,,ii ,cal5d> ,no4 #fgg #aag? ,,congress 
#b;d ,session  ,s4 #diac ,report ,no4   
#aag-bgh ,,9 ,,! ,,s5ate ,,( ,,! ,,unit$
 ,,/ates  ,septemb] #ba1 #bjbb,mr4      
,pet]s 7= himself & ,mr4 ,portman7      
introduc$ ! foll[+ bill2 :i* 0 read     
twice & ref]r$ to ! ,committee on       
,homel& ,security & ,gov]nm5tal ,affairs
  ,decemb] #ai1 #bjbb,report$ by ,mr4   
,pet]s1 ) amendments,omit ! "p /ruck    
?r\gh & ins]t ! "p pr9t$ 9 italic  ,a   
,,bill  ,to e/abli% ! duties ( !        
,director ( ! ,cyb]security &           
,infra/ructure ,security ,ag5cy reg>d+  
op5 s\rce s(tw>e security1 & = o!r      
purposes4  #a4 ,%ort title ,?is ,act may
 be cit$ z ! ,secur+ ,op5 ,s\rce ,s(tw>e
 ,act ( #bjbb4  #b4 ,f9d+s ,congress    
f9ds t-- 7#a7 op5 s\rce s(tw>e fo/]s    
te*nology developm5t & is an integral "p
 ( ov]all cyb]security2  7#b7 a secure1 
heal?y1 vibrant1 & resili5t op5 s\rce   
s(tw>e ecosy/em is crucial = ensur+ !   
national security & economic vitality ( 
! ,unit$ ,/ates2  7#c7 op5 s\rce s(tw>e 

is "p ( ! f\ndation ( digital           
infra/ructure t promotes a free & op5   
int]net2  7#d7 due to bo? ! unique      
/r5g?s ( op5 s\rce s(tw>e & inconsi/5t  
hi/orical inve/m5t 9 op5 s\rce s(tw>e   
security1 !re exi/ unique *all5ges 9    
secur+ op5 s\rce s(tw>e2 &  7#e7 !      
,f$]al ,gov]nm5t %\ld play a support+   
role 9 ensur+ ! long-t]m security ( op5 
s\rce s(tw>e4  #c4 ,op5 s\rce s(tw>e    
security duties  7a7 ,9 g5]al ,subtitle 
,a ( title ,,xxii ( ! ,homel& ,security 
,act ( #bjjb 7#f ,u4,s4,c4 #fea et seq47
 is am5d$-- 7#a7 9 section #bbja 7#f    
,u4,s4,c4 #fea7-- 7,a7 by r$esignat+    
p>agraphs 7#e71 7#f71 & 7#g7 z p>agraphs
 7#h71 7#i71 & 7#aj71 respectively2 &   
7,b7 by ins]t+ aft] p>agraph 7#d7 !     
foll[+3  7#e7 ,op5 s\rce s(tw>e ,! t]m  
op5 s\rce s(tw>e means s(tw>e = :i* !   
human-readable s\rce code is made       
available to ! public = use1 /udy1      
re-use1 modification1 enhancem5t1 &     
re-di/ribution4  7#f7 ,op5 s\rce s(tw>e 
community ,! t]m op5 s\rce s(tw>e       

community means ! community (           
individuals1 f\ndations1 nonpr(it       
organizations1 corporations1 & o!r      
entities t-- 7,a7 develop1 contribute   
to1 ma9ta91 & publi% op5 s\rce s(tw>e2  
or  7,b7 o!rwise "w to ensure ! security
 ( ! op5 s\rce s(tw>e ecosy/em4  7#g7   
,op5 s\rce s(tw>e compon5t ,! t]m op5   
s\rce s(tw>e compon5t means an          
individual repository ( op5 s\rce s(tw>e
 t is made available to ! public4  2    
7#b7 9 section #bbjb7;c7 7#f ,u4,s4,c4  
#feb7;c77-- 7,a7 9 p>agraph 7#ac71 by   
/rik+ & at ! end2  7,b7 by r$esignat+   
p>agraph 7#ad7 z p>agraph 7#ae72 &  7,c7
 by ins]t+ aft] p>agraph 7#ac7 ! foll[+3
  7#ad7 support1 includ+ by (f]+        
s]vices1 ! secure usage & deploym5t (   
s(tw>e1 includ+ op5 s\rce s(tw>e1 9 !   
s(tw>e developm5t lifecycle at ,f$]al   
ag5cies 9 accordance ) section #bbbj;,e2
 &  2 &  7#c7 by add+ at ! end ! foll[+3
  #bbbj;,e4 ,op5 s\rce s(tw>e security  
duties  7a7 ,def9ition ,9 ?is section1 !
 t]m s(tw>e bill ( mat]ials has ! mean+ 

