within 90 days and provide yearly auditable recovery certification reports, keeping the military accountable to lawmakers on cybersecurity readiness.