(a) Project Authorization Required.—The Secretary of Defense may carry out such military construction projects for energy resilience, energy security, and energy conservation as are authorized by law, using funds appropriated or otherwise made available for that purpose.

(b) Submission of Project Proposals.—(1) As part of the Department of Defense Form 1391 submitted to the appropriate committees of Congress for a military construction project covered by subsection (a), the Secretary of Defense shall include the following information:

(A) The project title.

(B) The location of the project.

(C) A brief description of the scope of work.

(D) The original project cost estimate and the current working cost estimate, if different.

(E) Such other information as the Secretary considers appropriate.

(2) In the case of a military construction project for energy conservation, the Secretary also shall include the following information:

(A) The original expected savings-to-investment ratio and simple payback estimates and measurement and verification cost estimate.

(B) The most current expected savings-to-investment ratio and simple payback estimates and measurement and verification plan and costs.

(C) A brief description of the measurement and verification plan and planned funding source.

(3) In the case of a military construction project for energy resilience or energy security, the Secretary also shall include the rationale for how the project would enhance mission assurance, support mission critical functions, and address known vulnerabilities.

(c) Alternative Funding Source.—(1) In addition to the authority under section 2805(c) of this title, in carrying out a military construction project for energy resilience, energy security, or energy conservation under this section, the Secretary concerned may use amounts available for operation and maintenance for the military department concerned if the Secretary concerned submits to the congressional defense committees a notification of the decision to carry out the project using such amounts and includes in the notification—

(A) the current estimate of the cost of the project;

(B) the source of funds for the project; and

(C) a certification that deferring the project pending the availability of funds appropriated for or otherwise made available for military construction would be inconsistent with the timely assurance of energy resilience, energy security, or energy conservation for one or more critical national security functions.

(2) A project carried out under this section using amounts under paragraph (1) may be carried out only after the end of the seven-day period beginning on the date on which a copy of the notification described in paragraph (1) is provided in an electronic medium pursuant to section 480 of this title.

(3) The maximum aggregate amount that the Secretary concerned may obligate from amounts available to the military department concerned for operation and maintenance in any fiscal year for projects under the authority of this subsection is $100,000,000.

(d) Relation to Certain Other Authorities.—A project under this section may include—

(1) activities related to a utility system authorized under subsections (h), (j), and (k) of section 2688 or section 2913 of this title, notwithstanding that the United States does not own the utility system covered by the project; and

(2) energy-related activities included as a separate requirement in an energy savings performance contract (as defined in section 804(3) of the National Energy Conservation Policy Act (42 U.S.C. 8287c(3))).

(e) Incorporation of Cybersecurity Supply Chain Risk Management Tools and Methods.—(1) The Secretary of Defense shall incorporate into covered projects cybersecurity supply chain risk management tools and solutions to provide continuous analysis, monitoring, and mitigation of cyber vulnerabilities.

(2) In carrying out the requirements of paragraph (1), the Secretary of Defense shall consider, to the maximum extent practicable, the following:

(A) The adoption of commercially available cybersecurity supply chain risk management tools and solutions.

(B) The inclusion of existing databases on cyber vulnerabilities when selecting such tools and solutions.

(C) The need for such tools and methods to provide continuous analysis, monitoring, and mitigation of cyber vulnerabilities in covered projects.

(D) Beginning with fiscal year 2026, documentation for any new requirements for cybersecurity supply chain risk management in annual guidance for covered projects that is submitted along with the annual budget request of the President submitted pursuant to section 1105 of title 31.

(3) In this subsection, the term "covered project" means a project connected to a Department of Defense Information Network for which funds are made available under this section.

(f) Application to Military Construction Projects.—This section shall apply to military construction projects covered by subsection (a) for which a Department of Defense Form 1391 is submitted to the appropriate committees of Congress in connection with the budget of the Department of Defense for fiscal year 2023 and thereafter.