giv5 ! t]m 9 ! ,m9imum ,elem5ts = a     
,s(tw>e ,bill ( ,mat]ials publi%$ by !  
,dep>tm5t ( ,comm]ce1 or any sup]s$+    
def9ition publi%$ by ! ,ag5cy4  7b7     
,employm5t ,! ,director %all1 to !      
greate/ ext5t practicable1 employ       
individuals 9 ! ,ag5cy :o-- 7#a7 h      
exp]tise & exp]i5ce p>ticipat+ 9 ! op5  
s\rce s(tw>e community2 &  7#b7 p]=m !  
duties describ$ 9 subsection 7c74  7c7  
,duties ( ! ,director  7#a7 ,9 g5]al ,! 
,director %all-- 7,a7 p]=m outrea* &    
engagem5t to bol/] ! security ( op5     
s\rce s(tw>e2  7,b7 support ,f$]al ef=ts
 to /r5g!n ! security ( op5 s\rce       
s(tw>e2  7,c7 coord9ate1 z appropriate1 
) non-,f$]al entities on ef=ts to ensure
 ! long-t]m security ( op5 s\rce s(tw>e2
  7,d7 s]ve z a public po9t ( contact   
reg>d+ ! security ( op5 s\rce s(tw>e =  
non-,f$]al entities1 includ+ ,/ate1     
local1 ,tribal1 & t]ritorial p>tn]s1 !  
private sector1 int]national p>tn]s1 op5
 s\rce s(tw>e organizations1 & op5 s\rce
 s(tw>e develop]s2 &  7,e7 support      

,f$]al & non-,f$]al supply *a9 security 
ef=ts by enc\rag+ ef=ts to bol/] op5    
s\rce s(tw>e security1 su* z-- 7i7      
assi/+ 9 coord9at$ vuln]ability         
disclosures 9 op5 s\rce s(tw>e compon5ts
 pursuant to section #bbji7n72 &  7ii7  
support+ ! activities ( ! ,f$]al        
,acquisition ,security ,c\ncil4  7#b7   
,assessm5t ( critical op5 s\rce s(tw>e  
compon5ts  7,a7 ,framework ,n lat] ?an  
#a ye> aft] ! date ( enactm5t ( ?is     
section1 ! ,director %all publicly      
publi% a framework1 incorporat+         
gov]nm5t1 includ+ ^? publi%$ by !       
,national ,in/itute ( ,/&>ds &          
,te*nology1 indu/ry1 & op5 s\rce s(tw>e 
community frameworks & be/ practices1   
includ+ ^? publi%$ by ! ,national       
,in/itute ( ,/&>ds & ,te*nology1 =      
assess+ ! risk ( op5 s\rce s(tw>e       
compon5ts1 includ+ direct & indirect op5
 s\rce s(tw>e dep5d5cies1 :i* %all      
incorporate1 at a m9imum-- 7i7 !        
security prop]ties ( code 9 a giv5 op5  
s\rce s(tw>e compon5t1 su* z :e!r ! code

 is writt5 9 a memory-safe programm+    
language2  7ii7 ! security practices (  
developm5t1 build1 & release processes (
 a giv5 op5 s\rce s(tw>e compon5t1 su* z
 ! use ( multi-factor au!ntication by   
ma9ta9]s & cryptographic sign+ (        
releases2  7iii7 ! numb] & sev]ity (    
publicly kn[n1 unpat*$ vuln]abilities 9 
a giv5 op5 s\rce s(tw>e compon5t2  7iv7 
! bread? ( deploym5t ( a giv5 op5 s\rce 
s(tw>e compon5t2  7v7 ! level ( risk    
associat$ ) :]e a giv5 op5 s\rce s(tw>e 
compon5t is integrat$ or deploy$1 su* z 
:e!r ! compon5t op]ates on a network    
b\nd>y or 9 a privileg$ location2 &     
7vi7 ! heal? ( ! community = a giv5 op5 
s\rce s(tw>e compon5t1 includ+1 :]e     
applicable1 ! level ( curr5t & hi/orical
 inve/m5t & ma9t5ance 9 ! op5 s\rce     
s(tw>e compon5t1 su* z ! numb] &        
activity ( individual ma9ta9]s4  7,b7   
,updat+ framework ,n less frequ5tly ?an 
annually aft] ! date on :i* ! framework 
is publi%$ "u subp>agraph 7,a71 !       
,director %all-- 7i7 det]m9e :e!r       

