,,ii #aagth ,,congress #b;d ,session ,s4 #diac ,,in ,,the ,,senate ,,of ,,the ,,united ,,states ,september #ba1 #bjbb,mr4 ,peters 7for himself and ,mr4 ,portman7 introduced the following bill2 which was read twice and referred to the ,committee on ,homeland ,security and ,governmental ,affairs ,a ,,bill ,to establish the duties of the ,director of the ,cybersecurity and ,infrastructure ,security ,agency regarding open source software security1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,securing ,open ,source ,software ,act of #bjbb4 #b4 ,findings ,congress finds that-- 7#a7 open source software fosters technology development and is an integral part of overall cybersecurity2 7#b7 a secure1 healthy1 vibrant1 and resilient open source software ecosystem is crucial for ensuring the national security and economic vitality of the ,united ,states2 7#c7 open source software is part of the foundation of digital infrastructure that promotes a free and open internet2 7#d7 due to both the unique strengths of open source software and inconsistent historical investment in open source software security1 there exist unique challenges in securing open source software2 and 7#e7 the ,federal ,government should play a supporting role in ensuring the long-term security of open source software4 #c4 ,open source software security duties 7a7 ,in general ,subtitle ,a of title ,,xxii of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #fea et seq47 is amended-- 7#a7 in section #bbja 7#f ,u4,s4,c4 #fea7-- 7,a7 by redesignating paragraphs 7#e71 7#f71 and 7#g7 as paragraphs 7#h71 7#i71 and 7#aj71 respectively2 and 7,b7 by inserting after paragraph 7#d7 the following3 7#e7 ,open source software ,the term open source software means software for which the human-readable source code is made available to the public for use1 study1 re-use1 modification1 enhancement1 and re-distribution4 7#f7 ,open source software community ,the term open source software community means the community of individuals1 foundations1 nonprofit organizations1 corporations1 and other entities that-- 7,a7 develop1 contribute to1 maintain1 and publish open source software2 or 7,b7 otherwise work to ensure the security of the open source software ecosystem4 7#g7 ,open source software component ,the term open source software component means an individual repository of open source software that is made available to the public4 2 7#b7 in section #bbjb7;c7 7#f ,u4,s4,c4 #feb7;c77-- 7,a7 in paragraph 7#ac71 by striking and at the end2 7,b7 by redesignating paragraph 7#ad7 as paragraph 7#ae72 and 7,c7 by inserting after paragraph 7#ac7 the following3 7#ad7 support1 including by offering services1 the secure usage and deployment of software1 including open source software1 in the software development lifecycle at ,federal agencies in accordance with section #bbbj;,e2 and 2 and 7#c7 by adding at the end the following3 #bbbj;,e4 ,open source software security duties 7a7 ,definition ,in this section1 the term software bill of materials has the meaning given the term in the ,minimum ,elements for a ,software ,bill of ,materials published by the ,department of ,commerce1 or any superseding definition published by the ,agency4 7b7 ,employment ,the ,director shall1 to the greatest extent practicable1 employ individuals in the ,agency who-- 7#a7 have expertise and experience participating in the open source software community2 and 7#b7 perform the duties described in subsection 7c74 7c7 ,duties of the ,director 7#a7 ,in general ,the ,director shall-- 7,a7 perform outreach and engagement to bolster the security of open source software2 7,b7 support ,federal efforts to strengthen the security of open source software2 7,c7 coordinate1 as appropriate1 with non-,federal entities on efforts to ensure the long-term security of open source software2 7,d7 serve as a public point of contact regarding the security of open source software for non-,federal entities1 including ,state1 local1 ,tribal1 and territorial partners1 the private sector1 international partners1 open source software organizations1 and open source software developers2 and 7,e7 support ,federal and non-,federal supply chain security efforts by encouraging efforts to bolster open source security1 such as-- 7i7 assisting in coordinated vulnerability disclosures in open source software components pursuant to section #bbji7n72 and 7ii7 supporting the activities of the ,federal ,acquisition ,security ,council4 7#b7 ,assessment of critical open source software components 7,a7 ,framework ,not later than #a year after the date of enactment of this section1 the ,director shall publicly publish a framework1 incorporating government1 including those published by the ,national ,institute of ,standards and ,technology1 industry1 and open source software community frameworks and best practices1 for assessing the risk of open source software components1 including direct and indirect open source software dependencies1 which shall incorporate1 at a minimum-- 7i7 the security properties of code in a given open source software component1 such as whether the code is written in a memory-safe programming language2 7ii7 the security practices of development1 build1 and release processes of a given open source software component1 such as the use of multi-factor authentication by maintainers and cryptographic signing of releases2 7iii7 the number and severity of publicly known1 unpatched vulnerabilities in a given open source software component2 7iv7 the breadth of deployment of a given open source software component2 7v7 the level of risk associated with where a given open source software component is integrated or deployed1 such as whether the component operates on a network boundary or in a privileged location2 and 7vi7 the health of the community for a given open source software component1 including1 where applicable1 the level of current and historical investment and maintenance in the open source software component1 such as the number