Saturday, November 7, 2026Independent tracking of the National Defense Authorization Act

The hub for the National Defense Authorization Act — status, history, and analysis

NDAA update ·

NDAA Update Nov 3, 2026: AI threats create urgent need to renew cybersecurity information-sharing law, businesses tell Congress

Three stories on Nov. 3: Cybersecurity Dive's Eric Geller on three dozen business groups, including organizations representing critical infrastructure sectors, pressing Congress to renew the 2015 Cybersecurity Information Sharing Act before its expiration next month, the groups writing on Sunday to the chairs and ranking members of the congressional armed-services committees that CISA 2015 "has become a foundational component of the nation's cybersecurity," after the law's initial 10-year operating period expired in 2025 and several short-term extensions, with the latest set to lapse on Dec. 11, businesses now wanting a new 10-year extension in the FY2027 NDAA, signers including the Aerospace Industries Association, American Bankers Association, American Chemistry Council, American Petroleum Institute, Healthcare Leadership Council, National Association of Manufacturers, National Retail Federation, National Rural Water Association, U.S. Chamber of Commerce and USTelecom plus the Alliance for Critical Infrastructure and the Cybersecurity Coalition, the House draft 2027 NDAA including a provision reauthorizing and renaming the law that would add AI to the list of topics about which companies can share information, the Senate draft not including a CISA 2015 reauthorization, and lawmakers set to begin reconciling the two draft bills after they return to Washington on Nov. 9, Federal News Network's Terry Gerton interviewing Jim Carroll, CEO of the Professional Services Council, on Federal Drive, Carroll saying "One of the things that is going to happen almost immediately is the work on the NDAA," that he met with the House Armed Services Committee last week and they are working very hard trying to get the NDAA through and get the government funded, that "December 11 is when our government funding bill runs out," that regardless of the election outcome "there is a great deal of appetite to getting a CR, getting another continuing resolution, get it passed into the end of January, maybe February," that as Congress works through the final version of the defense authorization bill contractors are watching provisions involving intellectual property and access to technical data, Carroll saying there is "thankfully a great deal of progress on getting this right" on intellectual property rights and defense repair rights provisions, that IP provisions will be in contract with protections against taking IP into production or to a third party and possible post-employment restrictions on maintenance personnel, and that overall "this is a really good balance of protecting everyone," and Breaking Defense's Elaine McCusker, a senior fellow at the American Enterprise Institute and former acting undersecretary of defense (comptroller), in an op-ed arguing that House Section 861 and Senate Section 804 right-to-repair provisions, which would set the default rights on any Pentagon contract to government purpose rights, need modification as conferees negotiate the final FY2027 NDAA, that the legislation as written "could cause more harm than good," that it should treat software and source code needed for repairs with a different policy, and that the Pentagon should employ a form of special negotiated license similar to the commercial sector, an approach Congress preferred in the 2018 defense policy bill (Section 835).

Bill status

No change in the bill's status: the House passed H.R. 8800 on July 22, 2026; S. 4784 has not reached the Senate floor; and the Senate is scheduled to return the week of November 9, after the November 3 election, with the NDAA deferred to the lame-duck session. Full timeline: FY2027 NDAA status · Did the NDAA pass? · NDAA 2027 status · What happens next.

The stories

AI threats create urgent need to renew cybersecurity information-sharing law, businesses tell Congress

Cybersecurity Dive · Nov 3, 2026

Eric Geller reports that three dozen business groups, including organizations representing critical infrastructure sectors, are pressing Congress to renew a major cybersecurity information sharing law before its expiration next month. The 2015 Cybersecurity Information Sharing Act "has become a foundational component of the nation's cybersecurity," the groups wrote on Sunday to the chairs and ranking members of the congressional armed-services committees. CISA 2015, as the law is often called, provides liability protections for companies sharing cyber threat indicators amongst themselves and with federal agencies. After the law's initial 10-year operating period expired in 2025, lawmakers passed several short-term extensions, with the latest one set to lapse on Dec. 11. Businesses now want Congress to include a new 10-year extension in the National Defense Authorization Act (NDAA) for fiscal year 2027. The industry coalition wrote: "These authorities support the timely exchange of actionable threat intelligence and are central to the collective defense of public- and private-sector networks, particularly across critical infrastructure sectors." Signers include the Aerospace Industries Association, American Bankers Association, American Chemistry Council, American Petroleum Institute, Healthcare Leadership Council, National Association of Manufacturers, National Retail Federation, National Rural Water Association, U.S. Chamber of Commerce and USTelecom; cybersecurity-focused groups including the Alliance for Critical Infrastructure and the Cybersecurity Coalition also signed. The groups pointed to recent vulnerability crises that have led to global patching scrambles, writing: "In this environment, the speed and breadth with which defenders share information determines whether they keep pace with adversaries." "That speed depends on the legal certainty CISA 2015 provides." The House's draft version of the 2027 NDAA includes a provision reauthorizing and renaming the cybersecurity information sharing law that would add AI to the list of topics about which companies can share information. The Senate's draft NDAA does not include a CISA 2015 reauthorization. Lawmakers will begin working to reconcile the two draft bills after they return to Washington on Nov. 9, following the midterm elections.