additional updates are ne$$ to !        
framework describ$ 9 subp>agraph 7,a72 &
  7ii7 if ! ,director det]m9es t        
additional updates are ne$$ "u clause   
7i71 make ^? updates to ! framework4    
7,c7 ,develop+ framework ,9 develop+ !  
framework describ$ 9 subp>agraph 7,a71 !
 ,director %all consult )-- 7i7         
appropriate ,f$]al ag5cies1 includ+ !   
,national ,in/itute ( ,/&>ds &          
,te*nology2  7ii7 individuals & nonpr(it
 organizations f ! op5 s\rce s(tw>e     
community2 &  7iii7 private companies f 
! op5 s\rce s(tw>e community4  7,d7     
,f$]al op5 s\rce s(tw>e assessm5t ,n    
lat] ?an #a ye> aft] ! publication ( !  
framework describ$ 9 subp>agraph 7,a71 &
 n less frequ5tly ?an e #b ye>s !reaft]1
 ! ,director %all1 to ! greate/ ext5t   
practicable & us+ ! framework describ$ 9
 subp>agraph 7,a7-- 7i7 p]=m an         
assessm5t ( op5 s\rce s(tw>e compon5ts  
us$ directly or indirectly by ,f$]al    
ag5cies bas$ on readily available1 &1 to
 ! greate/ ext5t practicable1 ma*9e     

readable1 in=mation1 su* z-- 7,i7 s(tw>e
 bills ( mat]ial t are made available to
 ! ,ag5cy or are o!rwise accessible via 
! int]net2  7,,ii7 s(tw>e inv5tories    
collect$ f ! ,cont9u\s ,diagno/ics &    
,mitigation program ( ! ,ag5cy2 &       
7,,iii7 o!r publicly available in=mation
 reg>d+ op5 s\rce s(tw>e compon5ts2 &   
7ii7 develop #a or m rank$ li/s (       
compon5ts describ$ 9 clause 7i7 bas$ on 
! assessm5t1 su* z rank$ by !           
criticality1 level ( risk1 or usage ( ! 
compon5ts1 or a comb9ation !re(4  7,e7  
,automation ,! ,director %all1 to !     
greate/ ext5t practicable1 automate !   
assessm5t conduct$ "u subp>agraph 7,d74 
7,f7 ,publication ,! ,director %all     
publicly publi% & ma9ta9 any tools      
develop$ to conduct ! assessm5t describ$
 9 subp>agraph 7,d7 z op5 s\rce s(tw>e4 
7,g7 ,%>+  7i7 ,results ,! ,director    
%all facilitate ! %>+ ( ! results ( !   
assessm5t describ$ 9 subp>agraph 7,d7 ) 
appropriate ,f$]al & non-,f$]al entities
 work+ to support ! security ( op5 s\rce

 s(tw>e1 includ+ by (f]+ means =        
appropriate ,f$]al & non-,f$]al entities
 to d[nload ! assessm5t 9 an automat$   
mann]4  7ii7 ,datasets ,! ,director may 
publicly publi%1 z appropriate1 any     
datasets or v]sions ( ! datasets        
develop$ or consolidat$ z a result ( !  
assessm5t describ$ 9 subp>agraph 7,d74  
7,h7 ,critical infra/ructure assessm5t  
/udy & pilot  7i7 ,/udy ,n lat] ?an #b  
ye>s aft] ! publication ( ! framework   
describ$ 9 subp>agraph 7,a71 ! ,director
 %all conduct a /udy reg>d+ !           
feasibility ( ! ,director conduct+ !    
assessm5t describ$ 9 subp>agraph 7,d7 = 
critical infra/ructure entities4  7ii7  
,pilot ,if ! ,director det]m9es t !     
assessm5t describ$ 9 clause 7i7 is      
feasible1 ! ,director may conduct a     
pilot assessm5t on a volunt>y basis ) #a
 or m critical infra/ructure sectors1 9 
coord9ation ) ! ,sector ,risk ,managem5t
 ,ag5cy & ! sector coord9at+ c\ncil (   
ea* p>ticipat+ sector4  7iii7 ,reports  
7,i7 ,/udy ,n lat] ?an #ahj days aft] ! 

