Key cybersecurity takeaways from the 2026 NDAA
On Dec. 7, the House and Senate Homeland Security Committees released their compromise version of the 2026 National Defense and Authorization Act (NDAA), a nearly 3,100-page piece of legislation that contains a host of provisions to fund several Department of Defense cybersecurity efforts in fiscal year 2026.
Although cybersecurity is referenced hundreds of times across the NDAA, the legislation contains provisions that, once the law becomes effective, will mark significant shifts in how the US military manages major cybersecurity tasks, particularly in the timely arena of protecting mobile communications of top brass and AI deployments, as well as more understated, but potentially high-impact, infosec duties.
Although numbers chronically vary widely for NDAA cyber expenses, depending on the source or the year, according to a July budget request from the CFO for the Defense Department, the cyber activities in the NDAA request for FY2026 are approximately $15.1 billion, or 4.1% more than the previous year’s request. This cyber budget bump stands in stark contrast to proposed double-digit cuts for civilian agencies.
Securing mobile phones for top officials
Few cyber risks are as operationally consequential as insecure mobile communications, and the NDAA directly targets this gap with new mandates for how the Pentagon procures and protects devices for top officials.
The bill requires that, no later than 90 days after enactment, the DoD will ensure that each wireless mobile phone and all related telecommunications the department provides to senior military officials or any other employee who performs sensitive national security functions are acquired under contracts or other agreements that require enhanced cybersecurity protections.
Under the bill, enhanced cybersecurity protections mean encrypted data, capabilities to mitigate or obfuscate persistent device identifiers, including periodic rotation of network or hardware identifiers to reduce the risk of inappropriate tracking of the activity or location of the wireless mobile phones, and the capability to monitor the wireless mobile phones continuously.
Under the legislation, 180 days after the bill’s enactment, the Secretary of Defense must submit to the relevant congressional defense committees a report detailing the mobile telecommunications contracts the Pentagon has entered pursuant to these provisions, how it determined which employees these mobile provisions apply to, and the total costs of wireless mobile phones and telecommunication services involved.
Ai and machine learning security and procurement requirements
Recognizing that AI now underpins everything from battlefield planning to intelligence analysis, the bill introduces sweeping requirements to safeguard these systems from emerging digital threats.
The NDAA spells out a spate of policy and procurement practices that the military should meet regarding artificial intelligence and machine learning (ML). First, the DoD, in consultation with other Federal agencies, has 180 days after the date of enactment to develop and implement a department-wide policy for the cybersecurity and associated governance of AI and ML systems and applications, as well as the models for AI and ML used in national defense applications.
The policy must protect against security threats to AI and machine learning, including model serialization attacks, model tampering, data leakage, adversarial prompt injection, model extraction, model jailbreaks, and supply chain attacks. It also must employ cybersecurity measures throughout the life cycle of systems using artificial intelligence or machine learning.
Moreover, the policy must reflect the adoption of industry-recognized frameworks to guide the development and implementation of AI and ML security best practices. Likewise, it must follow standards for governance, testing, auditing, and monitoring of systems using artificial intelligence and machine learning to ensure the integrity and resilience of such systems against corruption and unauthorized manipulation.
Finally, the AI and machine learning policy must accommodate training requirements for the department’s workforce to ensure personnel are prepared to identify and mitigate vulnerabilities specific to AI and ML.
Other noteworthy cyber-related NDAA provisions
Beyond mobile security and AI governance, the NDAA includes a broad array of cyber measures with strategic implications across defense, intelligence, and international partnerships.
The following are among the more noteworthy cybersecurity provisions in the compromise bill:
- Commercial spyware: The bill contains a “sense of Congress” statement that there is a national security need for the legitimate and responsible procurement and application of cyber intrusion capabilities, including efforts related to counterterrorism, counternarcotics, and countertrafficking. It expresses the view that the proliferation of commercial spyware presents significant and growing risks to national security, including to the safety and security of government personnel.
- Evaluation of national security risks posed by foreign adversary acquisition of American multiomic data: The bill stipulates that not later than 270 days after its enactment, the director of national intelligence, in consultation with the secretary of defense, the US attorney general the secretary of health and humans services, the secretary of commerce, the secretary of homeland security, the secretary of state, and the national cyber director, shall complete an assessment of risks to national security posed by human multiomic data from US citizens that is collected or stored by a foreign adversary from the provision of biotechnology equipment or services.
- Biological data for artificial intelligence: The legislation calls for tiered levels of cybersecurity safeguards and access controls for the storage of biological data and contains requirements for the protection of the privacy of individuals.
- Cybersecurity regulatory harmonization: By June 1, 2026, the DoD must harmonize the cybersecurity requirements applicable to the defense industrial base, reduce the number of such requirements that are unique to a specific contract or other agreement, and submit to the congressional defense committees a report on the actions taken to carry out the harmonization.
- Cybersecurity and resilience annex in Strategic Rail Corridor Network assessments: The legislation says the defense secretary, in coordination with the transportation secretary and the homeland security secretary, should conduct a periodic evaluation of the Strategic Rail Corridor Network. The assessment must include an annex containing a review of the cybersecurity and the resilience of the physical infrastructure of the Strategic Rail Corridor.
- Cyber workforce recruitment and retention: The billrequires the defense secretary to fix the rates of basic pay for military employees working on cyber with a pay rate on par with comparable employees elsewhere in the government.
- Supporting cybersecurity and cyber resilience in the Western Balkans: The NDAA contains a “sense of Congress” statement that the United States support for cybersecurity, cyber resilience, and secure ICT infrastructure in Western Balkans countries will strengthen the region’s ability to defend itself from and respond to malicious cyber activity conducted by nonstate and foreign actors, including foreign governments, that seek to influence the region.
- Demonstration of real-time monitoring capabilities to enhance weapon system platforms: If funds are available, the secretary of defense, in coordination with the undersecretary of defense for acquisition and sustainment and the service acquisition executives, will carry out a demonstration to equip selected weapon system platforms with onboard, near real-time, end-to-end serial bus and radio frequency monitoring capabilities to detect cyber threats and improve maintenance efficiency.
