10 U.S.C. § 3603

(a) Software Acquisition and Development Pathways .— The Secretary of Defense shall establish pathways as described under subsection (b) to provide for the efficient and effective acquisition, development, integration, and timely delivery of software and covered hardware. (b) Pathways .— The Secretary of Defense may establish as many pathways under this section as the Secretary determines appropriate and shall establish the following pathways: (1) Applications .— The applications pathway shall provide for the use of rapid development and implementation of applications and other software or software improvements operated by the Department of Defense, which may include applications and associated procurement of covered hardware (including modifications of a type not customarily available in the commercial marketplace to meet Department requirements), commercially available cloud computing platforms, and other nondevelopmental items. (2) Embedded systems .— The embedded systems pathway shall provide for the rapid development and insertion of upgrades and improvements for software and covered hardware embedded in weapon systems and other hardware systems unique to the Department of Defense. (c) Requirements for Pathways .— A pathway established under this section shall provide for the use of proven technologies and solutions to continuously engineer and deliver capabilities for software and covered hardware. (d) Considerations for Use of Authority .— In using the authority under this section, the Secretary shall consider how such use will— (1) initiate the engineering of new software capabilities quickly and, if applicable, the integration of such capabilities into covered hardware; (2) demonstrate the viability and effectiveness of such capabilities for operational use not later than one year after the date on which funds are first obligated to acquire or develop software; and (3) allow for the continuous updating and delivery of new capabilities not less frequently than annually to iteratively meet a requirement. (e) Treatment Not as Major Defense Acquisition Program .— Software and covered hardware acquired or developed using the authority under this section shall not be treated as a major defense acquisition program for purposes of section 4201 of title 10 , United States Code, or Department of Defense Directive 5000.01 without the specific designation of such software and covered hardware by the Under Secretary of Defense for Acquisition and Sustainment or a service acquisition executive. (f) Risk-based Approach .— The Secretary of Defense shall use a risk-based approach for the consideration of innovative technologies and new capabilities for software and covered hardware to be acquired or developed under this authority to meet needs communicated by the Joint Chiefs of Staff and the combatant commanders. (g) Expedited Process.— (1) In general .— A pathway established under this section shall provide for— (A) a streamlined and coordinated requirements, budget, and acquisition process to support rapid fielding of software applications and of software upgrades to embedded systems for operational use in a period of not more than one year from the time that the process is initiated; (B) the collection of data on software and covered hardware fielded; and (C) continuous engagement with the users of software and covered hardware to support— (i) engineering activities of the Department of Defense; and (ii) delivery of software and covered hardware for operational use in periods of not more than one year. (2) Expedited software requirements process.— (A) Inapplicability of joint capabilities integration and development system manual .— Software and covered hardware acquisition or development conducted under the authority of this section shall not be subject to the Joint Capabilities Integration and Development System Manual, except pursuant to a modified process specifically provided for the acquisition or development of software by the Vice Chairman of the Joint Chiefs of Staff, in consultation with Under Secretary of Defense for Acquisition and Sustainment and each service acquisition executive. (B) Inapplicability of defense acquisition system directive .— Software and covered hardware acquisition or development conducted under the authority of this section shall not be subject to Department of Defense Directive 5000.01, except when specifically provided for the acquisition or development of software by the Under Secretary of Defense for Acquisition and Sustainment, in consultation with the Vice Chairman of the Joint Chiefs of Staff and each service acquisition executive. (h) Elements .— In implementing a pathway established under the authority of this section, the Secretary shall tailor requirements relating to— (1) iterative development of requirements for software and covered hardware to be acquired or developed under the authority of this section through engagement with the user community and through user feedback, in order to continuously define and update priorities for such requirements; (2) early identification of the warfighter or user needs including the rationale for how software and covered hardware to be acquired or developed under the authority of this section will be tailored to address such needs; (3) initial contract requirements and format, including the use of summary-level lists of problems in existing software and desired features or capabilities of new or upgraded software; (4) continuous refinement and prioritization of contract requirements, informed by continuous engagement with users throughout the period of development and implementation of software and covered hardware to be acquired or developed under this section; (5) continuous consideration of issues related to lifecycle costs, technical data rights, and systems interoperability; (6) planning for support of capabilities of software to be acquired or developed under this section if the software developer stops supporting the software; (7) rapid contracting procedures, including expedited timeframes for making awards, selecting contract types, defining teaming arrangements, and defining options; (8) program execution processes, including supporting development and test infrastructure, automation and tools, digital engineering, data collection and sharing with Department of Defense stakeholders and with Congress, the role of developmental and operational testing activities, key decision-making and oversight events, and supporting processes and activities (such as independent costing activity, operational demonstration, and performance metrics); (9) assurances that cybersecurity metrics of the software to be acquired or developed, such as metrics relating to the density of vulnerabilities within the code of such software, the time from vulnerability identification to patch availability, the existence of common weaknesses within such code, and other cybersecurity metrics based on widely-recognized standards and industry best practices, are generated and made available to the Department of Defense and the congressional defense committees; (10) administrative procedures, including procedures relating to who may initiate and approve an acquisition under this authority, the roles and responsibilities of persons implementing or supporting the use of authority under this section, team selection and staffing process, governance and oversight roles and responsibilities, and appropriate independent technology assessments, testing, and cost estimation (including relevant thresholds or designation criteria); (11) mechanisms and waivers designed to ensure flexibility in the implementation of a pathway under this section, including the use of other transaction authority, broad agency announcements, and other procedures; and (12) mechanisms the Secretary will use for appropriate reporting to Congress on the use of the authority under this section, including notice of initiation of the use of a pathway and data regarding individual programs or acquisition activities, how acquisition activities are reflected in budget justification materials or requests to reprogram appropriated funds, and compliance with other reporting requirements. (i) Definitions .— In this section: (1) The term “covered hardware” means hardware— (A) that is a commercial product (as defined in section 103 of title 41 ) or a nondevelopmental item; and (B) in which software acquired under this section is embedded. (2) The term “nondevelopmental item” has the meaning given in section 110 of title 41 .