date on :i* ! ,director completes ! /udy
 conduct$ "u clause 7i71 ! ,director    
%all submit to ! appropriate            
congressional committees a report t--   
7aa7 summ>izes ! /udy2 &  7bb7 /ates    
:e!r ! ,director plans to proce$ ) !    
pilot describ$ 9 clause 7ii74  7,,ii7   
,pilot ,if ! ,director proce$s ) ! pilot
 describ$ 9 clause 7ii71 n lat] ?an #a  
ye> aft] ! date on :i* ! ,director beg9s
 ! pilot1 ! ,director %all submit to !  
appropriate congressional committees a  
report t includes-- 7aa7 a summ>y ( !   
results ( ! pilot2 &  7bb7 a            
recomm5dation z to :e!r ! pilot %\ld be 
cont9u$4  7#c7 ,coord9ation ) ,national 
,cyb] ,director ,! ,director %all-- 7,a7
 brief ! ,national ,cyb] ,director on ! 
activities describ$ 9 ?is subsection2 & 
7,b7 coord9ate activities ) ! ,national 
,cyb] ,director1 z appropriate4  7#d7   
,reports  7,a7 ,9 g5]al ,n lat] ?an #a  
ye> aft] ! date ( enactm5t ( ?is        
section1 & e #b ye>s !reaft]1 !         
,director %all submit to ! appropriate  

congressional committees a report t     
includes-- 7i7 a summ>y ( ! "w on op5   
s\rce s(tw>e security p]=m$ by !        
,director dur+ ! p]iod cov]$ by !       
report1 includ+ a li/ ( ! ,f$]al &      
non-,f$]al entities ) :i* ! ,director   
int]fac$2  7ii7 ! framework develop$ "u 
p>agraph 7#b77;,a72  7iii7 a summ>y (   
*anges made to ! framework develop$ "u  
p>agraph 7#b77;,a7 s9ce ! la/ report    
submitt$ "u ?is subp>agraph2  7iv7 a    
summ>y ( ! assessm5t conduct$ pursuant  
to p>agraph 7#b77;,d72  7v7 a summ>y (  
*anges made to ! assessm5t conduct$     
pursuant to p>agraph 7#b77;,d7 s9ce !   
la/ report submitt$ "u ?is subp>agraph1 
includ+ ov]all security tr5ds2 &  7vi7 a
 summ>y ( ! types ( entities ) :i* !    
assessm5t 0 %>$ pursuant to p>agraph    
7#b77;,g71 includ+ a li/ ( ! ,f$]al &   
non-,f$]al entities ) :i* ! assessm5t 0 
%>$4  7,b7 ,public report ,n lat] ?an   
#cj days aft] ! date on :i* ! ,director 
submits a report requir$ "u subp>agraph 
7,a71 ! ,director %all make a v]sion ( !

 report publicly available on ! website 
( ! ,ag5cy4  4  7b7 ,te*nical & con=m+  
am5dm5t ,! table ( cont5ts 9 section    
#a7;b7 ( ! ,homel& ,security ,act (     
#bjjb 7,public ,law #ajg-bif2 #aaf ,/at4
 #bace7 is am5d$-- 7#a7 by mov+ ! item  
relat+ to section #bbbj;,d to appe> aft]
 ! item relat+ to section #bbbj;,c2 &   
7#b7 by ins]t+ aft] ! item relat+ to    
section #bbbj;,d ! foll[+3  ,sec4       
#bbbj;,e4 ,op5 s\rce s(tw>e security    
duties4  4  #d4 ,s(tw>e security        
advisory subcommittee ,section          
#bbai7;d77#a7 ( ! ,homel& ,security ,act
 ( #bjjb 7#f ,u4,s4,c4 #ffe;e7d77#a77 is
 am5d$ by add+ at ! end ! foll[+3  7,e7 
,s(tw>e security1 includ+ op5 s\rce     
s(tw>e security4  4  #e4 ,op5 s\rce     
s(tw>e guidance  7a7 ,def9itions ,9 ?is 
section3 7#a7 ,appropriate congressional
 committee ,! t]m appropriate           
congressional committee has ! mean+ giv5
 ! t]m 9 section #b ( ! ,homel&         
,security ,act ( #bjjb 7#f ,u4,s4,c4    
#aja74  7#b7 ,cov]$ ag5cy ,! t]m cov]$  

