---
kind: "section"
citation: "10 U.S.C. § 6228"
title: "10"
title_heading: "Armed Forces"
number: "6228"
heading: "Reporting on penetrations of networks of contractors and subcontractors"
release: "119-102"
date: "2026-07-12"
url: "https://uscodex.org/usc/10/6228"
units:
  - "Subtitle A — General Military Law"
  - "Part VI — Elements of Department of Defense and Other Matters"
  - "Subpart B — Atomic Energy Defense"
  - "Chapter 605 — Safeguards and Security Matters"
  - "Subchapter I — Safeguards and Security"
---

# §6228. Reporting on penetrations of networks of contractors and subcontractors

- (a) **Procedures for Reporting Penetrations.—** The [Administrator](/usc/10/2700.md?p=3) shall establish procedures that require each contractor and subcontractor to report to the Chief Information [Officer](/usc/10/101.md?p=b-1) when a covered network of the contractor or subcontractor that meets the criteria established pursuant to [subsection (b)](#b) is successfully penetrated.
- (b) **Establishment of Criteria for Covered Networks.—**
  - (1) The [Administrator](/usc/10/2700.md?p=3) shall, in consultation with the officials specified in [paragraph (2)](#b-2), establish criteria for covered networks to be subject to the procedures for reporting penetrations under [subsection (a)](#a).
  - (2) The officials specified in this paragraph are the following officials of the Administration:
    - (A) The Deputy [Administrator](/usc/10/2700.md?p=3) for Defense [Programs](/usc/10/2101.md?p=1).
    - (B) The Associate [Administrator](/usc/10/2700.md?p=3) for Acquisition and Project Management.
    - (C) The Chief Information [Officer](/usc/10/101.md?p=b-1).
    - (D) Any other official of the Administration the [Administrator](/usc/10/2700.md?p=3) considers necessary.
- (c) **Procedure Requirements.—**
  - (1)
    - (A) The procedures established pursuant to [subsection (a)](#a) shall require each contractor or subcontractor to submit to the Chief Information [Officer](/usc/10/101.md?p=b-1) a report on each successful penetration of a covered network of the contractor or subcontractor that meets the criteria established pursuant to [subsection (b)](#b) not later than 60 days after the discovery of the successful penetration.
    - (B) Subject to [subparagraph (C)](#c-1-C), each report required by [subparagraph (A)](#c-1-A) with respect to a successful penetration of a covered network of a contractor or subcontractor shall include the following:
      - (i) A description of the technique or method used in such penetration.
      - (ii) A sample of the malicious software, if discovered and isolated by the contractor or subcontractor, involved in such penetration.
      - (iii) A summary of information created by or for the Administration in connection with any [program](/usc/10/2101.md?p=1) of the Administration that has been potentially compromised as a result of such penetration.
    - (C) If a contractor or subcontractor is not able to obtain all of the information required by [subparagraph (B)](#c-1-B) to be included in a report required by [subparagraph (A)](#c-1-A) by the date that is 60 days after the discovery of a successful penetration of a covered network of the contractor or subcontractor, the contractor or subcontractor shall—
      - (i) include in the report all information available as of that date; and
      - (ii) provide to the Chief Information [Officer](/usc/10/101.md?p=b-1) the additional information required by [subparagraph (B)](#c-1-B) as the information becomes available.
  - (2) Concurrent with the establishment of the procedures pursuant to [subsection (a)](#a), the [Administrator](/usc/10/2700.md?p=3) shall establish procedures to be used if information owned by the Administration was in use during or at risk as a result of the successful penetration of a covered network—
    - (A) in order to—
      - (i) in the case of a penetration of a covered network of a management and operating contractor, enhance the access of personnel of the Administration to Government-owned equipment and information; and
      - (ii) in the case of a penetration of a covered network of a contractor or subcontractor that is not a management and operating contractor, facilitate the access of personnel of the Administration to the equipment and information of the contractor or subcontractor; and
    - (B) which shall—
      - (i) include mechanisms for personnel of the Administration to, upon request, obtain access to equipment or information of a contractor or subcontractor necessary to conduct forensic analysis in addition to any analysis conducted by the contractor or subcontractor;
      - (ii) provide that a contractor or subcontractor is only required to provide access to equipment or information as described in [clause (i)](#c-2-B-i) to determine whether information created by or for the Administration in connection with any [program](/usc/10/2101.md?p=1) of the Administration was successfully exfiltrated from a network of the contractor or subcontractor and, if so, what information was exfiltrated; and
      - (iii) provide for the reasonable protection of trade secrets, commercial or financial information, and information that can be used to identify a specific [person](/usc/10/2700.md?p=2).
  - (3) The procedures established pursuant to [subsection (a)](#a) shall allow for limiting the dissemination of information obtained or derived through such procedures so that such information may be disseminated only to entities—
    - (A) with missions that may be affected by such information;
    - (B) that may be called upon to assist in the diagnosis, detection, or mitigation of [cyber](/usc/10/2200e.md?p=1) incidents;
    - (C) that conduct counterintelligence or law enforcement investigations; or
    - (D) for [national security](/usc/10/801.md?p=16) purposes, including [cyber](/usc/10/2200e.md?p=1) situational awareness and defense purposes.
- (d) **Definitions.—** In this section:
  - (1) The term “Chief Information [Officer](/usc/10/101.md?p=b-1)” means the Associate [Administrator](/usc/10/2700.md?p=3) for Information Management and Chief Information [Officer](/usc/10/101.md?p=b-1) of the Administration.
  - (2) The term “contractor” means a private entity that has entered into a contract or contractual action of any kind with the Administration to furnish [supplies](/usc/10/3011.md?p=8), equipment, materials, or services of any kind.
  - (3) The term “covered network” [includes](/usc/10/101.md?p=g-4) any network or information system that accesses, receives, or stores—
    - (A) [classified information](/usc/10/801.md?p=15); or
    - (B) sensitive unclassified information germane to any [program](/usc/10/2101.md?p=1) of the Administration, as determined by the [Administrator](/usc/10/2700.md?p=3).
  - (4) The term “subcontractor” means a private entity that has entered into a contract or contractual action with a contractor or another subcontractor to furnish [supplies](/usc/10/3011.md?p=8), equipment, materials, or services of any kind in connection with another contract in support of any [program](/usc/10/2101.md?p=1) of the Administration.

## Source credit

(Added and amended Pub. L. 119–60, div. C, title XXXI, § 3111(a), (d)(2), Dec. 18, 2025, 139 Stat. 1407, 1462.)

## Notes

### Editorial Notes

### Prior Provisions

Provisions similar to those in this section were contained in section 2662 of Title 50, War and National Defense, prior to repeal by Pub. L. 119–60, § 3111(b)(1).

### Amendments

2025—Pub. L. 119–60, § 3111(d)(2)(B), realigned margins.

Subsec. (b). Pub. L. 119–60, § 3111(d)(2)(A), struck out pars. (1) and (2) headings which read as follows: “In general” and “Officials specified”, respectively.

Subsec. (c)(1). Pub. L. 119–60, § 3111(d)(2)(A), struck out headings for par. (1) “Rapid reporting” and subpars. (A) to (C) “In general”, “Elements”, and “Avoidance of delays in reporting”, respectively.

Subsec. (c)(2), (3). Pub. L. 119–60, § 3111(d)(2)(A), struck out pars. (2) and (3) headings which read as follows: “Access to equipment and information by administration personnel” and “Dissemination of information”, respectively.

Subsec. (d). Pub. L. 119–60, § 3111(d)(2)(A), struck out pars. (1) to (4) headings which corresponded to the defined term in each par.