II
119th CONGRESS
2d Session
S. 5598
IN THE SENATE OF THE UNITED STATES
September 29, 2026
Mr. Banks introduced the following bill; which was read twice and referred to the Committee on Armed Services
A BILL
To provide for an audit and mitigation of covered cellular modules in the Department of Defense systems and infrastructure.
Short title
This Act may be cited as the Blocking Foreign Cellular Modules in Defense Systems Act of 2026
.
Audit and mitigation of covered cellular modules in the Department of Defense systems and infrastructure
Department of Defense audit
In general
Not later than 180 days after the date of the enactment of this Act, the Secretary of Defense shall initiate a Department-wide audit to identify the presence of covered cellular modules within covered systems.
Scope
The audit required under paragraph (1) shall—
cover all military departments, combatant commands, defense agencies, and Department of Defense activities or programs;
prioritize covered systems critical to military mobility, logistics, and installation security;
include both government-owned and contractor-operated covered systems connected to Department of Defense networks or accessing Department of Defense information;
identify to the maximum extent practicable, the manufacturer, model, firmware version, and host product for each covered cellular module identified; and
assess the cybersecurity risk posed by each identified covered cellular module, including data flows, network exposure, and potential for remote access.
Mitigation and Reporting
Report required
Not later than 1 year after the date of the enactment of this Act, and biennially thereafter for a period not to exceed 6 years, the Secretary shall submit to the congressional defense committees a report on the audit and mitigation activities carried out under this section.
Contents
Each report submitted under paragraph (1) shall include the following:
The preliminary or updated findings of the audit required under subsection (b).
A description of ongoing and planned mitigation measures, including—
rip-and-replace programs;
accelerated divestiture or retirement of legacy assets;
network segmentation, isolation, or compensating cybersecurity or engineering controls;
firmware or software remediation; and
supply-chain substitution with trusted alternatives.
Cost estimates, timelines, and resource requirements for each category of mitigation measure described in subparagraph (B).
An identification of any statutory, regulatory, or acquisition barriers to completing mitigation.
Recommendations for additional legislative authorities, if any, needed to complete mitigation.
Form
Each report submitted under paragraph (1) shall be submitted in unclassified form, but may include a classified annex.
Comptroller General report
Not later than 180 days after the submission of the report required in subsection (b), the Comptroller General of the United States shall submit to the congressional defense committees a report on the implementation and effectiveness of the activities described in subsection (b).
Definitions
In this section:
Cellular module
The term cellular module means a modular transmitter, as described in section 15.212 of title 47, Code of Federal Regulations, that provides cellular connectivity to a host product, including an Internet of things device.
Congressional defense committees
The term congressional defense committees has the meaning given the term in section 101(a)(16) of title 10, United States Code.
Covered cellular module
The term covered cellular module means any cellular module produced, manufactured, or provided by—
an entity identified under section 889 of the John S. McCain National Defense Authorization Act for Fiscal Year 2019 (Public Law 115–232; 41 U.S.C. 3901 note prec.);
an entity that is owned by, controlled by, or subject to the jurisdiction or direction of the People’s Republic of China; or
any other entity determined by the Secretary of Defense to present an unacceptable supply-chain risk.
Covered system
The term covered system means any item of infrastructure owned, leased, operated, or controlled by the Department of Defense.
Internet of things device
The term Internet of things device has the meaning given to such term in NIST Special Publication 1800–16.