,i  #aac? ,,congress  #b;d ,session  ,h4
 ,r4 #egic  ,,9 ,,! ,,h\se ,,(          
,,repres5tatives  ,decemb] #d1 #bjad    
,mr4 ,royce 7= himself & ,ms4 ,j5k9s7   
introduc$ ! foll[+ bill2 :i* 0 ref]r$ to
 ! ,committee on ,ov]sight & ,gov]nm5t  
,re=m  ,a ,,bill  ,to ensure ! integrity
 ( any s(tw>e1 firmw>e1 or product      
develop$ = or pur*as$ by ! ,unit$ ,/ates
 ,gov]nm5t t uses a ?ird p>ty or op5    
s\rce compon5t1 & = o!r purposes4  #a4  
,%ort title ,?is ,act may be cit$ z !   
,cyb] ,supply ,*a9 ,managem5t &         
,transp>5cy ,act ( #bjad4  #b4 ,s(tw>e1 
firmw>e1 or product ) kn[n security     
vuln]abilities or defects  7a7 ,,omb    
guidel9es requir$  7#a7 ,clauses requir$
 9 s(tw>e1 firmw>e1 or product contracts
 = s(tw>e1 firmw>e1 or product creat$ ) 
a b9>y compon5t ,n lat] ?an #ahj days   
aft] ! date ( ! enactm5t ( ?is ,act1 !  
,director ( ! ,(fice ( ,managem5t &     
,budget1 9 consultation ) ! ,secret>y ( 
,def5se1 ! ,secret>y ( ,homel&          
,security1 & any o!r intellig5ce or     

national security ag5cy ! ,director     
det]m9es to be necess>y1 %all issue     
guidel9es = ea* ag5cy t require includ+ 
! foll[+ clauses 9 any contract = !     
acquisition ( s(tw>e1 firmw>e1 or       
product t conta9s a b9>y compon5t3  7,a7
 ,compon5t li/ ,a clause t requires !   
inclusion ( a compreh5sive &            
confid5tially suppli$ li/1 or a bill (  
mat]ials1 ( ea* b9>y compon5t ( !       
s(tw>e1 firmw>e1 or product t is us$ 9 !
 s(tw>e1 firmw>e1 or product4  7,b7     
,v]ification requir$ ,a clause t        
requires ! contractor provid+ ! s(tw>e1 
firmw>e1 or product--  7i7 to v]ify t ! 
s(tw>e1 firmw>e1 or product does n      
conta9 any kn[n security vuln]abilities 
or defects t are li/$ 9 ! ,national     
,in/itute ( ,/&>ds & ,te*nology         
,national ,vuln]ability ,database & any 
additional database select$ by !        
,director ( ! ,(fice ( ,managem5t &     
,budget 7t is cr$ible & simil> to !     
,national ,vuln]ability ,database7 t    
tracks security vuln]abilities & defects

 9 a b9>y compon5t1 & t is necess>y to  
capture a wid] li/ ( b9>y compon5ts 7)  
kn[n security vuln]abilities or defects 
& = :i* a less vuln]able alt]native is  
available72 &  7ii7 to notify ! pur*as+ 
ag5cy ( any kn[n security vuln]abilities
 or defects discov]$ ?r\gh ! v]ification
 requir$ "u clause 7i74  7,c7 ,waiv] ,a 
clause t requires--  7i7 a contractor to
 submit a writt5 application1 & obta9 a 
waiv]1 = ea* b9>y compon5t t is kn[n to 
be vuln]able f ! head ( ! pur*as+ ag5cy2
 &  7ii7 if ! head ( ! pur*as+ ag5cy    
approves ! waiv]1 su* head %all provide 
! contractor ) a writt5 /atem5t t !     
ag5cy accepts all ( ! risk associat$ ) !
 use ( su* b9>y compon5t4  7,d7 ,updates
 ,a clause t requires su* s(tw>e1       
firmw>e1 or product to be writt5 or     
design$ 9 a mann] t all[s = any future  
security vuln]ability or defect 9 any "p
 ( ! s(tw>e1 firmw>e1 or product to be  
easily pat*$1 updat$1 or replac$ to fix 
! vuln]ability or defect 9 ! s(tw>e1    
firmw>e1 or product4  7,e7 ,timely      