and activity of individual maintainers4 7,b7 ,updating framework ,not less frequently than annually after the date on which the framework is published under subparagraph 7,a71 the ,director shall-- 7i7 determine whether additional updates are needed to the framework described in subparagraph 7,a72 and 7ii7 if the ,director determines that additional updates are needed under clause 7i71 make those updates to the framework4 7,c7 ,developing framework ,in developing the framework described in subparagraph 7,a71 the ,director shall consult with-- 7i7 appropriate ,federal agencies1 including the ,national ,institute of ,standards and ,technology2 7ii7 individuals and nonprofit organizations from the open source software community2 and 7iii7 private companies from the open source software community4 7,d7 ,federal open source software assessment ,not later than #a year after the publication of the framework described in subparagraph 7,a71 and not less frequently than every #b years thereafter1 the ,director shall1 to the greatest extent practicable and using the framework described in subparagraph 7,a7-- 7i7 perform an assessment of open source software components used directly or indirectly by ,federal agencies based on readily available1 and1 to the greatest extent practicable1 machine readable1 information1 such as-- 7,i7 software bills of material that are made available to the ,agency or are otherwise accessible via the internet2 7,,ii7 software inventories collected from the ,continuous ,diagnostics and ,mitigation program of the ,agency2 and 7,,iii7 other publicly available information regarding open source software components2 and 7ii7 develop #a or more ranked lists of components described in clause 7i7 based on the assessment1 such as ranked by the criticality1 level of risk1 or usage of the components1 or a combination thereof4 7,e7 ,automation ,the ,director shall1 to the greatest extent practicable1 automate the assessment conducted under subparagraph 7,d74 7,f7 ,publication ,the ,director shall publicly publish and maintain any tools developed to conduct the assessment described in subparagraph 7,d7 as open source software4 7,g7 ,sharing 7i7 ,results ,the ,director shall facilitate the sharing of the results of the assessment described in subparagraph 7,d7 with appropriate ,federal and non-,federal entities working to support the security of open source software1 including by offering means for appropriate ,federal and non-,federal entities to download the assessment in an automated manner4 7ii7 ,datasets ,the ,director may publicly publish1 as appropriate1 any datasets or versions of the datasets developed or consolidated as a result of the assessment described in subparagraph 7,d74 7,h7 ,critical infrastructure assessment study and pilot 7i7 ,study ,not later than #b years after the publication of the framework described in subparagraph 7,a71 the ,director shall conduct a study regarding the feasibility of the ,director conducting the assessment described in subparagraph 7,d7 for critical infrastructure entities4 7ii7 ,pilot ,if the ,director determines that the assessment described in clause 7i7 is feasible1 the ,director may conduct a pilot assessment on a voluntary basis with #a or more critical infrastructure sectors1 in coordination with the ,sector ,risk ,management ,agency and the sector coordinating council of each participating sector4 7iii7 ,reports 7,i7 ,study ,not later than #ahj days after the date on which the ,director completes the study conducted under clause 7i71 the ,director shall submit to the appropriate congressional committees a report that-- 7aa7 summarizes the study2 and 7bb7 states whether the ,director plans to proceed with the pilot described in clause 7ii74 7,,ii7 ,pilot ,if the ,director proceeds with the pilot described in clause 7ii71 not later than #a year after the date on which the ,director begins the pilot1 the ,director shall submit to the appropriate congressional committees a report that includes-- 7aa7 a summary of the results of the pilot2 and 7bb7 a recommendation as to whether the pilot should be continued4 7#c7 ,coordination with ,national ,cyber ,director ,the ,director shall-- 7,a7 brief the ,national ,cyber ,director on the activities described in this subsection2 and 7,b7 coordinate activities with the ,national ,cyber ,director1 as appropriate4 7#d7 ,reports 7,a7 ,in general ,not later than #a year after the date of enactment of this section1 and every #b years thereafter1 the ,director shall submit to the appropriate congressional committees a report that includes-- 7i7 a summary of the work on open source software security performed by the ,director during the period covered by the report1 including a list of the ,federal and non-,federal entities with which the ,director interfaced2 7ii7 the framework developed under paragraph 7#b77;,a72 7iii7 a summary of changes made to the framework developed under paragraph 7#b77;,a7 since the last report submitted under this subparagraph2 7iv7 a summary of the assessment conducted pursuant to paragraph 7#b77;,d72 7v7 a summary of changes made to the assessment conducted pursuant to paragraph 7#b77;,d7 since the last report submitted under this subparagraph1 including overall security trends2 and 7vi7 a summary of the types of entities with which the assessment was shared pursuant to paragraph 7#b77;,g71 including a list of the ,federal and non-,federal entities with which the assessment was shared4 7,b7 ,public report ,not later than #cj days after the date on which the ,director submits a report required under subparagraph 7,a71 the ,director shall make a version of the report publicly available on the website of the ,agency4 4 7b7 ,technical and conforming amendment ,the table of contents in section #a7;b7 of the ,homeland ,security ,act of #bjjb 7,public ,law #ajg-bif2 #aaf ,stat4 #bace7 is amended-- 7#a7 by moving the item relating to section #bbbj;,d to appear after the item relating to section #bbbj;,c2 