H.R. 8710 — National Defense Data Resilience Act

This section establishes mandatory data recovery requirements for the Department of Defense by inserting section 391c into title 10, United States Code. It directs the Secretary of Defense to designate data as critical, important, or necessary; establish recovery time objectives within 180 days for critical data and within 270 days for important or necessary data; and submit annual auditable recovery certification reports to the congressional defense committees beginning one year after enactment. This section further requires the Secretary to field data recovery capabilities for critical data within 180 days and for important or necessary data within 270 days, including immutable backups, continuous monitoring, annual recovery exercises simulating nation-state cyberattacks, and independent audits, while limiting adoption of technology to that meeting certified cybersecurity standards. It also requires the Secretary to submit a data recovery strategy, including recovery time objectives, necessary technology, oversight processes, and funding requirements, to the congressional defense committees within 90 days after enactment, in unclassified form with a possible classified annex.