Pentagon orders massive data-backup overhaul with no budget cap
H.R. 8710 — National Defense Data Resilience Act · Filed by Suhas Subramanyam (D-VA) · 1 cosponsor · Introduced May 7, 2026 · Referred to committee
Your members of Congress
Enter a ZIP to see where your representative and both senators stood on this bill.
Looked up on this device — your ZIP is never stored on our servers.
What it does
This bill requires the Department of Defense to establish mandatory data recovery and resilience standards across all its elements to protect against cyberattacks. The SecDef must classify DoD data as critical, important, or necessary; set recovery time targets for each category; deploy backup and recovery technologies meeting specific standards (immutable backups, continuous monitoring, annual cyberattack simulations); and submit annual certification reports to Congress. The bill mandates use of only DoD-certified cybersecurity technologies and requires submission of a comprehensive data recovery strategy within 90 days.
Why we flagged it
The bill establishes mandatory data recovery and resilience requirements for DoD systems in response to cyberattack threats. It is primarily a regulatory/operational mandate requiring the Secretary of Defense to implement specific technical and governance standards across all DoD elements.
What the text implies
- Mandates substantial new spending on cybersecurity infrastructure and data recovery technologies across all DoD elements, with no explicit budget cap or appropriation limit specified in the bill text.
- The requirement for 'approved technology standards' from a DoD inventory may create de facto procurement preferences for vendors already certified in the DoD system, potentially limiting competition for new entrants.
The full analysis lists 5 implications of this text.
Who stands to gain
Cybersecurity software and hardware vendors; Data backup and recovery technology providers; Defense contractors with IT infrastructure divisions