and 7#b7 by inserting after the item relating to section #bbbj;,d the following3 ,sec4 #bbbj;,e4 ,open source software security duties4 4 #d4 ,software security advisory subcommittee ,section #bbai7;d77#a7 of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #ffe;e7d77#a77 is amended by adding at the end the following3 7,e7 ,software security1 including open source software security4 4 #e4 ,open source software guidance 7a7 ,definitions ,in this section3 7#a7 ,appropriate congressional committee ,the term appropriate congressional committee has the meaning given the term in section #b of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #aja74 7#b7 ,covered agency ,the term covered agency means an agency described in section #ija7;b7 of title #ca1 ,united ,states ,code4 7#c7 ,director ,the term ,director means the ,director of the ,office of ,management and ,budget4 7#d7 ,open source software2 open source software community ,the terms open source software and open source software community have the meanings given those terms in section #bbja of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #fea71 as amended by section #c of this ,act4 7b7 ,guidance 7#a7 ,in general ,not later than #a year after the date of enactment of this ,act1 the ,director1 in coordination with the ,national ,cyber ,director1 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 and the ,administrator of ,general ,services1 shall issue guidance on the responsibilities of the chief information officer at each covered agency regarding open source software1 which shall include-- 7,a7 how chief information officers at each covered agency should1 considering industry and open source software community best practices-- 7i7 manage and reduce risks of using open source software2 and 7ii7 guide contributing to and releasing open source software2 7,b7 how chief information officers should enable1 rather than inhibit1 the secure usage of open source software at each covered agency2 7,c7 any relevant updates to the ,memorandum ,m-#af-ba issued by the ,office of ,management and ,budget on ,august #h1 #bjaf1 entitled1 ,federal ,source ,code ,policy3 ,achieving ,efficiency1 ,transparency1 and ,innovation through ,reusable and ,open ,source ,software2 and 7,d7 how covered agencies may contribute publicly to open source software that the covered agency uses1 including how chief information officers should encourage those contributions4 7#b7 ,exemption of national security systems ,the guidance issued under paragraph 7#a7 shall not apply to national security systems4 7c7 ,pilot 7#a7 ,in general ,not later than #a year after the date of enactment of this ,act1 the chief information officer of each covered agency described in paragraph 7#b71 in coordination with the ,director1 the ,national ,cyber ,director1 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 and the ,administrator of ,general ,services1 shall establish a pilot open source function at the covered agency that-- 7,a7 is modeled after open source program offices1 such as those in the private sector1 the nonprofit sector1 academia1 and other non-,federal entities2 and 7,b7 shall-- 7i7 support the secure usage of open source software at the covered agency2 7ii7 develop policies and processes for contributions to and releases of open source software at the covered agency1 in consultation1 as appropriate1 with the ,offices of ,general ,counsel and ,procurement of the covered agency2 7iii7 interface with the open source software community2 and 7iv7 manage and reduce risks of consuming open source software at the covered agency4 7#b7 ,selection of pilot agencies ,the ,director1 in coordination with the ,national ,cyber ,director1 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 and the ,administrator of ,general ,services1 shall select #a or more covered agencies to conduct the pilot described in paragraph 7#a7 7#c7 ,assessment ,not later than #a year after the establishment of the pilot open source functions described in paragraph 7#a71 the ,director1 in coordination with the ,national ,cyber ,director1 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 and the ,administrator of ,general ,services1 shall assess whether open source functions should be established at some or all covered agencies1 including-- 7,a7 how to organize those functions within covered agencies1 such as the creation of open source program offices2 and 7,b7 appropriate roles and responsibilities for those functions4 7#d7 ,guidance ,if the ,director determines1 based on the assessment described in paragraph 7#c71 that some or all of the open source functions should be established at some or all covered agencies1 the ,director1 in coordination with the ,national ,cyber ,director1 the ,director of the ,cybersecurity and ,infrastructure ,security ,agency1 and the ,administrator of ,general ,services1 shall issue guidance on the implementation of those functions4 7d7 ,briefing and report ,the ,director shall-- 7#a7 not later than #a year after the date of enactment of this ,act1 brief the appropriate congressional committees on the guidance issued under subsection 7b72 and 7#b7 not later than #edj days after the establishment of the pilot open source functions under subsection 7c77#a71 submit to the appropriate congressional committees a report on-- 7,a7 the pilot open source functions2 and 7,b7 the results of the assessment conducted under subsection 7c77#c74 7e7 ,duties ,section #ceed7;b7 of title #dd1 ,united ,states ,code1 is amended-- 7#a7 in paragraph 7#g71 by striking and at the end2 7#b7 in paragraph 7#h71 by striking the period at the end and inserting 2 and2 and 7#c7 by adding at the end the following3 7#i7 plans and procedures to ensure the secure usage and development of software1 including open source software4 4 #f4 ,rule of construction ,nothing in this ,act or the amendments made by this ,act shall be construed to provide any additional regulatory authority to any ,federal agency described therein4