National Defense Data Resilience Act

This legislation mandates that the Secretary of Defense implement robust data recovery capabilities across all elements of the Department of Defense. It requires the designation of data as either critical , important , or necessary , and the establishment of mandatory recovery time objectives for each category within 270 days of enactment. These objectives must be based on data type, threat exposure, and updated in response to evolving threats from state and non-state actors, including the People's Republic of China. The bill further requires the fielding of specific data recovery capabilities, including immutable backups , continuous monitoring of backup environments, and annual recovery exercises simulating sophisticated nation-state cyberattacks. It also mandates independent audits to assess and validate the Department's ability to meet recovery objectives under realistic threat conditions. Additionally, the Secretary of Defense must submit a comprehensive data recovery strategy to Congress within 90 days, detailing recovery time objectives, necessary technology, oversight processes, and funding requirements.