Pentagon must build cyberattack-proof data vaults, report to Congress

What it does

This bill requires the Department of Defense to establish and implement a comprehensive data recovery system to protect against cyberattacks. The DoD must classify its data as critical, important, or necessary; set recovery time targets for each category; deploy backup and monitoring systems within 180–270 days; and report annually to Congress on compliance. The bill mandates immutable backups, continuous monitoring for tampering, annual recovery drills simulating nation-state attacks, and independent audits—all using only DoD-approved cybersecurity technology.

Why we flagged it

The bill is a straightforward cybersecurity and data protection requirement for the Department of Defense, mandating specific defensive capabilities and congressional reporting. It is not a tax measure, appropriation, or deregulation—it is a direct operational mandate to harden DoD systems against cyberattacks.

What the text implies

• The bill requires DoD to maintain immutable backups isolated from external networks, which may necessitate significant infrastructure investment and operational changes across all military departments.
• Annual recovery exercises simulating nation-state cyberattacks will consume resources and personnel time but provide valuable intelligence on actual DoD vulnerability to sophisticated threats.
• The requirement to use only DoD-approved technology may create a bottleneck if the approved inventory is limited, potentially delaying implementation or forcing reliance on legacy systems.
• Congressional reporting of recovery time objectives and compliance status creates a public record (unclassified form) that could inadvertently signal DoD vulnerabilities or recovery timelines to adversaries, though the bill permits classified annexes to mitigate this.

Section numbers refer to the bill text the analysis read — linked under Primary records below.

Who it affects

The bill strengthens national defense by requiring the DoD to protect critical military data against cyberattacks, reducing the risk of catastrophic data loss that could compromise national security. Citizens benefit from enhanced resilience of defense systems and mandatory congressional oversight of compliance, improving both security and democratic accountability.

Who stands to gain

• cybersecurity and data protection technology vendors (approved by DoD)
• defense contractors specializing in backup and recovery systems
• consulting firms providing audit and assessment services

Named in the bill

Department of Defense, Secretary of Defense, House Committee on Armed Services, Congressional defense committees, People's Republic of China (mentioned as threat actor)

Where it stands

1 cosponsor: 1 Republicans.

• May 7, 2026 — Introduced · Congress.gov: “Introduced in House”
• May 7, 2026 — Referred to House Committee on Armed Services · Congress.gov: “Referred to the House Committee on Armed Services”

Dates and quoted wording are Congress.gov's action record; the timeline shows status changes, not every procedural step.

Money around this bill

1 lobbying clients named this bill on 1 disclosure filings across 1 quarter, Jun 2026 to Jun 2026. Those filings disclosed $1,560,000 in lobbying spend. A filing names 7 bills on average, so that figure is what each filing reported, not a share belonging to this bill.

More lobbying clients named this bill than 0% of bills with at least one filing.

Suhas Subramanyam, the sponsor, reported $356,670 in PAC receipts in the 2026 cycle.

• Sk Americas, Inc. — $1,560,000 on 1 filing

Lobbying Disclosure Act filings through Jul 20, 2026. A filing shows who paid to lobby on a bill it names, not what changed.