ag5cy means an ag5cy describ$ 9 section 
#ija7;b7 ( title #ca1 ,unit$ ,/ates     
,code4  7#c7 ,director ,! t]m ,director 
means ! ,director ( ! ,(fice (          
,managem5t & ,budget4  7#d7 ,national   
security sy/em ,! t]m national security 
sy/em has ! mean+ giv5 ! t]m 9 section  
#ceeb ( title #dd1 ,unit$ ,/ates ,code4 
7#d77e7 ,op5 s\rce s(tw>e2 op5 s\rce    
s(tw>e community ,! t]ms op5 s\rce      
s(tw>e & op5 s\rce s(tw>e community h ! 
mean+s giv5 ^? t]ms 9 section #bbja ( ! 
,homel& ,security ,act ( #bjjb 7#f      
,u4,s4,c4 #fea71 z am5d$ by section #c (
 ?is ,act4  7b7 ,guidance  7#a7 ,9 g5]al
 ,n lat] ?an #a ye> aft] ! date (       
enactm5t ( ?is ,act1 ! ,director1 9     
coord9ation ) ! ,national ,cyb]         
,director1 ! ,director ( ! ,cyb]security
 & ,infra/ructure ,security ,ag5cy1 & ! 
,adm9i/rator ( ,g5]al ,s]vices1 %all    
issue guidance on ! responsibilities ( !
 *ief in=mation (fic] at ea* cov]$ ag5cy
 reg>d+ op5 s\rce s(tw>e1 :i* %all      
include-- 7,a7 h[ *ief in=mation (fic]s 

at ea* cov]$ ag5cy %\ld1 consid]+       
indu/ry & op5 s\rce s(tw>e community be/
 practices-- 7i7 manage & r$uce risks ( 
us+ op5 s\rce s(tw>e2 &  7ii7 guide     
contribut+ to & releas+ op5 s\rce       
s(tw>e2  7,b7 h[ *ief in=mation (fic]s  
%\ld enable1 r ?an inhibit1 ! secure    
usage ( op5 s\rce s(tw>e at ea* cov]$   
ag5cy2  7,c7 any relevant updates to !  
,memor&um ,m-#af-ba issu$ by ! ,(fice ( 
,managem5t & ,budget on ,augu/ #h1      
#bjaf1 entitl$1 ,f$]al ,s\rce ,code     
,policy3 ,a*iev+ ,effici5cy1            
,transp>5cy1 & ,innovation ?r\gh        
,reusable & ,op5 ,s\rce ,s(tw>e2 &  7,d7
 h[ cov]$ ag5cies may contribute        
publicly to op5 s\rce s(tw>e t ! cov]$  
ag5cy uses1 includ+ h[ *ief in=mation   
(fic]s %\ld enc\rage ^? contributions4  
7#b7 ,exemption ( national security     
sy/ems ,! guidance issu$ "u p>agraph    
7#a7 %all n apply to national security  
sy/ems4  7c7 ,pilot  7#a7 ,9 g5]al ,n   
lat] ?an #a ye> aft] ! date ( enactm5t (
 ?is ,act1 ! *ief in=mation (fic] ( ea* 

