,,ib ,union ,calendar ,no4 #he #aagth ,,congress #ast ,session ,h4 ,r4 #dfaa ,report ,no4 #aag-abj ,,in ,,the ,,house ,,of ,,representatives ,july #ba1 #bjba,mr4 ,torres of ,new ,york 7for himself and ,mr4 ,garbarino7 introduced the following bill2 which was referred to the ,committee on ,homeland ,security ,september #ad1 #bjba,reported with an amendment1 committed to the ,committee of the ,whole ,house on the ,state of the ,union1 and ordered to be printed,strike out all after the enacting clause and insert the part printed in italic,for text of introduced bill1 see copy of bill as introduced on ,july #ba1 #bjba ,a ,,bill ,to direct the ,secretary of ,homeland ,security to issue guidance with respect to certain information and communications technology or services contracts1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,,dhs ,software ,supply ,chain ,risk ,management ,act of #bjba4 #b4 ,department of ,homeland ,security guidance with respect to certain information and communications technology or services contracts 7a7 ,guidance ,the ,secretary of ,homeland ,security1 acting through the ,under ,secretary1 shall issue guidance with respect to new and existing covered contracts4 7b7 ,new covered contracts ,in developing guidance under subsection 7a71 with respect to each new covered contract1 as a condition on the award of such a contract1 each contractor responding to a solicitation for such a contract shall submit to the covered officer-- 7#a7 a planned bill of materials when submitting a bid proposal2 and 7#b7 the certification and notifications described in subsection 7e74 7c7 ,existing covered contracts ,in developing guidance under subsection 7a71 with respect to each existing covered contract1 each contractor with an existing covered contract shall submit to the covered officer-- 7#a7 the bill of materials used for such contract1 upon the request of such officer2 and 7#b7 the certification and notifications described in subsection 7e74 7d7 ,updating bill of materials ,with respect to a covered contract1 in the case of a change to the information included in a bill of materials submitted pursuant to subsections 7b77#a7 and 7c77#a71 each contractor shall submit to the covered officer the update to such bill of materials1 in a timely manner4 7e7 ,certification and notifications ,the certification and notifications referred to in subsections 7b77#b7 and 7c77#b71 with respect to a covered contract1 are the following3 7#a7 ,a certification that each item listed on the submitted bill of materials is free from all known vulnerabilities or defects affecting the security of the end product or service identified in-- 7,a7 the ,national ,institute of ,standards and ,technology ,national ,vulnerability ,database2 and 7,b7 any database designated by the ,under ,secretary1 in coordination with the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 that tracks security vulnerabilities and defects in open source or third-party developed software4 7#b7 ,a notification of each vulnerability or defect affecting the security of the end product or service1 if identified1 through-- 7,a7 the certification of such submitted bill of materials required under paragraph 7#a72 or 7,b7 any other manner of identification4 7#c7 ,a notification relating to the plan to mitigate1 repair1 or resolve each security vulnerability or defect listed in the notification required under paragraph 7#b74 7f7 ,enforcement ,in developing guidance under subsection 7a71 the ,secretary shall instruct covered officers with respect to-- 7#a7 the processes available to such officers enforcing subsections 7b7 and 7c72 and 7#b7 when such processes should be used4 7g7 ,effective date ,the guidance required under subsection 7a7 shall take effect on the date that is #ahj days after the date of the enactment of this section4 7h7 ,,gao report ,not later than #a year after the date of the enactment of this ,act1 the ,comptroller ,general of the ,united ,states shall submit to the ,secretary1 the ,committee on ,homeland ,security of the ,house of ,representatives1 and the ,committee on ,homeland ,security and ,governmental ,affairs of the ,senate a report that includes-- 7#a7 a review of the implementation of this section2 7#b7 information relating to the engagement of the ,department of ,homeland ,security with industry2 7#c7 an assessment of how the guidance issued pursuant to subsection 7a7 complies with ,executive ,order #adbjh 7#hf ,fed4 ,reg4 #bffcc2 relating to improving the nation's cybersecurity72 and 7#d7 any recommendations relating to improving the supply chain with respect to covered contracts4 7i7 ,definitions ,in this section3 7#a7 ,bill of materials ,the term bill of materials means a list of the parts and components 7whether new or reused7 of an end product or service1 including1 with respect to each part and component1 information relating to the origin1 composition1 integrity1 and any other information as determined appropriate by the ,under ,secretary4 7#b7 ,covered contract ,the term covered contract means a contract relating to the procurement of covered information and communications technology or services for the ,department of ,homeland ,security4 7#c7 ,covered information and communications technology or services ,the term covered information and communications technology or services means the terms-- 7,a7 information technology 7as such term is defined in section #aaaja7f7 of title #dj1 ,united ,states ,code72 7,b7 information system 7as such term is defined in section #cejb7h7 of title #dd1 ,united ,states ,code72 7,c7 telecommunications equipment 7as such term is defined in section #c7eb7 of the ,communications ,act of #aicd 7#dg ,u4,s4,c4 #aec7eb7772 and 7,d7 telecommunications service 7as such term is defined in section #c7ec7 of the ,communications ,act of #aicd 7#dg ,u4,s4,c4 #aec7ec7774 7#d7 ,covered officer ,the term covered officer means-- 7,a7 a contracting officer of the ,department2 and 7,b7 any other official of the ,department as determined appropriate by the ,under ,secretary4 7#e7 ,software ,the term software means computer programs and associated data that may be dynamically written or modified during execution4 7#f7 ,under ,secretary ,the term ,under ,secretary means the ,under ,secretary for ,management of the ,department of ,homeland ,security4 ,september #ad1 #bjba,reported with an amendment1 committed to the ,committee of the ,whole ,house on the ,state of the ,union1 and ordered to be printed