,i  #aacth ,,congress  #b;d ,session    
,h4 ,r4 #egic  ,,in ,,the ,,house ,,of  
,,representatives  ,december #d1 #bjad  
,mr4 ,royce 7for himself and ,ms4       
,jenkins7 introduced the following bill2
 which was referred to the ,committee on
 ,oversight and ,government ,reform  ,a 
,,bill  ,to ensure the integrity of any 
software1 firmware1 or product developed
 for or purchased by the ,united ,states
 ,government that uses a third party or 
open source component1 and for other    
purposes4  #a4 ,short title ,this ,act  
may be cited as the ,cyber ,supply      
,chain ,management and ,transparency    
,act of #bjad4  #b4 ,software1 firmware1
 or product with known security         
vulnerabilities or defects  7a7 ,,omb   
guidelines required  7#a7 ,clauses      
required in software1 firmware1 or      
product contracts for software1         
firmware1 or product created with a     
binary component ,not later than #ahj   
days after the date of the enactment of 
this ,act1 the ,director of the ,office 

of ,management and ,budget1 in          
consultation with the ,secretary of     
,defense1 the ,secretary of ,homeland   
,security1 and any other intelligence or
 national security agency the ,director 
determines to be necessary1 shall issue 
guidelines for each agency that require 
including the following clauses in any  
contract for the acquisition of         
software1 firmware1 or product that     
contains a binary component3  7,a7      
,component list ,a clause that requires 
the inclusion of a comprehensive and    
confidentially supplied list1 or a bill 
of materials1 of each binary component  
of the software1 firmware1 or product   
that is used in the software1 firmware1 
or product4  7,b7 ,verification required
 ,a clause that requires the contractor 
providing the software1 firmware1 or    
product--  7i7 to verify that the       
software1 firmware1 or product does not 
contain any known security              
vulnerabilities or defects that are     
listed in the ,national ,institute of   

,standards and ,technology ,national    
,vulnerability ,database and any        
additional database selected by the     
,director of the ,office of ,management 
and ,budget 7that is credible and       
similar to the ,national ,vulnerability 
,database7 that tracks security         
vulnerabilities and defects in a binary 
component1 and that is necessary to     
capture a wider list of binary          
components 7with known security         
vulnerabilities or defects and for which
 a less vulnerable alternative is       
available72 and  7ii7 to notify the     
purchasing agency of any known security 
vulnerabilities or defects discovered   
through the verification required under 
clause 7i74  7,c7 ,waiver ,a clause that
 requires--  7i7 a contractor to submit 
a written application1 and obtain a     
waiver1 for each binary component that  
is known to be vulnerable from the head 
of the purchasing agency2 and  7ii7 if  
the head of the purchasing agency       
approves the waiver1 such head shall    

provide the contractor with a written   
statement that the agency accepts all of
 the risk associated with the use of    
such binary component4  7,d7 ,updates ,a
 clause that requires such software1    
firmware1 or product to be written or   
designed in a manner that allows for any
 future security vulnerability or defect
 in any part of the software1 firmware1 
or product to be easily patched1        
updated1 or replaced to fix the         
vulnerability or defect in the software1
 firmware1 or product4  7,e7 ,timely    
repair ,a clause that requires the      
contractor to provide a repair in a     
timely manner with regard to any new    
security vulnerability discovered       
through any of the databases described  
in subparagraph 7,b74  7#b7 ,disclosure 
of security vulnerability or defect ,not
 later than #ahj days after the date of 
the enactment of this ,act1 the         
,director of the ,office of ,management 
and ,budget shall issue guidelines for  
each agency with respect to any         

software1 firmware1 or product in use by
 the ,united ,states ,government that   
contains a binary component that        
requires each agency to have a process--
  7,a7 to replace any currently known   
vulnerable binary component2 and  7,b7  
to remove and repair any new vulnerable 
binary component after such component   
becomes known pursuant to paragraph     
7#a77;,b74  7#c7 ,agency guidelines     
7,a7 ,software1 firmware1 or product    
that can not be fixed or patched ,not   
later than #bbj days after the date of  
the enactment of this ,act1 the         
,director of the ,office of ,management 
and ,budget shall issue guidelines for  
each agency with respect to any         
software1 firmware1 or product that     
contains a known vulnerable binary      
component--  7i7 that can not be fixed1 
patched1 or updated2 and  7ii7 that     
requires such component1 to migrate to  
patchable1 repairable1 and fixable      
products4  7,b7 ,inventory of existing  
software1 firmware1 or product with a   

known vulnerable binary component ,not  
later than #bj months after the date of 
the enactment of this ,act1 the         
,director of the ,office of ,budget of  
,management shall instruct each agency  
to provide the relevant office in the   
,department of ,homeland ,security with 
a list of each known vulnerable binary  
in any software1 firmware or product in 
use by each agency4  7,c7 ,analysis of  
project integrity and annual report ,not
 later than twelve months after all     
lists described in subparagraph 7,b7 are
 provided to the ,department of         
,homeland ,security1 the ,secretary of  
,homeland ,security shall issue an      
annual confidential report describing   
the security vulnerabilities of the     
projects that created any known         
vulnerable binary component in any list 
described in subparagraph 7,b7 and      
through the verification required under 
paragraph 7#a77;,b74 ,the report shall  
assess the integrity of binary component
 suppliers for the incidence of security

 vulnerabilities1 the severity1 the mean
 time to remediate such vulnerabilities 
that can be applied to assess the       
security of binary projects and         
suppliers1 for use by other agencies4   
7b7 ,report on removal of binary        
component with known security           
vulnerability or defect ,not later than 
#cj months after the date of the        
enactment of this ,act1 the head of each
 agency shall submit to each relevant   
,committee of jurisdiction in the ,house
 of ,representatives and the ,senate a  
report on the completion of the removal 
of each binary component with known     
security vulnerabilities or defects in  
the agency and shall include a          
classified version of this report for   
the ,permanent ,select ,committee on    
,intelligence and the ,committees on    
,armed ,services1 ,foreign ,affairs1 and
 ,homeland ,security of the ,house of   
,representatives and the ,select        
,committee on ,intelligence and the     
,committees on ,armed ,services1        

,foreign ,affairs1 and ,homeland        
,security and ,governmental ,affairs of 
the ,senate4 ,the report shall also     
detail the policies1 procedures1 and    
processes by which a newly discovered   
vulnerable binary component is replaced 
in software1 firmware1 and products in  
use by the ,united ,states ,government4 
7c7 ,other entities of the ,united      
,states ,government ,any other entity of
 the ,united ,states ,government--  7#a7
 shall replace any vulnerable binary    
component with another less vulnerable  
alternative in any software1 firmware1  
or product in use by the entity2 and    
7#b7 shall begin such replacement       
process with critical systems4  7d7     
,definitions ,in this section3  7#a7    
,agency ,the term agency has the meaning
 given that term in section #eea7a7 of  
title #e1 ,united ,states ,code4  7#b7  
,binary component ,the term binary      
component means a third party or open   
source component4