Cybersecurity Policy Report, Defense Bill Would Require New Cyber Requirements for Some DoD Telecom Contracts, (Dec 8, 2025)
The Department of Defense would have to add new cybersecurity requirements to its contracts for telecom services when those services are used for “sensitive national security functions” under legislation released yesterday by the House Armed Services Committee.
The committee released a compromise version of the National Defense Authorization Act (NDAA) for Fiscal Year 2026 (S.B. 1071, 119th Cong. (2025)). The compromise bill, negotiated over several weeks by a House-Senate conference committee, reconciles differences between the House and Senate versions of the NDAA.
“Beginning not later than 90 days after the date of enactment of this Act, the Secretary of Defense shall ensure that each wireless mobile phone the Department of Defense provides to a senior official of the Department or any other employee of the Department who performs sensitive national security functions, as determined by the Secretary, and all related telecommunications services are acquired under contracts or other agreements that require ... enhanced cybersecurity protections,” the bill says.
The enhanced protections would have to include (1) “encryption of data on the wireless mobile phones and of all telecommunications to and from the wireless mobile phones,” (2) the ability to “obfuscate persistent device identifiers ... to reduce the risk of inappropriate tracking of the activity or location of the wireless mobile phones,” and (3) “the capability to continuously monitor the wireless mobile phones.”
Other provisions of the compromise NDAA would seek to “harmonize” cybersecurity requirements for defense contractors and require DoD to work with other federal agencies to find ways to deter foreign adversaries from attacking U.S. “defense critical infrastructure” in cyberspace.
On the deterrence issue, DoD would be required to “conduct a study on the use of military capabilities to increase the costs of, and consequently reduce the incentives of adversaries for, targeting defense critical infrastructure in cyberspace,” the bill says.
The study would have to assess “the cyber capabilities and intent of adversaries regarding attacks against defense critical infrastructure” and evaluate “the roles and relative effectiveness of military capabilities, including offensive cyber operations, both independent and integrated with other military capabilities and non-cyber measures, in credibly and in a scalable manner reducing the incentives of, by increasing the costs to, adversaries to target defense critical infrastructure in cyberspace,” according to the bill.
Congress has passed NDAAs annually since 1961, and the compromise text of the 2026 version will be presented to the House and Senate before year-end for lawmakers’ consideration. The House Rules Committee is scheduled to consider the bill tomorrow at 4 p.m. in Room H-313 of the Capitol.
MainStory: TopStory FederalLegislation DataSecurity