The FY2026 National Defense Authorization Act (NDAA) reflects a constructive step forward in how Congress is approaching technology, modernization, and national security. For the enterprise software industry, the final bill includes several concrete policy measures that strengthen security and help government adopt technology solutions more quickly and effectively.
Strong Momentum for Commercial Technology and IT Modernization
Congress made meaningful progress toward accelerating the government’s adoption of modern software, artificial intelligence (AI), and cloud services. This includes provisions that expand the role of commercial solutions and require the department to confront long-standing modernization challenges.
Section 1833 encourages broader department use of commercial technology, signaling that proven, widely deployed tools should help drive mission outcomes.
Section 1503 requires the department to identify and prioritize technical debt across legacy IT systems, ensuring modernization needs are visible and actionable.
Why It Matters: Together, these steps push the department toward more secure, cost-effective technologies and prevent outdated systems—and their risks—from remaining hidden in the budget process.
Tailored Cloud-Access Provisions
Congress also took a more measured approach to cloud-access restrictions than earlier drafts, bringing the final language into clearer alignment with established national-security standards.
Section 1692 adopts clearer statutory definitions and narrows the provision’s focus to core security concerns.
Section 1825 allows for the Consumption Based pricing which is an update for the SaaS community on payment and was adopted in the final bill.
Why It Matters: Targeted, well-defined guardrails strengthen protection of sensitive environments while supporting operational reliability and continued innovation. By adding Section 1825’s authorization of consumption-based pricing for SaaS offerings, Congress also modernizes federal procurement practices—enabling agencies to adopt scalable, cost-efficient solutions that reflect commercial best practices and better align payment structures with actual usage. This combination of clarified security requirements and updated procurement flexibility promotes both stronger national-security posture and more agile technology adoption.
Strengthened AI Security and Governance
The NDAA reinforces the importance of secure, responsible AI use across the department, emphasizing governance and risk management.
Section 1512 directs the department to establish a comprehensive AI/ML security framework and conduct a department-wide assessment of risks and vulnerabilities.
Why It Matters: A unified, thoughtful approach to AI security ensures safeguards keep pace with rapidly evolving capabilities and supports confident adoption of advanced technologies.
Progress on Cybersecurity, ATO Reform, and Post-Quantum Preparedness
Congress continued efforts to modernize cybersecurity practices and anticipate emerging threats—with notable progress on both Authorization-to-Operate (ATO) reform and post-quantum cryptography (PQC).
Section 1521 advances long-needed reforms to the ATO process. By directing improvements that streamline authorization pathways and reduce redundant compliance burdens, Congress is helping the department move toward a model where secure, commercial technology can be adopted in weeks or months rather than years.
Congress also strengthened federal momentum on PQC by reaffirming the importance of preparing government systems for the transition to quantum-resistant cryptography. The final bill underscores the need for early planning, visibility into PQC readiness, and alignment with the federal government’s broader cryptographic modernization roadmap.
Why It Matters: Modernizing the ATO process is one of the most impactful steps Congress can take to accelerate the department’s ability to acquire secure, commercial-grade tools. Faster, risk-aligned authorizations reduce operational delays, improve cybersecurity, and allow the department to keep pace with rapidly evolving threats. At the same time, explicit congressional focus on PQC represents a forward-looking outcome that strengthens federal preparedness for emerging quantum-enabled risks.
Conclusion
Overall, the FY2026 NDAA strikes a thoughtful balance—strengthening national security while enabling innovation, modernization, and more efficient adoption of commercial technology across government.