,,ib ,union ,calendar ,no4 #abg #aahth ,,congress #ast ,session ,h4 ,r4 #cbhf ,report ,no4 #aah-afj1 ,part ,i ,,in ,,the ,,house ,,of ,,representatives ,may #ae1 #bjbc,mr4 ,green of ,tennessee 7for himself1 ,mr4 ,garbarino1 and ,mr4 ,swalwell7 introduced the following bill2 which was referred to the ,committee on ,homeland ,security1 and in addition to the ,committee on ,oversight and ,accountability1 for a period to be subsequently determined by the ,speaker1 in each case for consideration of such provisions as fall within the jurisdiction of the committee concerned ,july #bg1 #bjbc;,additional sponsor3 ,mr4 ,la,lota ,july #bg1 #bjbc,reported from the ,committee on ,homeland ,security with an amendment,strike out all after the enacting clause and insert the part printed in italic ,july #bg1 #bjbc;,committee on ,oversight and ,accountability discharged2 committed to the ,committee of the ,whole ,house on the ,state of the ,union and ordered to be printed,for text of introduced bill1 see copy of bill as introduced on ,may #ae1 #bjbc ,a ,,bill ,to amend the ,homeland ,security ,act of #bjjb to establish the duties of the ,director of the ,cybersecurity and ,infrastructure ,security ,agency regarding open source software security1 and for other purposes4 #a4 ,short title ,this ,act may be cited as the ,securing ,open ,source ,software ,act of #bjbc4 #b4 ,open source software security duties 7a7 ,in general ,title ,,xxii of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #fej et seq47 is amended-- 7#a7 in section #bbjj 7#f ,u4,s4,c4 #fej7-- 7,a7 by redesignating paragraphs 7#bb7 through 7#bh7 as paragraphs 7#be7 through 7#ca71 respectively2 and 7,b7 by inserting after paragraph 7#ba7 the following new paragraphs3 7#bb7 ,open source software ,the term open source software means software for which the human-readable source code is made available to the public for use1 study1 re-use1 modification1 enhancement1 and re-distribution4 7#bc7 ,open source software community ,the term open source software community means the community of individuals1 foundations1 nonprofit organizations1 corporations1 and other entities that-- 7,a7 develop1 contribute to1 maintain1 and publish open source software2 or 7,b7 otherwise work to ensure the security of the open source software ecosystem4 7#bd7 ,open source software component ,the term open source software component means an individual repository of open source software that is made available to the public4 2 7#b7 in section #bbjb7;c7 7#f ,u4,s4,c4 #feb7;c77-- 7,a7 in paragraph 7#ac71 by striking and at the end2 7,b7 by redesignating paragraph 7#ad7 as paragraph 7#ae72 and 7,c7 by inserting after paragraph 7#ac7 the following3 7#ad7 support1 including by offering services1 the secure usage and deployment of software1 including open source software1 in the software development lifecycle at ,federal agencies in accordance with section #bbbj;,f2 and 2 and 7#c7 by adding at the end the following3 #bbbj;,f4 ,open source software security duties 7a7 ,definition ,in this section1 the term software bill of materials has the meaning given such term in the ,minimum ,elements for a ,software ,bill of ,materials published by the ,department of ,commerce1 or any superseding definition published by the ,agency4 7b7 ,employment ,the ,director shall1 to the greatest extent practicable1 employ individuals in the ,agency who-- 7#a7 have expertise and experience participating in the open source software community2 and 7#b7 perform the duties described in subsection 7c74 7c7 ,duties of the ,director 7#a7 ,in general ,the ,director shall-- 7,a7 perform outreach and engagement to bolster the security of open source software2 7,b7 support ,federal efforts to strengthen the security of open source software2 7,c7 coordinate1 as appropriate1 with non-,federal entities on efforts to ensure the long-term security of open source software2 7,d7 serve as a public point of contact regarding the security of open source software for non-,federal entities1 including ,state1 local1 ,tribal1 and territorial partners1 the private sector1 international partners1 and open source software communities2 and 7,e7 support ,federal and non-,federal supply chain security efforts by encouraging efforts to bolster open source software security1 such as-- 7i7 assisting in coordinated vulnerability disclosures in open source software components pursuant to section #bbji7n72 and 7ii7 supporting the activities of the ,federal ,acquisition ,security ,council4 7#b7 ,assessment of critical open source software components 7,a7 ,framework ,not later than one year after the date of the enactment of this section1 the ,director shall publicly publish a framework1 incorporating government1 private sector1 and open source software community frameworks and best practices1 including those published by the ,national ,institute of ,standards and ,technology1 for assessing the risk of open source software components1 including direct and indirect open source software dependencies1 which shall incorporate1 at a minimum1 the following with respect to a given open source software component3 7i7 ,the security properties of code1 such as whether the code is written in a memory-safe programming language or successor language4 7ii7 ,the security practices of development1 build1 and release processes1 such as the use of multi-factor authentication by maintainers and cryptographic signing of releases4 7iii7 ,the number and severity of publicly known1 unpatched vulnerabilities4 7iv7 ,the breadth of deployment4 7v7 ,the level of risk associated with where such component is integrated or deployed1 such as whether such component operates on a network boundary or in a privileged location4 7vi7 ,the health and sustainability of the open source software community1 including1 where applicable1 the level of current and historical investment and maintenance in such component1 such as the number and activity of individual maintainers4 7,b7 ,updating framework ,not less frequently than annually after the date on which the framework is published under subparagraph 7,a71 the ,director shall-- 7i7 determine whether updates are needed to such framework1 including the augmentation1 addition1 or removal of the elements described in clauses 7i7 through 7vi7 of such subparagraph2 and 7ii7 if the ,director so determines that such additional updates are needed1 make such updates4 7,c7 ,developing framework ,in developing the framework described in subparagraph 7,a71 the ,director shall consult with the following3 7i7 ,appropriate ,federal agencies1 including the ,national ,institute of ,standards and ,technology4 7ii7 ,the open source software community4 7,d7 ,usability ,the ,director shall ensure1 to the greatest extent practicable1 that the framework described in subparagraph 7,a7 is usable by the open source software community1 including through the consultation required under subparagraph 7,c74 7,e7 ,federal open source software assessment ,not later than one year after the publication of the framework under subparagraph 7,a7 and not less frequently than every two years thereafter1 the ,director shall1 to the greatest extent practicable and using such framework-- 7i7 perform an assessment of each open source software component deployed on high value assets1 as described in ,office of ,management and ,budget memorandum ,m-#ai-jc 7issued ,december #aj1 #bjah7 or successor guidance1 at ,federal agencies based on readily available1 and1 to the greatest extent practicable1 machine readable1 information1 such as-- 7,i7 software bills of material that are1 at the time of the assessment1 made available to the ,agency or are otherwise accessible via the internet2 7,,ii7 software inventories1 available to the ,director at the time of the assessment1 from the ,continuous ,diagnostics and ,mitigation program of the ,agency2 and 7,,iii7 other publicly available information regarding open source software components2 and 7ii7 develop1 in consultation with the ,federal agency at which an open source software component is deployed1 one or more ranked lists of components described in clause 7i7 based on such assessment1 such as ranked by the criticality1 level of risk1 or usage of the components1 or a combination thereof4 7,f7 ,automation ,the ,director shall1 to the greatest extent practicable1 automate the assessment performed pursuant to subparagraph 7,e74 7,g7 ,publication ,the ,director shall publicly publish and maintain any tools developed to perform the assessment under subparagraph 7,e7 as open source software4 7,h7 ,sharing 7i7 ,results ,the ,director1 to the greatest extent practicable1 and taking into account the sensitivity of the information contained in the assessment performed pursuant to subparagraph 7,e71 shall facilitate the sharing of the results of each assessment under subparagraph 7,e77i7 with appropriate ,federal and non-,federal entities working to support the security of open source software1 including by offering means for appropriate ,federal and non-,federal entities to download the assessment in an automated manner4 7ii7 ,datasets ,the ,director may publicly publish1 as appropriate1 any datasets or versions of the datasets developed or consolidated as a result of an assessment under subparagraph 7,e77i74 7,i7 ,critical infrastructure