cov]$ ag5cy describ$ inselect$ "u       
p>agraph 7#b71 9 coord9ation ) !        
,director1 ! ,national ,cyb] ,director1 
! ,director ( ! ,cyb]security &         
,infra/ructure ,security ,ag5cy1 & !    
,adm9i/rator ( ,g5]al ,s]vices1 %all    
e/abli% a pilot op5 s\rce function at ! 
cov]$ ag5cy t-- 7,a7 is model$ aft] op5 
s\rce program (fices1 su* z ^? 9 !      
private sector1 ! nonpr(it sector1      
academia1 & o!r non-,f$]al entities2 &  
7,b7 %all-- 7i7 support ! secure usage (
 op5 s\rce s(tw>e at ! cov]$ ag5cy2     
7ii7 develop policies & processes =     
contributions to & releases ( op5 s\rce 
s(tw>e at ! cov]$ ag5cy1 9 consultation1
 z appropriate1 ) ! ,o(fices ( ,gg5]al  
,cc\nsel & ,pprocurem5t ( ! cov]$ ag5cy2
  7iii7 int]face ) ! op5 s\rce s(tw>e   
community2 &  7iv7 manage & r$uce risks 
( consum+us+ op5 s\rce s(tw>e at ! cov]$
 ag5cy4  7#b7 ,selection ( pilot ag5cies
 ,! ,director1 9 coord9ation ) !        
,national ,cyb] ,director1 ! ,director (
 ! ,cyb]security & ,infra/ructure       

,security ,ag5cy1 & ! ,adm9i/rator (    
,g5]al ,s]vices1 %all select #a or m    
cov]$ ag5cies to conduct ! pilot        
describ$ 9 p>agraph 7#a7  7#c7          
,assessm5t ,n lat] ?an #a ye> aft] !    
e/abli%m5t ( ! pilot op5 s\rce functions
 describ$ 9 p>agraph 7#a71 ! ,director1 
9 coord9ation ) ! ,national ,cyb]       
,director1 ! ,director ( ! ,cyb]security
 & ,infra/ructure ,security ,ag5cy1 & ! 
,adm9i/rator ( ,g5]al ,s]vices1 %all    
assess :e!r op5 s\rce functions %\ld be 
e/abli%$ at "s or all cov]$ ag5cies1    
includ+-- 7,a7 h[ to organize ^?        
functions )9 cov]$ ag5cies1 su* z !     
creation ( op5 s\rce program (fices2 &  
7,b7 appropriate roles &                
responsibilities = ^? functions4  7#d7  
,guidance ,if ! ,director det]m9es1 bas$
 on ! assessm5t describ$ 9 p>agraph     
7#c71 t "s or all ( ! op5 s\rce         
functions %\ld be e/abli%$ at "s or all 
cov]$ ag5cies1 ! ,director1 9           
coord9ation ) ! ,national ,cyb]         
,director1 ! ,director ( ! ,cyb]security

 & ,infra/ructure ,security ,ag5cy1 & ! 
,adm9i/rator ( ,g5]al ,s]vices1 %all    
issue guidance on ! implem5tation ( ^?  
functions4  7d7 ,brief+ & report ,!     
,director %all-- 7#a7 n lat] ?an #a ye> 
aft] ! date ( enactm5t ( ?is ,act1 brief
 ! appropriate congressional committees 
on ! guidance issu$ "u subsection 7b72 &
  7#b7 n lat] ?an #edj days aft] !      
e/abli%m5t ( ! pilot op5 s\rce functions
 "u subsection 7c77#a71 submit to !     
appropriate congressional committees a  
report on-- 7,a7 ! pilot op5 s\rce      
functions2 &  7,b7 ! results ( !        
assessm5t conduct$ "u subsection        
7c77#c74  7e7 ,duties ,section #ceed7;b7
 ( title #dd1 ,unit$ ,/ates ,code1 is   
am5d$-- 7#a7 9 p>agraph 7#g71 by /rik+ &
 at ! end2  7#b7 9 p>agraph 7#h71 by    
/rik+ ! p]iod at ! end & ins]t+ 2 &2 &  
7#c7 by add+ at ! end ! foll[+3  7#i7   
plans & proc$ures to ensure ! secure    
usage & developm5t ( s(tw>e1 includ+ op5
 s\rce s(tw>e4  4  #f4 ,rule (          
con/ruction ,no?+ 9 ?is ,act or !       

am5dm5ts made by ?is ,act %all be       
con/ru$ to provide any additional       
regulatory au?ority to any ,f$]al ag5cy 
describ$ !re94  ,decemb] #ai1           
#bjbb,report$ ) am5dm5ts