House defense bill restructures cyber authority and supply-chain review; DOD names innovation advisors

The House Armed Services Committee has advanced three distinct policy changes in its annual defense authorization bill that shift how the Pentagon manages cyber operations and reviews technology supply chains. Inside Defense reports that the bill realigns DOD cyber responsibilities, mandates expanded zero-trust architecture provisions, and codifies new open-source software security requirements. A separate provision incorporates legislation to revamp the Federal Acquisition Security Council, the interagency body that coordinates supply-chain security reviews for federal technology procurements.

The FASC restructuring is the most consequential piece. The council was established in 2018 to assess and exclude high-risk vendors from federal contracts, but it has operated with minimal transparency and uneven enforcement. The House bill does not yet specify what "revamp" means in statutory terms—whether it expands membership, changes voting thresholds, or mandates published guidance on exclusion criteria. The language in prior drafts has varied. Until the conference text is published, the market should treat this as a signal of intent, not a specification of new authority.

The cyber realignment provisions appear to consolidate oversight of departmentwide zero-trust implementation, which has been fragmented across service branches and component agencies since the 2021 White House executive order. The open-source software language likely responds to concerns raised after the Log4j vulnerability in late 2021 and subsequent supply-chain compromises. The House bill does not appear to ban open-source dependencies outright but may require attestation or software bill-of-materials disclosures for contractors.

Separately, Inside Defense reports that the Pentagon has named fifteen appointees to a new science and innovation panel. The panel's mandate and reporting line are not specified in the coverage. If it reports to the Under Secretary of Defense for Research and Engineering, it will carry more weight in program-of-record decisions than if it is advisory to the Secretary's office. Personnel appointments are often the earliest observable signal of where the department intends to direct dual-use and emerging-technology funding in the next budget cycle.

The House bill's provisions will move to conference with the Senate, where timing and scope often shift. The FASC language, in particular, has been debated for two budget cycles. Publication of the enacted rule—and then the enforcement guidance—will lag the authorization by quarters, not weeks.