assessment study and pilot 7i7 ,study ,not later than two years after the publication of the framework under subparagraph 7,a71 the ,director shall conduct a study regarding the feasibility of the ,director conducting the assessment under subparagraph 7,e7 for critical infrastructure entities4 7ii7 ,pilot 7,i7 ,in general ,if the ,director determines that the assessment described in clause 7i7 is feasible1 the ,director may conduct a pilot assessment on a voluntary basis with one or more critical infrastructure sectors1 in coordination with the ,sector ,risk ,management ,agency and the sector coordinating council of each participating sector4 7,,ii7 ,termination ,if the ,director proceeds with the pilot assessment described in subclause 7,i71 such pilot assessment shall terminate not later than two years after the date on which the ,director begins such pilot assessment4 7iii7 ,reports 7,i7 ,study ,not later than #ahj days after the date on which the ,director completes the study conducted under clause 7i71 the ,director shall submit to the appropriate congressional committees a report that-- 7aa7 summarizes the study2 7bb7 states whether the ,director plans to proceed with the pilot assessment described in clause 7ii77,i72 and 7cc7 if the ,director proceeds with such pilot assessment1 describes-- 7,,aa7 the methodology for selecting the critical infrastructure sector or sectors to participate in the pilot2 and 7,,bb7 the resources required to carry out the pilot4 7,,ii7 ,pilot ,if the ,director proceeds with the pilot assessment described in clause 7ii71 not later than one year after the date on which the ,director begins such pilot assessment1 the ,director shall submit to the appropriate congressional committees a report that includes the following3 7aa7 ,a summary of the results of such pilot assessment4 7bb7 ,a recommendation as to whether the activities carried out under such pilot assessment should be continued after the termination of such pilot assessment in accordance with clause 7ii77,,ii74 7#c7 ,consultation with ,national ,cyber ,director ,the ,director shall-- 7,a7 brief the ,national ,cyber ,director on the activities described in this subsection2 and 7,b7 consult with the ,national ,cyber ,director regarding such activities1 as appropriate4 7#d7 ,reports 7,a7 ,in general ,not later than one year after the date of the enactment of this section and every two years thereafter for the following six years1 the ,director shall submit to the appropriate congressional committees a report that includes for the period covered by each such report the following3 7i7 ,a summary of the work on open source software security performed by the ,director1 including a list of the ,federal and non-,federal entities with which the ,director interfaced4 7ii7 ,the framework under paragraph 7#b77;,a7 or a summary of any updates to such framework pursuant to paragraph 7#b77;,b71 as the case may be4 7iii7 ,a summary of each assessment under paragraph 7#b77;,e77i74 7iv7 ,a summary of changes made to each such assessment1 including overall security trends4 7v7 ,a summary of the types of entities with which each such assessment was shared pursuant to paragraph 7#b77;,h71 including a list of the ,federal and non-,federal entities with which such assessment was shared4 7vi7 ,information on resources1 including staffing1 allocated to the ,director's open source software responsibilities under this section4 7,b7 ,public report ,not later than #cj days after the date on which the ,director submits each report required under subparagraph 7,a71 the ,director shall make a version of each such report publicly available on the website of the ,agency4 4 7b7 ,technical and conforming amendment ,the table of contents in section #a7;b7 of the ,homeland ,security ,act of #bjjb is amended by inserting after the item relating to section #bbbj;,e the following new item3 ,sec4 #bbbj;,f4 ,open source software security duties4 4 7c7 ,software security advisory subcommittee ,section #bbai7;d77#a7 of the ,homeland ,security ,act of #bjjb 7#f ,u4,s4,c4 #ffe;e7d77#a77 is amended by adding at the end the following3 7,e7 ,software security1 including open source software security4 4 7d7 ,rule of construction ,nothing in this ,act or the amendments made by this ,act may be construed to provide any additional regulatory authority to any ,federal agency described therein4 ,july #bg1 #bjbc,reported from the ,committee on ,homeland ,security with an amendment,july #bg1 #bjbc;,committee on ,oversight and ,accountability discharged2 committed to the ,committee of the ,whole ,house on the ,state of the ,union and ordered to be printed