Letter to House Armed Services Committee on FY 2025 National Defense Authorization Act

July 31, 2024

The Honorable Mike Rogers

Chairman, House Armed Services Committee

2469 Rayburn House Office Building

Washington, DC 20515

The Honorable Adam Smith

Ranking Member, House Armed Services Committee

2264 Rayburn House Office Building

Washington, DC 20515

Dear Chairman Rogers and Ranking Member Smith,

On behalf of the Operational Technology Cybersecurity Coalition (OTCC), I want to thank you for including provisions included in the Fiscal Year (FY) 2025 National Defense Authorization Act (NDAA) related to securing Department of Defense (DoD) Operational Technology (OT). Your leadership in addressing the evolving cybersecurity challenges facing the Department is commendable and vital for our national security.

The OTCC is a diverse group of leading industrial control systems (ICS) and OT cybersecurity vendors. As such, we particularly appreciate the inclusion of Section 1057 which requires the Chairman of the Joint Chiefs to provide to Congress a report that “contains an identification of any existing or new sensor and interceptor capabilities necessary to defend critical infrastructure assets.” We understand this to be a report on the state of the market and not a report on DoD networks. As such, we hope that the report provided by the Chairman of the Joint Chiefs of Staff will give Congress the information it needs to make informed future resource investments in securing defense critical assets and infrastructure.

OTCC also supports Section 1534, which limits travel funds for certain personnel until the Department complies with several provisions included in previous NDAAs. As you know, the Department is not in compliance with Section 1505 of the FY 2022 NDAA, which directs DoD to map its mission-relevant terrain in cyberspace for Defense Critical Assets and Task Critical Assets so that they can be defended from cyber threats. It is essential that DoD fully maps, prioritizes, and protects critical OT assets and functions in order to ensure the reliability of the facilities and weapons systems necessary to defend the United States. While Section 1505 is ambitious in scope, it is a necessary requirement to secure the DoD enterprise.

We look forward to working closely with you and your staff on these critical issues in the future. Together, we can ensure that our nation’s defense infrastructure is robust and resilient against cyber threats.

Thank you once again for your leadership and support.

Sincerely,

Andrew Howell

Executive Director, OTCC