repair ,a clause t requires ! contractor
 to provide a repair 9 a timely mann] ) 
reg>d to any new security vuln]ability  
discov]$ ?r\gh any ( ! databases        
describ$ 9 subp>agraph 7,b74  7#b7      
,disclosure ( security vuln]ability or  
defect ,n lat] ?an #ahj days aft] ! date
 ( ! enactm5t ( ?is ,act1 ! ,director ( 
! ,(fice ( ,managem5t & ,budget %all    
issue guidel9es = ea* ag5cy ) respect to
 any s(tw>e1 firmw>e1 or product 9 use  
by ! ,unit$ ,/ates ,gov]nm5t t conta9s a
 b9>y compon5t t requires ea* ag5cy to h
 a process--  7,a7 to replace any       
curr5tly kn[n vuln]able b9>y compon5t2 &
  7,b7 to remove & repair any new       
vuln]able b9>y compon5t aft] su*        
compon5t becomes kn[n pursuant to       
p>agraph 7#a77;,b74  7#c7 ,ag5cy        
guidel9es  7,a7 ,s(tw>e1 firmw>e1 or    
product t c n be fix$ or pat*$ ,n lat]  
?an #bbj days aft] ! date ( ! enactm5t (
 ?is ,act1 ! ,director ( ! ,(fice (     
,managem5t & ,budget %all issue         
guidel9es = ea* ag5cy ) respect to any  

s(tw>e1 firmw>e1 or product t conta9s a 
kn[n vuln]able b9>y compon5t--  7i7 t c 
n be fix$1 pat*$1 or updat$2 &  7ii7 t  
requires su* compon5t1 to migrate to    
pat*able1 repairable1 & fixable         
products4  7,b7 ,inv5tory ( exi/+       
s(tw>e1 firmw>e1 or product ) a kn[n    
vuln]able b9>y compon5t ,n lat] ?an #bj 
mon?s aft] ! date ( ! enactm5t ( ?is    
,act1 ! ,director ( ! ,(fice ( ,budget (
 ,managem5t %all in/ruct ea* ag5cy to   
provide ! relevant (fice 9 ! ,dep>tm5t (
 ,homel& ,security ) a li/ ( ea* kn[n   
vuln]able b9>y 9 any s(tw>e1 firmw>e or 
product 9 use by ea* ag5cy4  7,c7       
,analysis ( project integrity & annual  
report ,n lat] ?an twelve mon?s aft] all
 li/s describ$ 9 subp>agraph 7,b7 are   
provid$ to ! ,dep>tm5t ( ,homel&        
,security1 ! ,secret>y ( ,homel&        
,security %all issue an annual          
confid5tial report describ+ ! security  
vuln]abilities ( ! projects t creat$ any
 kn[n vuln]able b9>y compon5t 9 any li/ 
describ$ 9 subp>agraph 7,b7 & ?r\gh !   

v]ification requir$ "u p>agraph         
7#a77;,b74 ,! report %all assess !      
integrity ( b9>y compon5t suppli]s = !  
incid5ce ( security vuln]abilities1 !   
sev]ity1 ! mean "t to rem$iate su*      
vuln]abilities t c be appli$ to assess !
 security ( b9>y projects & suppli]s1 = 
use by o!r ag5cies4  7b7 ,report on     
removal ( b9>y compon5t ) kn[n security 
vuln]ability or defect ,n lat] ?an #cj  
mon?s aft] ! date ( ! enactm5t ( ?is    
,act1 ! head ( ea* ag5cy %all submit to 
ea* relevant ,committee ( jurisdiction 9
 ! ,h\se ( ,repres5tatives & ! ,s5ate a 
report on ! completion ( ! removal ( ea*
 b9>y compon5t ) kn[n security          
vuln]abilities or defects 9 ! ag5cy &   
%all include a classifi$ v]sion ( ?is   
report = ! ,p]man5t ,select ,committee  
on ,intellig5ce & ! ,committees on ,arm$
 ,s]vices1 ,=eign ,affairs1 & ,homel&   
,security ( ! ,h\se ( ,repres5tatives & 
! ,select ,committee on ,intellig5ce & !
 ,committees on ,arm$ ,s]vices1 ,=eign  
,affairs1 & ,homel& ,security &         

,gov]nm5tal ,affairs ( ! ,s5ate4 ,!     
report %all also detail ! policies1     
proc$ures1 & processes by :i* a newly   
discov]$ vuln]able b9>y compon5t is     
replac$ 9 s(tw>e1 firmw>e1 & products 9 
use by ! ,unit$ ,/ates ,gov]nm5t4  7c7  
,o!r entities ( ! ,unit$ ,/ates         
,gov]nm5t ,any o!r entity ( ! ,unit$    
,/ates ,gov]nm5t--  7#a7 %all replace   
any vuln]able b9>y compon5t ) ano!r less
 vuln]able alt]native 9 any s(tw>e1     
firmw>e1 or product 9 use by ! entity2 &
  7#b7 %all beg9 su* replacem5t process 
) critical sy/ems4  7d7 ,def9itions ,9  
?is section3  7#a7 ,ag5cy ,! t]m ag5cy  
has ! mean+ giv5 t t]m 9 section #eea7a7
 ( title #e1 ,unit$ ,/ates ,code4  7#b7 
,b9>y compon5t ,! t]m b9>y compon5t     
means a ?ird p>ty or op5 s\rce compon5t4