National Defense Authorization Act for Fiscal Year 2022, Section 1511 ("Comparative analysis of cybersecurity capabilities")

• Authority: United States Congress
• Parent authority: Federal government
• Jurisdiction: United States
• Collections: NDAA provisions;U.S. federal laws
• Most recent activity: Enacted
• Most recent activity date: 2021-12-27

Risk subdomain coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the risk subdomain are explicitly described.

• AI system security vulnerabilities

Minimal coverage — Brief mention but no specific mitigations, recommendations or governance measures relating to the risk subdomain are described.

• Compromise of privacy
• Cyberattacks, weapon development or use
• Competitive dynamics
• Governance failure
• Lack of capability or robustness

All other risk subdomains had no coverage in this document.

Risk Coverage Summary

The document has minimal coverage of risk domains, with primary focus on AI system security (2.2) through cybersecurity tool analysis. There is implicit coverage of governance failure (6.5) through requirements for comparative analysis of security capabilities, and minimal coverage of competitive dynamics (6.4) through emphasis on maintaining cybersecurity capabilities. The document is primarily operational/technical rather than risk-focused.

Sector coverage

Good coverage — Comprehensive governance measures or mitigations with clear procedures relating to the sector are explicitly described.

• National Security

All other sectors had no coverage in this document.

Sectors Summary

This document exclusively governs the National Security sector, specifically addressing cybersecurity capabilities within the Department of Defense and military departments. It does not regulate private sector activities or other government sectors beyond national defense.

Legislative Status

Hard Law

Legislative Status Summary

This is a binding legislative provision enacted by the United States Congress as part of the National Defense Authorization Act for Fiscal Year 2022. It contains mandatory obligations with specific deadlines and enforcement through congressional oversight.

Actors

Proposer

• Entity Types: AI_Governance_Actor
• Entities: United States Congress
• Summary: The document is Section 1511 of the National Defense Authorization Act for Fiscal Year 2022, which is enacted by the United States Congress as the legislative authority.

Target

• Entity Types: AI_Governance_Actor
• Entities: Chief Information Officer of the Department of Defense; Director of Cost Assessment and Program Evaluation (CAPE) of the Department of Defense; Principal Cyber Advisor to the Secretary of Defense; Chief Information Officers of each of the military departments; Director of the National Security Agency; Director of the Defense Information Systems Agency
• Summary: The document targets specific Department of Defense officials and agencies who are required to conduct the comparative analysis and provide briefings. These are government entities responsible for implementing the cybersecurity analysis requirements.

Enforcer

• Entity Types: AI_Governance_Actor
• Entities: congressional defense committees
• Summary: The congressional defense committees serve as the enforcement mechanism through oversight, receiving mandatory briefings on the analysis findings and recommendations.

Monitor

• Entity Types: AI_Governance_Actor
• Entities: congressional defense committees
• Summary: The congressional defense committees monitor implementation through required briefings within 30 days of analysis completion, allowing them to track compliance and outcomes.

AI Lifecycle Stages

Lifecycle stages covered by the documents, as defined in the OECD Framework for the Classification of AI Systems

• Plan and Design
• Build and Use Model
• Verify and Validate
• Deploy
• Operate and Monitor

AI Lifecycle Summary

The document primarily covers the Verify and Validate stage through comparative analysis of cybersecurity capabilities, and the Operate and Monitor stage through assessment of deployed security tools and systems. It also touches on Build and Use Model through evaluation of AI/ML capabilities in security tools.

Technical Scope

Terms relating to technical scope that are mentioned or implicitly referenced in the document

• AI Models
• AI Systems
• Task-specific AI

Technical Scope Summary

The document explicitly mentions AI systems through references to artificial intelligence and machine-learning capabilities in cybersecurity tools. It does not mention frontier AI, general purpose AI, foundation models, or specific compute thresholds. The focus is on AI/ML capabilities integrated into security and productivity tools.