Defense Department to Audit Foreign Modules

Summary#

The Blocking Foreign Cellular Modules in Defense Systems Act of 2026 would create a new law; it does not amend an existing Act. It would require the Secretary of Defense to audit Department of Defense (DoD) systems for certain cellular modules and report on mitigation efforts. Its stated goal is to provide for an audit and mitigation of these modules; the bill does not guarantee their removal.

  • Within 180 days after enactment, the Secretary must start a department-wide audit covering military departments, combatant commands, defense agencies, and DoD activities and programs. The audit must prioritize systems critical to military mobility, logistics, and installation security.
  • The audit must include contractor-operated systems connected to DoD networks or accessing DoD information, as well as government-owned systems. It must identify module details to the extent practicable and assess cybersecurity risks.
  • “Covered” modules include those made, manufactured, or provided by entities identified under a cited 2019 law; entities owned or controlled by, or subject to the jurisdiction or direction of, China; or other entities the Secretary finds pose an unacceptable supply-chain risk.
  • The Secretary must report to congressional defense committees within a year, then every two years for no more than six years. Reports must describe ongoing and planned mitigation measures, their estimated costs and timelines, barriers, and any need for more legal authority.
  • The Comptroller General must report on implementation and effectiveness within 180 days after the Secretary’s report.

What it means for you#

  • DoD departments, agencies, and programs: The Secretary must start the audit and report its findings and planned or ongoing responses.
  • Contractors: Their systems are included if they are connected to DoD networks or access DoD information. The bill does not directly require contractors to replace or remove modules.
  • DoD and taxpayers: The bill requires audit and reporting work, but does not itself order a rip-and-replace, retirement, or other specific mitigation action. It does not create a public application process or a direct service for individuals.
  • General public: The reports must be submitted in unclassified form but may include a classified annex. The bill does not say they must be published publicly.

Money#

No publicly available information on the cost of the audit or the bill’s overall cost.

  • The bill requires audit and reporting work but provides no funding amount or cost estimate for that work.
  • Reports must include cost estimates, timelines, and resource needs for mitigation measures; those estimates are to be produced after enactment.

What is unclear#

  • The bill does not set a deadline for completing the audit or require a particular mitigation action after a module is found.
  • It does not set rules for how the Secretary decides that a supply-chain risk is “unacceptable.”
  • The bill does not explain how audit findings will be handled, or what oversight, appeal, or public-disclosure process applies.
  • A report provision refers to the audit required under subsection (b), but the audit requirement is in subsection (a). The intended reference appears unclear from the text.
  • The cited 2019 law and the NIST publication are not included in the supplied material, so their relevant details cannot be verified here.

Case for#

  • A department-wide audit could give DoD a clearer picture of where covered modules are used and what risks they may pose.
  • Prioritizing systems important to mobility, logistics, and installation security focuses the audit on areas the bill identifies as critical.
  • Including contractor-operated systems could help avoid gaps where systems connected to DoD networks or information are not government-owned.
  • Requiring reports on costs, timelines, barriers, and possible additional legal authority could help Congress assess what mitigation would require.

Case against#

  • The bill requires an audit and reports but does not require DoD to remove or replace any identified modules. That could leave mitigation dependent on later decisions.
  • The Secretary can designate other entities as unacceptable supply-chain risks, but the bill does not explain the criteria or process for doing so.
  • The audit and reporting duties require resources, but the bill provides no funding amount or estimate.
  • The bill does not set a completion deadline for the audit or explain how findings will lead to decisions about particular systems.