The terms that govern how companies bring innovation to government could be changing

Federal News Network · Nov 3, 2026

On Federal Drive with Terry Gerton, Jim Carroll, CEO of the Professional Services Council, says "One of the things that is going to happen almost immediately is the work on the NDAA." The page summary states that as Congress works through the final version of the defense authorization bill, contractors are watching closely for provisions involving intellectual property and access to technical data, and that those decisions could shape how companies protect their investments while still providing government access to the technologies it wants most. Gerton notes it is election day and that a lot of people will be watching where the National Defense Authorization Act is and how it progresses. Carroll says he met with the House Armed Services Committee last week, that they are working very hard trying to get the NDAA through and making sure they are doing everything possible to get the government funded, and that "December 11 is when our government funding bill runs out." He says that regardless of the outcome of today's election, "there is a great deal of appetite to getting a CR, getting another continuing resolution, get it passed into the end of January, maybe February," and that there is a lot to do in the current bill that is of interest to PSC members, who are federal contractors. Asked about intellectual property rights and defense repair rights provisions in this version of the NDAA, Carroll says there is "thankfully a great deal of progress on getting this right," that everyone understands — whether from the Pentagon, the White House, or in a bipartisan bicameral fashion from Capitol Hill — that the warfighter in the field "absolutely needs to be able to do whatever it takes to stay safe, stay engaged," and that the issue is the research and development funds that have gone into developing this intellectual property and the safeguards around it. He says the IP provisions will be in contract so companies know up front there will be the ability, if there is the need to quickly produce something that is a one-off situation not going into production, and that if there is any attempt to buy a third party to suddenly take that IP and make their own item, that is absolutely protected, as well as the idea that there might be post-employment restrictions on maintenance personnel so they cannot take that IP to a competitor. He says having these protections in contracts and licensing agreements will encourage companies to stay in the defense industrial base, and that if the provisions went through as initially contemplated — that basically "there's no such thing as IP" — some companies were going to rethink getting into the defense world. Asked whether those constraints strike the right balance, Carroll says he thinks they do, that no one is disputing that military personnel who need maintenance capabilities should have them at their fingertips, that companies want to make sure they cannot take that IP and go into mass production or give it to another company, that it would primarily be on the MDAPS, the major defense acquisition programs, and that overall "this is a really good balance of protecting everyone."

The Congressional 'right to repair' solution needs some repairs itself

Breaking Defense · Nov 3, 2026

In a Breaking Defense op-ed published November 3, 2026, Elaine McCusker, a senior fellow at the American Enterprise Institute and former acting undersecretary of defense (comptroller), argues that House Section 861 and Senate Section 804 right-to-repair / technical-data provisions need modification as House and Senate conferees negotiate a final FY2027 NDAA in the post-midterm session. The House and Senate provisions "are very similar and would set the default rights on any Pentagon contract to government purpose rights (GPR), which allow the US to use data generated by a combination of government and private funds and share that data as needed for federal purposes." She writes that the legislation as written would bypass root issues "with a one size fits all approach that could delay development and procurement, pull money from readiness accounts and drive innovative companies out of the defense industrial base when the nation needs them most," and that it "could cause more harm than good to the military's ability to get the equipment it needs and keep it running." Two core problems she identifies are negotiating government license rights to needed intellectual property and, once obtained, managing and delivering that technical data for maintainers. Defaulting all IP to GPR, she writes, could grind defense contracting to a halt and raise prices by requiring any contractor asserting less-than-government purpose rights to prove there was no government investment in their IP prior to contract award; new commercial firms "will not have the business model to easily give up IP," while traditional primes "may not possess the rights to disclose IP developed and owned by their subcontractors or supply chains," and companies "will have to price loss of IP into sales to the Pentagon." The proposed rules "will do nothing to fix the problem of repairing equipment that is in the inventory now." She says solving disagreements on the distinction between operation, maintenance, installation and training (OMIT) data — which law already requires be provided with unlimited rights — and detailed manufacturing and process data (DMPD) would go a long way, citing a CSIS paper that "DOD guidelines acknowledge that some OMIT data also qualifies as DMPD" but that such data does not automatically fall under unlimited rights. Her suggested fix is to modify the legislation to use existing GPR authorities updated to further delineate data definitions, treat software and source code needed for repairs with a different policy as procurement of such technology already does, and have the government work with industry in contract negotiations to determine what data it actually needs; if the Pentagon has trouble defining the future need, "it should consider employing a form of special negotiated license similar to the commercial sector," an approach Congress preferred in the 2018 defense policy bill (Section 835). She also urges Congress to direct the Pentagon to demonstrate implementation of the data management section of its November 2025 Acquisition and Management of Contractor-Prepared Data (DOD Manual 5010.12) and then update the requirements of the 2026 policy bill (Section 805) to require a secure digital catalog for management and access. "Defaulting to GPR is not the answer," she writes; the solution is "to fix what is actually broken — accurate identification, acquisition and management of required IP — and availability of that data to military maintainers."

On this site

More

Get these by email: sign up for free NDAA alerts.